diff --git a/helm/litellm-helm/templates/deployment.yaml b/helm/litellm-helm/templates/deployment.yaml
index cf7b3f8a38d..8ab4a3286e4 100644
--- a/helm/litellm-helm/templates/deployment.yaml
+++ b/helm/litellm-helm/templates/deployment.yaml
@@ -85,8 +85,8 @@ spec:
             {{- end }}
           {{- end }}
           ports:
-            - name: http
-              containerPort: {{ .Values.service.port }}
+            - name: {{ .Values.service.portName | default "http" }}
+              containerPort: {{ .Values.service.containerPort | default .Values.service.port }}
               protocol: TCP
             {{- if .Values.metricsServer.enabled }}
             - name: metrics
diff --git a/helm/litellm-helm/templates/service.yaml b/helm/litellm-helm/templates/service.yaml
index 11812208929..11eb9c982dc 100644
--- a/helm/litellm-helm/templates/service.yaml
+++ b/helm/litellm-helm/templates/service.yaml
@@ -15,8 +15,11 @@ spec:
   {{- end }}
   ports:
     - port: {{ .Values.service.port }}
-      targetPort: http
+      targetPort: {{ .Values.service.portName | default "http" }}
       protocol: TCP
-      name: http
+      name: {{ .Values.service.portName | default "http" }}
+      {{- with .Values.service.appProtocol }}
+      appProtocol: {{ . }}
+      {{- end }}
   selector:
     {{- include "litellm.selectorLabels" . | nindent 4 }}
diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml
index fcee331a5aa..28465d685f1 100644
--- a/helm/litellm-helm/values.yaml
+++ b/helm/litellm-helm/values.yaml
@@ -85,6 +85,13 @@ environmentConfigMaps:
 service:
   type: ClusterIP
   port: 4000
+  # Istio auto protocol selection uses the Service port name. Use "tcp"
+  # (and optionally appProtocol: tcp) for mesh installs that must not treat
+  # this port as HTTP.
+  portName: http
+  appProtocol: ""
+  # Container listen port. Defaults to service.port when empty/omitted.
+  containerPort: ""
   # If service type is `LoadBalancer` you can
   # optionally specify loadBalancerClass
   # loadBalancerClass: tailscale
diff --git a/helm/litellm/templates/backend/deployment.yaml b/helm/litellm/templates/backend/deployment.yaml
index 3eb64e5528c..7e6d428ec25 100644
--- a/helm/litellm/templates/backend/deployment.yaml
+++ b/helm/litellm/templates/backend/deployment.yaml
@@ -53,8 +53,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           ports:
-            - name: http
-              containerPort: 4001
+            - name: {{ .Values.backend.service.portName | default "http" }}
+              containerPort: {{ .Values.backend.service.containerPort | default .Values.backend.service.port }}
               protocol: TCP
           env:
             {{- include "litellm.serverEnv" (dict "root" $ "component" .Values.backend) | nindent 12 }}
diff --git a/helm/litellm/templates/backend/service.yaml b/helm/litellm/templates/backend/service.yaml
index d480c654784..ef791ee95f7 100644
--- a/helm/litellm/templates/backend/service.yaml
+++ b/helm/litellm/templates/backend/service.yaml
@@ -10,9 +10,12 @@ spec:
   type: {{ .Values.backend.service.type }}
   ports:
     - port: {{ .Values.backend.service.port }}
-      targetPort: http
+      targetPort: {{ .Values.backend.service.portName | default "http" }}
       protocol: TCP
-      name: http
+      name: {{ .Values.backend.service.portName | default "http" }}
+      {{- with .Values.backend.service.appProtocol }}
+      appProtocol: {{ . }}
+      {{- end }}
   selector:
     {{- include "litellm.backend.selectorLabels" . | nindent 4 }}
 {{- end }}
diff --git a/helm/litellm/templates/gateway/deployment.yaml b/helm/litellm/templates/gateway/deployment.yaml
index 49b452b3053..ab557031b02 100644
--- a/helm/litellm/templates/gateway/deployment.yaml
+++ b/helm/litellm/templates/gateway/deployment.yaml
@@ -51,8 +51,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           ports:
