diff --git a/apps.yaml b/apps.yaml
index dbfe0ad872..70ba41f1ae 100644
--- a/apps.yaml
+++ b/apps.yaml
@@ -97,7 +97,7 @@ appsInfo:
     integration: App Platform has security best practices built in, and is designed for intrusion. Istio is used by App Platform as a service mesh to deliver mTLS enforcement for all traffic that is deemed compromisable, egress control to force teams to choose explicit egress endpoints, and advanced routing capabilities such as weight based load balancing (A/B or blue/green testing). Istio is part of the core of App Platform and can not be disabled.
   keycloak:
     title: Keycloak
-    appVersion: 26.6.2
+    appVersion: 26.6.4
     repo: https://github.com/keycloak/keycloak
     maintainers: Keycloak
     relatedLinks:
diff --git a/chart/chart-index/Chart.yaml b/chart/chart-index/Chart.yaml
index dcdc5adb0d..9b6d52efe3 100644
--- a/chart/chart-index/Chart.yaml
+++ b/chart/chart-index/Chart.yaml
@@ -60,7 +60,7 @@ dependencies:
     repository: https://istio-release.storage.googleapis.com/charts
   - name: keycloakx
     alias: keycloak
-    version: 7.2.0
+    version: 7.2.2
     repository: https://codecentric.github.io/helm-charts
   - name: knative-operator
     version: v1.22.2
diff --git a/charts/keycloak/Chart.yaml b/charts/keycloak/Chart.yaml
index 3080ad3607..20ace70793 100644
--- a/charts/keycloak/Chart.yaml
+++ b/charts/keycloak/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 26.6.3
+appVersion: 26.6.4
 description: Keycloak.X - Open Source Identity and Access Management for Modern Applications
   and Services
 home: https://www.keycloak.org/
@@ -21,4 +21,4 @@ name: keycloakx
 sources:
 - https://github.com/codecentric/helm-charts
 - https://github.com/keycloak/keycloak/tree/main/quarkus/container
-version: 7.2.0
+version: 7.2.2
diff --git a/charts/keycloak/README.md b/charts/keycloak/README.md
index 43e31c331c..0e574e7810 100644
--- a/charts/keycloak/README.md
+++ b/charts/keycloak/README.md
@@ -66,6 +66,7 @@ The following table lists the configurable parameters of the Keycloak-X chart an
 |-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `fullnameOverride`                            | Optionally override the fully qualified name                                                                                                                                                                                                                                      | `""`                                                                                                                                                                                    |
 | `nameOverride`                                | Optionally override the name                                                                                                                                                                                                                                                      | `""`                                                                                                                                                                                    |
+| `namespaceOverride`                           | Optionally override the namespace for all resources. Useful for umbrella charts that deploy multiple aliased keycloak instances each into their own namespace.                                                                                                                     | `""`                                                                                                                                                                                    |
 | `replicas`                                    | The number of replicas to create                                                                                                                                                                                                                                                  | `1`                                                                                                                                                                                     |
 | `image.repository`                            | The Keycloak image repository                                                                                                                                                                                                                                                     | `quay.io/keycloak/keycloak`                                                                                                                                                             |
 | `image.tag`                                   | Overrides the Keycloak image tag whose default is the chart version                                                                                                                                                                                                               | `""`                                                                                                                                                                                    |
@@ -124,6 +125,7 @@ The following table lists the configurable parameters of the Keycloak-X chart an
 | `service.loadBalancerIP`                      | Optional IP for the load balancer. Used for services of type LoadBalancer only                                                                                                                                                                                                    | `""`                                                                                                                                                                                    |
 | `loadBalancerSourceRanges`                    | Optional List of allowed source ranges (CIDRs). Used for service of type LoadBalancer only                                                                                                                                                                                        | `[]`                                                                                                                                                                                    |
 | `service.externalTrafficPolicy`               | Optional external traffic policy. Used for services of type LoadBalancer & NodePort only                                                                                                                                                                                                     | `"Cluster"`                                                                                                                                                                             |
+| `service.internalTrafficPolicy`               | Optional internal traffic policy. Valid values: `Cluster`, `Local`.                                                                                                                                                                                                                | `""`                                                                                                                                                                                    |
 | `service.httpPort`                            | The http Service port                                                                                                                                                                                                                                                             | `80`                                                                                                                                                                                    |
 | `service.httpNodePort`                        | The HTTP Service node port if type is NodePort                                                                                                                                                                                                                                    | `""`                                                                                                                                                                                    |
 | `service.httpsPort`                           | The HTTPS Service port                                                                                                                                                                                                                                                            | `8443`                                                                                                                                                                                  |
diff --git a/charts/keycloak/templates/NOTES.txt b/charts/keycloak/templates/NOTES.txt
index da4e504106..2da9f26d52 100644
--- a/charts/keycloak/templates/NOTES.txt
+++ b/charts/keycloak/templates/NOTES.txt
@@ -19,15 +19,15 @@ Keycloak was installed with a Service of type NodePort.
 {{ if .Values.service.httpNodePort }}
 Get its HTTP URL with the following commands:
 
