diff --git a/.github/workflows/test-wandb-base.yaml b/.github/workflows/test-wandb-base.yaml
new file mode 100644
index 000000000..bfcce265a
--- /dev/null
+++ b/.github/workflows/test-wandb-base.yaml
@@ -0,0 +1,118 @@
+name: Test wandb-base Chart
+
+on:
+  pull_request:
+    paths:
+      - charts/operator-wandb/**
+      - test-configs/wandb-base/**
+
+jobs:
+  snapshots:
+    name: Snapshot testing
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Helm
+        uses: azure/setup-helm@v4.2.0
+        with:
+          version: v3.17.0
+      - name: Helm snapshot build and test
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add stakater https://stakater.github.io/stakater-charts
+          helm repo add prometheus https://prometheus-community.github.io/helm-charts
+
+          helm plugin install https://github.com/origranot/helm-cascade
+          helm plugin install https://github.com/jlandowner/helm-chartsnap
+          ./snapshots.sh build wandb-base
+          ./snapshots.sh run wandb-base
+
+  test:
+    name: Test Chart
+    strategy:
+      fail-fast: false
+      matrix:
+        k8s-version: ["v1.32.2", "v1.31.6", "v1.30.10"]
+        configuration:
+          - env-values-example
+          - env-precedence-container
+          - env-precedence-sizing
+          - env-precedence-chart-env
+          - env-precedence-chart-legacy
+          - env-precedence-global-env
+          - env-precedence-global-legacy
+    runs-on: ubuntu-latest
+    environment: Helm Charts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4.2.0
+        with:
+          version: v3.17.0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.7.0
+        with:
+          version: v3.12.0
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --config ct.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Determine Kind Cluster Name
+        id: cluster
+        run: |
+          MATRIX_STRING="${{ matrix.k8s-version }}-${{ matrix.configuration }}"
+
+          HASH=$(python3 -c "
+          import zlib
+          data = '$MATRIX_STRING'.encode('utf-8')
+          crc = zlib.crc32(data) & 0xffffffff
+          print(f'{crc:08x}')
+          ")
+
+          export NAME="ct-${HASH}"
+          echo "name=${NAME}" >> "$GITHUB_OUTPUT"
+          echo "Matrix: $MATRIX_STRING -> Hash: $HASH -> Name: $NAME"
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.12.0
+        with:
+          version: v0.27.0
+          cluster_name: ${{ steps.cluster.outputs.name }}
+          node_image: kindest/node:${{ matrix.k8s-version }}
+        if: env.ACT || steps.list-changed.outputs.changed == 'true'
+
+      - name: Apply user defined secrets
+        run: |
+          if [[ -d test-configs/additional-resources/${{matrix.configuration}} ]]; then
+            kubectl --context kind-${{ steps.cluster.outputs.name }} apply -f test-configs/additional-resources/${{matrix.configuration}}
+            echo "Applied additional resources for ${{matrix.configuration}}"
+            sleep 5
+          else
+            echo "No additional resources to be applied for ${{matrix.configuration}}"
+          fi
+        if: env.ACT || steps.list-changed.outputs.changed == 'true'
+
+      - name: Run chart-testing (install)
+        if: env.ACT || steps.list-changed.outputs.changed == 'true'
+        run: |
+          ct install --namespace default \
+          --charts ./charts/wandb-base \
+          --config ct.yaml \
+          --helm-extra-args '--kube-context kind-${{ steps.cluster.outputs.name }} --timeout 600s' \
+          --helm-extra-set-args '--values test-configs/wandb-base/${{ matrix.configuration }}.yaml'
diff --git a/charts/wandb-base/README.md b/charts/wandb-base/README.md
index fa9deb7b3..33d50a083 100644
--- a/charts/wandb-base/README.md
+++ b/charts/wandb-base/README.md
@@ -30,7 +30,7 @@ Environment variables can be defined at multiple levels, with the following prec
 5. Global environment variables (`global.env`)
 6. Legacy global environment variables (`global.extraEnv`)
 
-Example:
+#### Examples Of `env` at different levels
 
 ```yaml
 # Global environment variables (lowest precedence)
@@ -52,6 +52,71 @@ containers:
 
 In this example, the `LOG_LEVEL` for the `app` container would be set to `trace`.