-            - name: http
-              containerPort: 4000
+            - name: {{ .Values.gateway.service.portName | default "http" }}
+              containerPort: {{ .Values.gateway.service.containerPort | default .Values.gateway.service.port }}
               protocol: TCP
           env:
             {{- include "litellm.serverEnv" (dict "root" $ "component" .Values.gateway) | nindent 12 }}
diff --git a/helm/litellm/templates/gateway/service.yaml b/helm/litellm/templates/gateway/service.yaml
index 03a4167a0ab..5e9a4f487e8 100644
--- a/helm/litellm/templates/gateway/service.yaml
+++ b/helm/litellm/templates/gateway/service.yaml
@@ -10,9 +10,12 @@ spec:
   type: {{ .Values.gateway.service.type }}
   ports:
     - port: {{ .Values.gateway.service.port }}
-      targetPort: http
+      targetPort: {{ .Values.gateway.service.portName | default "http" }}
       protocol: TCP
-      name: http
+      name: {{ .Values.gateway.service.portName | default "http" }}
+      {{- with .Values.gateway.service.appProtocol }}
+      appProtocol: {{ . }}
+      {{- end }}
   selector:
     {{- include "litellm.gateway.selectorLabels" . | nindent 4 }}
 {{- end }}
diff --git a/helm/litellm/templates/ui/deployment.yaml b/helm/litellm/templates/ui/deployment.yaml
index efee2d5fc34..8aa69cb88ff 100644
--- a/helm/litellm/templates/ui/deployment.yaml
+++ b/helm/litellm/templates/ui/deployment.yaml
@@ -48,8 +48,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           ports:
-            - name: http
-              containerPort: 3000
+            - name: {{ .Values.ui.service.portName | default "http" }}
+              containerPort: {{ .Values.ui.service.containerPort | default .Values.ui.service.port }}
               protocol: TCP
           env:
             {{- if .Values.ui.logLevel }}
diff --git a/helm/litellm/templates/ui/service.yaml b/helm/litellm/templates/ui/service.yaml
index 52b539fa00c..bbe229dad81 100644
--- a/helm/litellm/templates/ui/service.yaml
+++ b/helm/litellm/templates/ui/service.yaml
@@ -10,9 +10,12 @@ spec:
   type: {{ .Values.ui.service.type }}
   ports:
     - port: {{ .Values.ui.service.port }}
-      targetPort: http
+      targetPort: {{ .Values.ui.service.portName | default "http" }}
       protocol: TCP
-      name: http
+      name: {{ .Values.ui.service.portName | default "http" }}
+      {{- with .Values.ui.service.appProtocol }}
+      appProtocol: {{ . }}
+      {{- end }}
   selector:
     {{- include "litellm.ui.selectorLabels" . | nindent 4 }}
 {{- end }}
diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml
index 2c0c7151a32..80a8e22b14d 100644
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@@ -362,6 +362,14 @@ gateway:
   service:
     type: ClusterIP
     port: 4000
+    # Service port name used for targetPort/container port name matching.
+    # Istio auto protocol selection treats a port named "http" as HTTP; set
+    # this to "tcp" (and optionally appProtocol: tcp) for mesh installs.
+    portName: http
+    # Optional Kubernetes appProtocol on the Service port.
+    appProtocol: ""
+    # Container listen port. Defaults to service.port when empty/omitted.
+    containerPort: ""
   resources:
     requests:
       cpu: "1"
@@ -507,6 +515,10 @@ backend:
   service:
     type: ClusterIP
     port: 4001
+    # See gateway.service.portName / appProtocol / containerPort.
+    portName: http
+    appProtocol: ""
+    containerPort: ""
   resources:
     requests:
       cpu: "1"
@@ -575,6 +587,10 @@ ui:
   service:
     type: ClusterIP
     port: 3000
+    # See gateway.service.portName / appProtocol / containerPort.
+    portName: http
+    appProtocol: ""
+    containerPort: ""
   # The dashboard expects to know where to reach the backend API. Set this to
   # the externally-routable URL (typically the ingress host + /api or similar).
   backendUrl: ""