-export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} service {{ include "keycloak.fullname" . }}-http --template='{{"{{ range .spec.ports }}{{ if eq .name \"http\" }}{{ .nodePort }}{{ end }}{{ end }}"}}')
-export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+export NODE_PORT=$(kubectl get --namespace {{ include "keycloak.namespace" . }} service {{ include "keycloak.fullname" . }}-http --template='{{"{{ range .spec.ports }}{{ if eq .name \"http\" }}{{ .nodePort }}{{ end }}{{ end }}"}}')
+export NODE_IP=$(kubectl get nodes --namespace {{ include "keycloak.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
 echo "http://$NODE_IP:$NODE_PORT"
 {{- end }}
 {{ if .Values.service.httpsNodePort }}
 Get its HTTPS URL with the following commands:
 
-export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} service {{ include "keycloak.fullname" . }}-http --template='{{"{{ range .spec.ports }}{{ if eq .name \"https\" }}{{ .nodePort }}{{ end }}{{ end }}"}}')
-export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+export NODE_PORT=$(kubectl get --namespace {{ include "keycloak.namespace" . }} service {{ include "keycloak.fullname" . }}-http --template='{{"{{ range .spec.ports }}{{ if eq .name \"https\" }}{{ .nodePort }}{{ end }}{{ end }}"}}')
+export NODE_IP=$(kubectl get nodes --namespace {{ include "keycloak.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
 echo "http://$NODE_IP:$NODE_PORT"
 {{- end }}
 
@@ -36,16 +36,16 @@ echo "http://$NODE_IP:$NODE_PORT"
 Keycloak was installed with a Service of type LoadBalancer
 
 NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-     You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} service -w {{ include "keycloak.fullname" . }}'
+     You can watch the status of by running 'kubectl get --namespace {{ include "keycloak.namespace" . }} service -w {{ include "keycloak.fullname" . }}'
 
 Get its HTTP URL with the following commands:
 
-export SERVICE_IP=$(kubectl get service --namespace {{ .Release.Namespace }} {{ include "keycloak.fullname" . }}-http --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+export SERVICE_IP=$(kubectl get service --namespace {{ include "keycloak.namespace" . }} {{ include "keycloak.fullname" . }}-http --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
 echo "http://$SERVICE_IP:{{ .Values.service.httpPort }}"
 
 Get its HTTPS URL with the following commands:
 
-export SERVICE_IP=$(kubectl get service --namespace {{ .Release.Namespace }} {{ include "keycloak.fullname" . }}-http --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+export SERVICE_IP=$(kubectl get service --namespace {{ include "keycloak.namespace" . }} {{ include "keycloak.fullname" . }}-http --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
 echo "http://$SERVICE_IP:{{ .Values.service.httpsPort }}"
 
 {{- else if eq "ClusterIP" .Values.service.type }}
@@ -54,8 +54,8 @@ Keycloak was installed with a Service of type ClusterIP
 
 Create a port-forwarding with the following commands:
 
-export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "keycloak.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o name)
+export POD_NAME=$(kubectl get pods --namespace {{ include "keycloak.namespace" . }} -l "app.kubernetes.io/name={{ include "keycloak.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o name)
 echo "Visit http://127.0.0.1:8080 to use your application"
-kubectl --namespace {{ .Release.Namespace }} port-forward "$POD_NAME" 8080
+kubectl --namespace {{ include "keycloak.namespace" . }} port-forward "$POD_NAME" 8080
 