 
+#### Examples of different `env` values:
+At any of the difference env levels shown above the following patterns are allowed.
+
+[k8s ref envvar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvar-v1-core)
+[k8s ref valueFrom](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvarsource-v1-core)
+
+Basic Key/Value
+```yaml
+env:
+  EXAMPLE: "100"
+```
+
+```yaml
+env:
+  EXAMPLE_ALT:
+    value: "200"
+```
+
+Reference a configmap
+```yaml
+env:
+  EXAMPLE_FROM_CONFIGMAP:
+    valueFrom:
+      configMapKeyRef:
+        name: "my-configmap"
+        key: "configmap-key"
+```
+
+Reference a secret
+```yaml
+env:
+  EXAMPLE_FROM_SECRET:
+    valueFrom:
+      secretKeyRef:
+        name: "my-secret"
+        key: "secret-key"
+```
+
+Reference k8s data (fieldRef)
+Selects a field of the pod: supports `metadata.name`, `metadata.namespace`, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`, `spec.nodeName`, `spec.serviceAccountName`, `status.hostIP`, `status.podIP`, `status.podIPs`
+```yaml
+env:
+  EXAMPLE_FROM_FIELD_REF:
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.namespace
+  # practical example
+  DD_AGENT_HOST:
+    valueFrom:
+      fieldRef:
+        fieldPath: status.hostIP
+```
+
+Reference k8s data (resourceFieldRef)
+Selects a resource of the container: only resources limits and requests (`limits.cpu`, `limits.memory`, `limits.ephemeral-storage`, `requests.cpu`, `requests.memory` and `requests.ephemeral-storage`) are currently supported.
+```yaml
+env:
+  EXAMPLE_FROM_RESOURCE_FIELD_REF:
+    valueFrom:
+      resourceFieldRef:
+        resource: limits.memory
+```
+
+#### Examples of `envFrom` to set groups of env vars at once
+
 Additionally, environment variables can be sourced from ConfigMaps and Secrets using the `envFrom` field:
 
 ```yaml
diff --git a/charts/wandb-base/templates/tests/test-jobs.yaml b/charts/wandb-base/templates/tests/test-jobs.yaml
new file mode 100644
index 000000000..000f77186
--- /dev/null
+++ b/charts/wandb-base/templates/tests/test-jobs.yaml
@@ -0,0 +1,84 @@
+{{- if eq .Values.kind "Job" }}
+  {{- range $jobName, $job := .Values.jobs }}
+    {{- $job := mergeOverwrite (dict "enabled" true) $job}}
+    {{- $fullname := include "wandb-base.fullname" $ }}
+    {{- if $job.enabled }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "{{ $fullname }}-test-job-{{ $jobName }}-sa"
+  labels:
+    {{- include "wandb-base.labels" $ | nindent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "{{ $fullname }}-test-job-{{ $jobName }}-role"
+  labels:
+    {{- include "wandb-base.labels" $ | nindent 4 }}
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "{{ $fullname }}-test-job-{{ $jobName }}-binding"
+  labels:
+    {{- include "wandb-base.labels" $ | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "{{ $fullname }}-test-job-{{ $jobName }}-role"
+subjects:
+- kind: ServiceAccount
+  name: "{{ $fullname }}-test-job-{{ $jobName }}-sa"
+  namespace: {{ $.Release.Namespace }}
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ $fullname }}-test-job-{{ $jobName }}"
+  labels:
+    {{- include "wandb-base.labels" $ | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "{{ $fullname }}-test-job-{{ $jobName }}-sa"
+  containers:
+    - name: job-test
+      image: bitnami/kubectl:latest
+      command: ['/bin/sh']
+      args:
+        - -c
+        - |
+          set -e
+          echo "Testing job: {{ printf "%s-%s" $fullname $jobName }}"
+
+          i=0
+          until kubectl logs job/{{ printf "%s-%s" $fullname $jobName }}; do
+            i=$((i+1))
+            if [ "$i" -ge 60 ]; then
+              echo "Timed out waiting for job logs."
