diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8381b5..bc5ae19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## Chart 0.4.2 — 2026-10-19
+
+Found while running the daemon on the live cluster (ai-rm end-to-end run).
+
+### Fixed
+- Writable `/tmp` under the read-only root: `rbln-stat` (PyInstaller) unpacks itself under `TMPDIR`
+  and failed with "Could not create temporary directory", so no ATOM was published.
+- `hostDev` (default on) mounts the host's `/dev` live. A privileged container sees `/dev` as it was at
+  start; an ATOM that the driver re-created after a pod released it dropped out of discovery.
+
+### Added
+- Site extension points, all empty by default: `command`, `extraEnv`, `initContainers`,
+  `extraVolumes`, `extraVolumeMounts` (run the daemon from a stock Python image until the
+  `rm-abstract-node` image is published).
+
 ## 0.4.1 — 2026-10-19
 
 ### Fixed
diff --git a/deploy/helm/rm-abstract-node/Chart.yaml b/deploy/helm/rm-abstract-node/Chart.yaml
index de0ef03..df1e03f 100644
--- a/deploy/helm/rm-abstract-node/Chart.yaml
+++ b/deploy/helm/rm-abstract-node/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: rm-abstract-node
 description: ai-rm L1 node daemon - publishes each node's accelerators as AcceleratorProfiles and node labels
 type: application
-version: 0.4.1
+version: 0.4.2
 appVersion: "0.4.1"
diff --git a/deploy/helm/rm-abstract-node/templates/daemonset.yaml b/deploy/helm/rm-abstract-node/templates/daemonset.yaml
index e71cdca..bb91e84 100644
--- a/deploy/helm/rm-abstract-node/templates/daemonset.yaml
+++ b/deploy/helm/rm-abstract-node/templates/daemonset.yaml
@@ -29,11 +29,20 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: daemon
           image: "{{ required "image.repository is required" .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.command }}
+          command:
+            {{- toYaml .Values.command | nindent 12 }}
+          {{- else }}
           command: ["python", "-m", "rm_abstract.airm.daemon"]
+          {{- end }}
           env:
             - name: AIRM_NODE_NAME
               valueFrom:
@@ -47,6 +56,9 @@ spec:
               value: {{ .Values.removeAfter | quote }}
             - name: AIRM_METRICS_PORT
               value: {{ .Values.airm.metricsPort | quote }}
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           {{- if .Values.airm.metricsPort }}
           ports:
             - name: metrics
@@ -59,4 +71,26 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          volumeMounts:
+            # read-only root: rbln-stat (PyInstaller) unpacks itself under $TMPDIR
+            - name: tmp
+              mountPath: /tmp
+            {{- if .Values.hostDev }}
+            - name: dev
+              mountPath: /dev
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        {{- if .Values.hostDev }}
+        - name: dev
+          hostPath:
+            path: /dev
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
 {{- end }}
diff --git a/deploy/helm/rm-abstract-node/values.yaml b/deploy/helm/rm-abstract-node/values.yaml
index f25134b..08d5459 100644
--- a/deploy/helm/rm-abstract-node/values.yaml
+++ b/deploy/helm/rm-abstract-node/values.yaml
@@ -19,11 +19,23 @@ removeAfter: 3         # remove a device's profile after this many discoveries w
 
 # Vendor tools read the device nodes, which needs a privileged container.
 privileged: true
+# Mount the host's /dev live. A privileged container otherwise sees /dev as it was at start, and a
+# device that a driver re-creates (e.g. after a pod releases an ATOM) drops out of discovery.
+hostDev: true
 
 serviceAccount:
   create: true
   name: ""
 
+# Site extension points (all empty by default). A site without the published image can run a
+# stock Python image: an init container installs rm-abstract[k8s] into a volume on PYTHONPATH,
+# and the host's vendor tools are mounted read-only and appended to PATH.
+command: []            # default: python -m rm_abstract.airm.daemon
+extraEnv: []           # [{name, value}] appended to the daemon's env
+initContainers: []     # pod initContainers, verbatim
+extraVolumes: []       # pod volumes, verbatim
+extraVolumeMounts: []  # daemon volumeMounts, verbatim
+
 nodeAffinity: {}       # default: every node; restrict with airm.ai-computing.io/<vendor>.<model> labels
 tolerations:
   - operator: Exists   # run on tainted accelerator nodes too