 {{- end }}
diff --git a/charts/keycloak/templates/_helpers.tpl b/charts/keycloak/templates/_helpers.tpl
index c935d5afbc..f993a6b630 100644
--- a/charts/keycloak/templates/_helpers.tpl
+++ b/charts/keycloak/templates/_helpers.tpl
@@ -62,7 +62,14 @@ Create the name of the service account to use
 Create the service DNS name.
 */}}
 {{- define "keycloak.serviceDnsName" -}}
-{{ include "keycloak.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
+{{ include "keycloak.fullname" . }}-headless.{{ include "keycloak.namespace" . }}.svc.{{ .Values.clusterDomain }}
+{{- end }}
+
+{{/*
+Namespace for all resources. Callers can override via .Values.namespaceOverride.
+*/}}
+{{- define "keycloak.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride -}}
 {{- end }}
 
 {{- define "keycloak.databasePasswordEnv" -}}
diff --git a/charts/keycloak/templates/configmap-startup.yaml b/charts/keycloak/templates/configmap-startup.yaml
index 72fffa7585..1bf5944261 100644
--- a/charts/keycloak/templates/configmap-startup.yaml
+++ b/charts/keycloak/templates/configmap-startup.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "keycloak.fullname" . }}-startup
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
 data:
diff --git a/charts/keycloak/templates/database-secret.yaml b/charts/keycloak/templates/database-secret.yaml
index 2bd4056a83..1e649b581a 100644
--- a/charts/keycloak/templates/database-secret.yaml
+++ b/charts/keycloak/templates/database-secret.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "keycloak.fullname" $ }}-database
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
   {{- include "keycloak.labels" $ | nindent 4 }}
 type: Opaque
diff --git a/charts/keycloak/templates/hpa.yaml b/charts/keycloak/templates/hpa.yaml
index e1c9435eaf..2c56ffaef2 100644
--- a/charts/keycloak/templates/hpa.yaml
+++ b/charts/keycloak/templates/hpa.yaml
@@ -3,7 +3,7 @@ apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
     {{- range $key, $value := .Values.autoscaling.labels }}
diff --git a/charts/keycloak/templates/httproute.yaml b/charts/keycloak/templates/httproute.yaml
index 6c4b031b8d..857c6ad6eb 100644
--- a/charts/keycloak/templates/httproute.yaml
+++ b/charts/keycloak/templates/httproute.yaml
@@ -4,7 +4,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
     {{- range $key, $value := $httpRoute.labels }}
@@ -47,12 +47,12 @@ spec:
     {{- end }}
 {{- end }}
 ---
-{{- if $httpRoute.console.enabled -}}
+{{- if $httpRoute.console.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "keycloak.fullname" . }}-console
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
     {{- range $key, $value := $httpRoute.labels }}
diff --git a/charts/keycloak/templates/ingress.yaml b/charts/keycloak/templates/ingress.yaml
index c5876b9be0..476f29f607 100644
--- a/charts/keycloak/templates/ingress.yaml
+++ b/charts/keycloak/templates/ingress.yaml
@@ -6,7 +6,7 @@ apiVersion: {{ $apiVersion }}
 kind: Ingress
 metadata:
   name: {{ $fullName }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with $ingress.annotations }}
   annotations:
     {{- range $key, $value := . }}
@@ -55,7 +55,7 @@ apiVersion: {{ $apiVersion }}
 kind: Ingress
 metadata:
   name: {{ $fullName }}-console
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with $ingress.console.annotations }}
   annotations:
     {{- range $key, $value := . }}
diff --git a/charts/keycloak/templates/networkpolicy.yaml b/charts/keycloak/templates/networkpolicy.yaml
index f375327f3f..d8d4702498 100644
--- a/charts/keycloak/templates/networkpolicy.yaml
+++ b/charts/keycloak/templates/networkpolicy.yaml
@@ -3,7 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ include "keycloak.fullname" . | quote }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
     {{- range $key, $value := .Values.networkPolicy.labels }}
diff --git a/charts/keycloak/templates/poddisruptionbudget.yaml b/charts/keycloak/templates/poddisruptionbudget.yaml
index 14de61b957..def94e1841 100644
--- a/charts/keycloak/templates/poddisruptionbudget.yaml
+++ b/charts/keycloak/templates/poddisruptionbudget.yaml
@@ -3,7 +3,7 @@ apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0"
 kind: PodDisruptionBudget
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
 spec:
diff --git a/charts/keycloak/templates/prometheusrule.yaml b/charts/keycloak/templates/prometheusrule.yaml
index b7d36489df..4f4207d220 100644
--- a/charts/keycloak/templates/prometheusrule.yaml
+++ b/charts/keycloak/templates/prometheusrule.yaml
@@ -7,7 +7,7 @@ metadata:
   {{- with .namespace }}
   namespace: {{ . }}
   {{- else }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" $ }}
   {{- end }}
   {{- with .annotations }}
   annotations:
diff --git a/charts/keycloak/templates/rbac.yaml b/charts/keycloak/templates/rbac.yaml
index d74dbab961..7ceaffcdf7 100644
--- a/charts/keycloak/templates/rbac.yaml
+++ b/charts/keycloak/templates/rbac.yaml
@@ -3,7 +3,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
 rules:
@@ -13,7 +13,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
 roleRef:
@@ -23,5 +23,5 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "keycloak.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace | quote }}
+    namespace: {{ include "keycloak.namespace" . | quote }}
 {{- end }}
diff --git a/charts/keycloak/templates/route.yaml b/charts/keycloak/templates/route.yaml
index 563537331c..f22cdb7da7 100644
--- a/charts/keycloak/templates/route.yaml
+++ b/charts/keycloak/templates/route.yaml
@@ -4,7 +4,7 @@ apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with $route.annotations }}
   annotations:
     {{- range $key, $value := . }}
diff --git a/charts/keycloak/templates/secrets.yaml b/charts/keycloak/templates/secrets.yaml
index b3b15c9cee..f78d0cd0f4 100644
--- a/charts/keycloak/templates/secrets.yaml
+++ b/charts/keycloak/templates/secrets.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "keycloak.fullname" $ }}-{{ $nameSuffix }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" $ }}
   {{- with $values.annotations }}
   annotations:
   {{- range $key, $value := . }}
diff --git a/charts/keycloak/templates/service-headless.yaml b/charts/keycloak/templates/service-headless.yaml
index 1083302052..cae56368c0 100644
--- a/charts/keycloak/templates/service-headless.yaml
+++ b/charts/keycloak/templates/service-headless.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "keycloak.fullname" . }}-headless
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with .Values.serviceHeadless.annotations }}
   annotations:
     {{- range $key, $value := . }}
diff --git a/charts/keycloak/templates/service-http.yaml b/charts/keycloak/templates/service-http.yaml
index 75482ab899..6f219d200c 100644
--- a/charts/keycloak/templates/service-http.yaml
+++ b/charts/keycloak/templates/service-http.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "keycloak.fullname" . }}-http
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with .Values.service.annotations }}
   annotations:
     {{- range $key, $value := . }}
@@ -27,6 +27,9 @@ spec:
   {{- if or (eq "LoadBalancer" .Values.service.type) (eq "NodePort" .Values.service.type) }}
   externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
   {{- end }}
+  {{- if .Values.service.internalTrafficPolicy }}
+  internalTrafficPolicy: {{ .Values.service.internalTrafficPolicy }}
+  {{- end }}
   {{- if .Values.service.sessionAffinity }}
   sessionAffinity: {{ .Values.service.sessionAffinity }}
     {{- with .Values.service.sessionAffinityConfig }}
diff --git a/charts/keycloak/templates/serviceaccount.yaml b/charts/keycloak/templates/serviceaccount.yaml
index 10971c52e4..bf54ea2c3f 100644
--- a/charts/keycloak/templates/serviceaccount.yaml
+++ b/charts/keycloak/templates/serviceaccount.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "keycloak.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with .Values.serviceAccount.annotations }}
   annotations:
     {{- range $key, $value := . }}
@@ -20,13 +20,12 @@ imagePullSecrets: {{ toYaml . | nindent 4 }}
 {{- end }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 
+{{- if .Values.serviceAccount.allowReadPods }}
 ---
-
-  {{- if .Values.serviceAccount.allowReadPods -}}
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: jgroups-kubeping-pod-reader-{{ .Release.Namespace }}
+  name: jgroups-kubeping-pod-reader-{{ include "keycloak.namespace" . }}
 rules:
   - apiGroups: [""]
     resources: ["pods"]
@@ -35,14 +34,14 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: jgroups-kubeping-api-access-{{ .Release.Namespace }}