+              exit 1
+            fi
+            sleep 5
+          done
+          if ! kubectl wait --for=condition=complete job/{{ printf "%s-%s" $fullname $jobName }} --timeout=600s; then
+            echo "Job {{ printf "%s-%s" $fullname $jobName }} did not complete successfully."
+            kubectl describe job/{{ printf "%s-%s" $fullname $jobName }} || true
+            kubectl logs job/{{ printf "%s-%s" $fullname $jobName }} --tail=200 || true
+            exit 1
+          fi
+          echo "Job {{ printf "%s-%s" $fullname $jobName }} completed successfully."
+
+  restartPolicy: Never
+    {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/snapshots.sh b/snapshots.sh
index ce2c63226..2ccab99ac 100755
--- a/snapshots.sh
+++ b/snapshots.sh
@@ -20,7 +20,7 @@ function usage() {
   cat <<EOF
 A helper script for the helm-chartsnap plugin https://github.com/jlandowner/helm-chartsnap
 
-Usage: $0 [COMMAND]
+Usage: $0 [COMMAND] [optional: CHART (ex: operator-wandb)]
 
 Commands:
   build,    build the operator-wandb chart
@@ -29,8 +29,29 @@ Commands:
 EOF
 }
 
+function build_chart() {
+  local chart="$1"
+  echo "Building $chart"
+  helm cascade build "./charts/$chart"
+}
+
+function update_chart() {
+  local chart="$1"
+  local values_file="$2"
+  echo "updating $chart snapshots"
+  helm chartsnap -c "./charts/$chart" -u -f "$values_file"
+}
+
+function run_chart() {
+  local chart="$1"
+  local values_file="$2"
+  echo "Checking $chart snapshot tests"
+  helm chartsnap -c "./charts/$chart" -f "$values_file"
+}
+
 function main() {
-  local chart="operator-wandb"
+  local func="$1"
+  local charts=("wandb-base" "operator-wandb")
   local values_dir="test-configs"
 
   if [ $# -eq 0 ]; then
@@ -38,25 +59,27 @@ function main() {
     exit 1
   fi
 
-  local func="$1"
-  case "$func" in
-    build)
-      echo "Building operator-wandb"
-      helm cascade build "./charts/$chart"
-      ;;
-    update)
-      echo "Updating operator-wandb snapshots"
-      helm chartsnap -c "./charts/$chart" -u -f "./$values_dir/$chart"
-      ;;
-    run)
-      echo "Checking snapshot tests"
-      helm chartsnap -c "./charts/$chart" -f "./$values_dir/$chart"
-      ;;
-    *)
-      usage
-      exit 1
-      ;;
-  esac
+  if [ -n "$2"  ]; then
+    charts=("$2")
+  fi
+
+  for chart in "${charts[@]}"; do
+    case "$func" in
+      build)
+        build_chart "$chart"
+        ;;
+      update)
+        update_chart "$chart" "./$values_dir/$chart"
+        ;;
+      run)
+        run_chart "$chart" "./$values_dir/$chart"
+        ;;
+      *)
+        usage
+        exit 1
+        ;;
+    esac
+  done
 }
 
 main "$@"
diff --git a/test-configs/additional-resources/env-values-example/configmap.yaml b/test-configs/additional-resources/env-values-example/configmap.yaml
new file mode 100644
index 000000000..d337438e7
--- /dev/null
+++ b/test-configs/additional-resources/env-values-example/configmap.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: my-configmap
+data:
+  configmap-key: "test"
diff --git a/test-configs/additional-resources/env-values-example/secret.yaml b/test-configs/additional-resources/env-values-example/secret.yaml
new file mode 100644
index 000000000..599c8af87
--- /dev/null
+++ b/test-configs/additional-resources/env-values-example/secret.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-secret
+stringData:
+  secret-key: "test"
diff --git a/test-configs/wandb-base/.chartsnap.yaml b/test-configs/wandb-base/.chartsnap.yaml
new file mode 100644
index 000000000..e77982a58
--- /dev/null
+++ b/test-configs/wandb-base/.chartsnap.yaml
@@ -0,0 +1,4 @@
+dynamicFields:
+  - jsonPath:
+    - /metadata/labels/helm.sh~1chart
+    value: '###CHART_VERSION###'
diff --git a/test-configs/wandb-base/__snapshots__/env-precedence-chart-env.snap b/test-configs/wandb-base/__snapshots__/env-precedence-chart-env.snap
new file mode 100644
index 000000000..c0aef7ec9
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-precedence-chart-env.snap
