diff --git a/charts/helix-controlplane/Chart.yaml b/charts/helix-controlplane/Chart.yaml
index 197587104b..ba88e1f4ec 100644
--- a/charts/helix-controlplane/Chart.yaml
+++ b/charts/helix-controlplane/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.35
+version: 0.3.36
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/helix-controlplane/templates/gke_managed_certificate.yaml b/charts/helix-controlplane/templates/gke_managed_certificate.yaml
new file mode 100644
index 0000000000..21dc9b2b9d
--- /dev/null
+++ b/charts/helix-controlplane/templates/gke_managed_certificate.yaml
@@ -0,0 +1,19 @@
+{{- if and .Values.ingress.enabled .Values.ingress.gke .Values.ingress.gke.managedCertificate .Values.ingress.gke.managedCertificate.enabled }}
+apiVersion: networking.gke.io/v1
+kind: ManagedCertificate
+metadata:
+  name: {{ include "helix-controlplane.fullname" . }}-managed-cert
+  labels:
+    {{- include "helix-controlplane.labels" . | nindent 4 }}
+spec:
+  domains:
+    {{- if .Values.ingress.gke.managedCertificate.domains }}
+    {{- range .Values.ingress.gke.managedCertificate.domains }}
+    - {{ . | quote }}
+    {{- end }}
+    {{- else }}
+    {{- range .Values.ingress.hosts }}
+    - {{ .host | quote }}
+    {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/charts/helix-controlplane/values.yaml b/charts/helix-controlplane/values.yaml
index 18e48a3c6e..8377290b5a 100644
--- a/charts/helix-controlplane/values.yaml
+++ b/charts/helix-controlplane/values.yaml
@@ -201,6 +201,13 @@ ingress:
         - path: /
           pathType: ImplementationSpecific
   tls: []
+  # GKE-specific configuration
+  gke:
+    managedCertificate:
+      # Enable to automatically create a Google-managed TLS certificate
+      enabled: false
+      # Optional: specify domains explicitly. If empty, uses ingress.hosts[].host
+      domains: []
 
 resources: {}
 
diff --git a/scripts/index_repo.sh b/scripts/index_repo.sh
index d6c93389b0..47eaa943d3 100755
--- a/scripts/index_repo.sh
+++ b/scripts/index_repo.sh
@@ -11,8 +11,11 @@ chmod 700 get_helm.sh
 ./get_helm.sh
 
 echo "Indexing repository"
-if [ -f index.yaml ]; then
-  helm repo index --url "${REPO_URL}" --merge index.yaml ./temp
+# The index.yaml is downloaded to temp/ by the previous gsutil rsync step
+if [ -f temp/index.yaml ]; then
+  echo "Merging with existing index.yaml"
+  helm repo index --url "${REPO_URL}" --merge temp/index.yaml ./temp
 else
+  echo "Creating new index.yaml"
   helm repo index --url "${REPO_URL}" ./temp
 fi