+  name: jgroups-kubeping-api-access-{{ include "keycloak.namespace" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: jgroups-kubeping-pod-reader-{{ .Release.Namespace }}
+  name: jgroups-kubeping-pod-reader-{{ include "keycloak.namespace" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "keycloak.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
+    namespace: {{ include "keycloak.namespace" . }}
+{{- end }}
 {{- end }}
diff --git a/charts/keycloak/templates/servicemonitor.yaml b/charts/keycloak/templates/servicemonitor.yaml
index 1d677725fb..c3e5d6b064 100644
--- a/charts/keycloak/templates/servicemonitor.yaml
+++ b/charts/keycloak/templates/servicemonitor.yaml
@@ -9,7 +9,7 @@ metadata:
   {{- with .namespace }}
   namespace: {{ . }}
   {{- else }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" $ }}
   {{- end }}
   {{- with .annotations }}
   annotations:
diff --git a/charts/keycloak/templates/statefulset.yaml b/charts/keycloak/templates/statefulset.yaml
index 088171cc4c..8447db000c 100644
--- a/charts/keycloak/templates/statefulset.yaml
+++ b/charts/keycloak/templates/statefulset.yaml
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ include "keycloak.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   {{- with .Values.statefulsetAnnotations }}
   annotations:
     {{- range $key, $value := . }}
diff --git a/charts/keycloak/templates/test/configmap-test.yaml b/charts/keycloak/templates/test/configmap-test.yaml
index da4ed13d61..5fde3a4d88 100644
--- a/charts/keycloak/templates/test/configmap-test.yaml
+++ b/charts/keycloak/templates/test/configmap-test.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "keycloak.fullname" . }}-test
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
   annotations:
diff --git a/charts/keycloak/templates/test/pod-test.yaml b/charts/keycloak/templates/test/pod-test.yaml
index fe4e59959a..2ac89801b0 100644
--- a/charts/keycloak/templates/test/pod-test.yaml
+++ b/charts/keycloak/templates/test/pod-test.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: {{ include "keycloak.fullname" . }}-test
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "keycloak.namespace" . }}
   labels:
     {{- include "keycloak.labels" . | nindent 4 }}
     app.kubernetes.io/component: test
diff --git a/charts/keycloak/values.schema.json b/charts/keycloak/values.schema.json
index 2ed5d078c0..0278f89dae 100644
--- a/charts/keycloak/values.schema.json
+++ b/charts/keycloak/values.schema.json
@@ -245,6 +245,9 @@
       "nameOverride": {
         "type": "string"
       },
+      "namespaceOverride": {
+        "type": "string"
+      },
       "nodeSelector": {
         "type": "object"
       },
@@ -478,6 +481,9 @@
           "loadBalancerIP": {
             "type": "string"
           },
+          "internalTrafficPolicy": {
+            "type": "string"
+          },
           "sessionAffinity": {
             "type": "string"
           },
diff --git a/charts/keycloak/values.yaml b/charts/keycloak/values.yaml
index 2439da55a0..a0897138d6 100644
--- a/charts/keycloak/values.yaml
+++ b/charts/keycloak/values.yaml
@@ -4,6 +4,10 @@ fullnameOverride: ""
 # Optionally override the name
 nameOverride: ""
 
+# Optionally override the namespace for all resources. Useful for umbrella charts that
+# deploy multiple aliased keycloak instances each into their own namespace.
+namespaceOverride: ""
+
 # The number of replicas to create (has no effect if autoscaling enabled)
 replicas: 1
 
@@ -11,7 +15,7 @@ image:
   # The Keycloak image repository
   repository: quay.io/keycloak/keycloak
   # Overrides the Keycloak image tag whose default is the chart appVersion
-  tag: "26.6.3"
+  tag: "26.6.4"
   # Overrides the Keycloak image tag with a specific digest
   digest: ""
   # The Keycloak image pull policy
@@ -271,6 +275,9 @@ service:
   # by changing the default (Cluster) to be Local.
   # See https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
   externalTrafficPolicy: "Cluster"
+  # Controls how traffic from internal sources is routed. Valid values: Cluster, Local.
+  # See https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy/
+  internalTrafficPolicy: ""
   # Session affinity
   # See https://kubernetes.io/docs/concepts/services-networking/service/#proxy-mode-userspace
   sessionAffinity: ""