@@ -0,0 +1,191 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          echo "EXAMPLE=$EXAMPLE"
+          EXPECTED="400"
+          if [ "$EXAMPLE" = "$EXPECTED" ]; then
+            echo "Value is $EXPECTED"
+            exit 0
+          else
+            echo "Value is NOT $EXPECTED"
+            exit 1
+          fi
+        envFrom:
+        env:
+        - name: EXAMPLE
+          value: "400"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/__snapshots__/env-precedence-chart-legacy.snap b/test-configs/wandb-base/__snapshots__/env-precedence-chart-legacy.snap
new file mode 100644
index 000000000..2c8d9bed3
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-precedence-chart-legacy.snap
@@ -0,0 +1,191 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          echo "EXAMPLE=$EXAMPLE"
+          EXPECTED="300"
+          if [ "$EXAMPLE" = "$EXPECTED" ]; then
+            echo "Value is $EXPECTED"
+            exit 0
+          else
+            echo "Value is NOT $EXPECTED"
+            exit 1
+          fi
+        envFrom:
+        env:
+        - name: EXAMPLE
+          value: "300"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/__snapshots__/env-precedence-container.snap b/test-configs/wandb-base/__snapshots__/env-precedence-container.snap
new file mode 100644
index 000000000..fe7c4aba6
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-precedence-container.snap
@@ -0,0 +1,191 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          echo "EXAMPLE=$EXAMPLE"
+          EXPECTED="600"
+          if [ "$EXAMPLE" = "$EXPECTED" ]; then
+            echo "Value is $EXPECTED"
+            exit 0
+          else
+            echo "Value is NOT $EXPECTED"
+            exit 1
+          fi
+        envFrom:
+        env:
+        - name: EXAMPLE
+          value: "600"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/__snapshots__/env-precedence-global-env.snap b/test-configs/wandb-base/__snapshots__/env-precedence-global-env.snap
new file mode 100644
index 000000000..19f51d044
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-precedence-global-env.snap
@@ -0,0 +1,191 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          echo "EXAMPLE=$EXAMPLE"
+          EXPECTED="200"
+          if [ "$EXAMPLE" = "$EXPECTED" ]; then
+            echo "Value is $EXPECTED"
+            exit 0
+          else
+            echo "Value is NOT $EXPECTED"
+            exit 1
+          fi
+        envFrom:
+        env:
+        - name: EXAMPLE
+          value: "200"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/__snapshots__/env-precedence-global-legacy.snap b/test-configs/wandb-base/__snapshots__/env-precedence-global-legacy.snap
new file mode 100644
index 000000000..bd16eac40
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-precedence-global-legacy.snap
@@ -0,0 +1,191 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          echo "EXAMPLE=$EXAMPLE"
+          EXPECTED="100"
+          if [ "$EXAMPLE" = "$EXPECTED" ]; then
+            echo "Value is $EXPECTED"
+            exit 0
+          else
+            echo "Value is NOT $EXPECTED"
+            exit 1
+          fi
+        envFrom:
+        env:
+        - name: EXAMPLE
+          value: "100"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/__snapshots__/env-precedence-sizing.snap b/test-configs/wandb-base/__snapshots__/env-precedence-sizing.snap
new file mode 100644
index 000000000..4b4a5dbf2
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-precedence-sizing.snap
@@ -0,0 +1,191 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          echo "EXAMPLE=$EXAMPLE"
+          EXPECTED="500"
+          if [ "$EXAMPLE" = "$EXPECTED" ]; then
+            echo "Value is $EXPECTED"
+            exit 0
+          else
+            echo "Value is NOT $EXPECTED"
+            exit 1
+          fi
+        envFrom:
+        env:
+        - name: EXAMPLE
+          value: "400"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/__snapshots__/env-values-example.snap b/test-configs/wandb-base/__snapshots__/env-values-example.snap
new file mode 100644
index 000000000..97f668d68
--- /dev/null
+++ b/test-configs/wandb-base/__snapshots__/env-values-example.snap
@@ -0,0 +1,230 @@
+# chartsnap: snapshot_version=v3
+---
+# Source: wandb-base/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchExpressions:
+    - key: batch.kubernetes.io/job-name
+      operator: DoesNotExist
+    matchLabels:
+      app.kubernetes.io/name: wandb-base
+      app.kubernetes.io/instance: chartsnap
+  maxUnavailable: 1
+---
+# Source: wandb-base/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: chartsnap-wandb-base
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-role"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "chartsnap-wandb-base-test-job-test-binding"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: "chartsnap-wandb-base-test-job-test-role"
+subjects:
+- kind: ServiceAccount
+  name: "chartsnap-wandb-base-test-job-test-sa"
+  namespace: default
+---
+# Source: wandb-base/templates/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: chartsnap-test
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+spec:
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: wandb-base-0.11.0
+        app.kubernetes.io/name: wandb-base
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: example
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - |
+          if [ "$USED_NAMESPACE" = "default" ]; then
+            echo "fieldRef test"
+          else
+            echo "fieldRef test failed"
+            exit 1
+          fi
+          if [ "$MEM_LIMIT" = "1073741824" ]; then
+            echo "resourceFieldRef test"
+          else
+            echo "resourceFieldRef test failed"
+            exit 1
+          fi
+          if [ "$BASIC" = "$BASIC_ALT" ]; then
+            echo "Basic test"
+          else
+            echo "Basic test failed"
+            exit 1
+          fi
+          if [ "$EXAMPLE_FROM_CONFIGMAP" = "$EXAMPLE_FROM_SECRET" ]; then
+            echo "configmap/secret test"
+          else
+            echo "configmap/secret test failed"
+            exit 1
+          fi
+          exit 0
+        envFrom:
+        env:
+        - name: BASIC
+          value: "600"
+        - name: BASIC_ALT
+          value: "600"
+        - name: EXAMPLE_FROM_CONFIGMAP
+          valueFrom:
+            configMapKeyRef:
+              key: configmap-key
+              name: my-configmap
+        - name: EXAMPLE_FROM_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: secret-key
+              name: my-secret
+        - name: MEM_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: USED_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: []
+            drop: []
+          privileged: false
+          readOnlyRootFilesystem: false
+        image: "debian:12-slim"
+        imagePullPolicy:
+        resources:
+          limits:
+            memory: 1Gi
+      restartPolicy: Never
+      serviceAccountName: chartsnap-wandb-base
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: wandb-base
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+---
+# Source: wandb-base/templates/tests/test-jobs.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "chartsnap-wandb-base-test-job-test"
+  labels:
+    helm.sh/chart: '###CHART_VERSION###'
+    app.kubernetes.io/name: wandb-base
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+    "helm.sh/hook-weight": "1"
+spec:
+  serviceAccountName: "chartsnap-wandb-base-test-job-test-sa"
+  containers:
+  - name: job-test
+    image: bitnami/kubectl:latest
+    command: ['/bin/sh']
+    args:
+    - -c
+    - |
+      set -e
+      echo "Testing job: chartsnap-wandb-base-test"
+
+      i=0
+      until kubectl logs job/chartsnap-wandb-base-test; do
+        i=$((i+1))
+        if [ "$i" -ge 60 ]; then
+          echo "Timed out waiting for job logs."
+          exit 1
+        fi
+        sleep 5
+      done
+  restartPolicy: Never
diff --git a/test-configs/wandb-base/env-precedence-chart-env.yaml b/test-configs/wandb-base/env-precedence-chart-env.yaml
new file mode 100644
index 000000000..ef0563a25
--- /dev/null
+++ b/test-configs/wandb-base/env-precedence-chart-env.yaml
@@ -0,0 +1,34 @@
+global:
+  extraEnv:
+    EXAMPLE: "100"
+  env:
+    EXAMPLE: "200"
+
+extraEnv:
+  EXAMPLE: "300"
+
+env:
+  EXAMPLE: "400"
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            echo "EXAMPLE=$EXAMPLE"
+            EXPECTED="400"
+            if [ "$EXAMPLE" = "$EXPECTED" ]; then
+              echo "Value is $EXPECTED"
+              exit 0
+            else
+              echo "Value is NOT $EXPECTED"
+              exit 1
+            fi
diff --git a/test-configs/wandb-base/env-precedence-chart-legacy.yaml b/test-configs/wandb-base/env-precedence-chart-legacy.yaml
new file mode 100644
index 000000000..74df80248
--- /dev/null
+++ b/test-configs/wandb-base/env-precedence-chart-legacy.yaml
@@ -0,0 +1,31 @@
+global:
+  extraEnv:
+    EXAMPLE: "100"
+  env:
+    EXAMPLE: "200"
+
+extraEnv:
+  EXAMPLE: "300"
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            echo "EXAMPLE=$EXAMPLE"
+            EXPECTED="300"
+            if [ "$EXAMPLE" = "$EXPECTED" ]; then
+              echo "Value is $EXPECTED"
+              exit 0
+            else
+              echo "Value is NOT $EXPECTED"
+              exit 1
+            fi
diff --git a/test-configs/wandb-base/env-precedence-container.yaml b/test-configs/wandb-base/env-precedence-container.yaml
new file mode 100644
index 000000000..ad54e8145
--- /dev/null
+++ b/test-configs/wandb-base/env-precedence-container.yaml
@@ -0,0 +1,43 @@
+global:
+  extraEnv:
+    EXAMPLE: "100"
+  env:
+    EXAMPLE: "200"
+
+extraEnv:
+  EXAMPLE: "300"
+
+env:
+  EXAMPLE: "400"
+
+size: "small"
+
+sizing:
+  small:
+    env:
+      EXAMPLE: "500"
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            echo "EXAMPLE=$EXAMPLE"
+            EXPECTED="600"
+            if [ "$EXAMPLE" = "$EXPECTED" ]; then
+              echo "Value is $EXPECTED"
+              exit 0
+            else
+              echo "Value is NOT $EXPECTED"
+              exit 1
+            fi
+        env:
+          EXAMPLE: "600"
diff --git a/test-configs/wandb-base/env-precedence-global-env.yaml b/test-configs/wandb-base/env-precedence-global-env.yaml
new file mode 100644
index 000000000..926a8d487
--- /dev/null
+++ b/test-configs/wandb-base/env-precedence-global-env.yaml
@@ -0,0 +1,28 @@
+global:
+  extraEnv:
+    EXAMPLE: "100"
+  env:
+    EXAMPLE: "200"
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            echo "EXAMPLE=$EXAMPLE"
+            EXPECTED="200"
+            if [ "$EXAMPLE" = "$EXPECTED" ]; then
+              echo "Value is $EXPECTED"
+              exit 0
+            else
+              echo "Value is NOT $EXPECTED"
+              exit 1
+            fi
diff --git a/test-configs/wandb-base/env-precedence-global-legacy.yaml b/test-configs/wandb-base/env-precedence-global-legacy.yaml
new file mode 100644
index 000000000..434ea5c58
--- /dev/null
+++ b/test-configs/wandb-base/env-precedence-global-legacy.yaml
@@ -0,0 +1,26 @@
+global:
+  extraEnv:
+    EXAMPLE: "100"
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            echo "EXAMPLE=$EXAMPLE"
+            EXPECTED="100"
+            if [ "$EXAMPLE" = "$EXPECTED" ]; then
+              echo "Value is $EXPECTED"
+              exit 0
+            else
+              echo "Value is NOT $EXPECTED"
+              exit 1
+            fi
diff --git a/test-configs/wandb-base/env-precedence-sizing.yaml b/test-configs/wandb-base/env-precedence-sizing.yaml
new file mode 100644
index 000000000..bb819f93b
--- /dev/null
+++ b/test-configs/wandb-base/env-precedence-sizing.yaml
@@ -0,0 +1,41 @@
+global:
+  extraEnv:
+    EXAMPLE: "100"
+  env:
+    EXAMPLE: "200"
+
+extraEnv:
+  EXAMPLE: "300"
+
+env:
+  EXAMPLE: "400"
+
+size: "small"
+
+sizing:
+  small:
+    env:
+      EXAMPLE: "500"
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            echo "EXAMPLE=$EXAMPLE"
+            EXPECTED="500"
+            if [ "$EXAMPLE" = "$EXPECTED" ]; then
+              echo "Value is $EXPECTED"
+              exit 0
+            else
+              echo "Value is NOT $EXPECTED"
+              exit 1
+            fi
diff --git a/test-configs/wandb-base/env-values-example.yaml b/test-configs/wandb-base/env-values-example.yaml
new file mode 100644
index 000000000..2bac6fe17
--- /dev/null
+++ b/test-configs/wandb-base/env-values-example.yaml
@@ -0,0 +1,77 @@
+global:
+  env:
+    USED_NAMESPACE:
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+
+
+env:
+  EXAMPLE_FROM_CONFIGMAP:
+    valueFrom:
+      configMapKeyRef:
+        name: "my-configmap"
+        key: "configmap-key"
+  EXAMPLE_FROM_SECRET:
+    valueFrom:
+      secretKeyRef:
+        name: "my-secret"
+        key: "secret-key"
+
+size: "small"
+
+sizing:
+  small:
+    resources:
+      limits:
+        memory: 1Gi
+    env:
+      MEM_LIMIT:
+        valueFrom:
+          resourceFieldRef:
+            resource: limits.memory
+
+kind: Job
+jobs:
+  test:
+    containers:
+      example:
+        image:
+          repository: debian
+          tag: 12-slim
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            if [ "$USED_NAMESPACE" = "default" ]; then
+              echo "fieldRef test"
+            else
+              echo "fieldRef test failed"
+              exit 1
+            fi
+            if [ "$MEM_LIMIT" = "1073741824" ]; then
+              echo "resourceFieldRef test"
+            else
+              echo "resourceFieldRef test failed"
+              exit 1
+            fi
+            if [ "$BASIC" = "$BASIC_ALT" ]; then
+              echo "Basic test"
+            else
+              echo "Basic test failed"
+              exit 1
+            fi
+            if [ "$EXAMPLE_FROM_CONFIGMAP" = "$EXAMPLE_FROM_SECRET" ]; then
+              echo "configmap/secret test"
+            else
+              echo "configmap/secret test failed"
+              exit 1
+            fi
+            exit 0
+
+        env:
+          BASIC: "600"
+          BASIC_ALT:
+            value: "600"
+