diff --git a/apps/overlays/au-syd1/clickhouse-system/values.yaml b/apps/overlays/au-syd1/clickhouse-system/values.yaml
index ee144fc..52b09b9 100644
--- a/apps/overlays/au-syd1/clickhouse-system/values.yaml
+++ b/apps/overlays/au-syd1/clickhouse-system/values.yaml
@@ -6,6 +6,12 @@
 # upstream). Upstream official images are used; no Docker Hardened Image variant
 # is adopted (DHI is subscription-gated and served from a private org namespace
 # not reachable via the anonymous artifactapi dockerhub proxy).
+#
+# Watch the logging namespace where the ClickHouseInstallation lives. The chart
+# default (watchNamespaces: []) makes the operator watch ONLY its own namespace
+# (clickhouse-system), so the logs CHI was never reconciled — set it explicitly.
+watchNamespaces:
+  - logging
 crdHook:
   image:
     repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/bitnami/kubectl
diff --git a/apps/overlays/au-syd1/logging/values-vector-agent.yaml b/apps/overlays/au-syd1/logging/values-vector-agent.yaml
index bff67a5..1be370d 100644
--- a/apps/overlays/au-syd1/logging/values-vector-agent.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-agent.yaml
@@ -23,6 +23,9 @@ tolerations:
   - operator: Exists
 
 env:
+  # Vector 0.57 disables ${VAR} config interpolation by default; auth needs it.
+  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
+    value: "true"
   - name: NATS_PRODUCER_PASSWORD
     valueFrom:
       secretKeyRef:
diff --git a/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml b/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml
index 4ee0d14..b4d48f9 100644
--- a/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml
@@ -40,6 +40,10 @@ existingConfigMaps:
 
 # The ONLY place ClickHouse + NATS-consumer creds are consumed.
 env:
+  # Vector 0.57 disables ${VAR} config interpolation by default; the pipeline's
+  # auth (${CLICKHOUSE_*}, ${NATS_CONSUMER_PASSWORD}) needs it enabled.
+  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
+    value: "true"
   - name: CLICKHOUSE_USER
     valueFrom:
       secretKeyRef:
diff --git a/apps/overlays/au-syd1/logging/values-vector-archiver.yaml b/apps/overlays/au-syd1/logging/values-vector-archiver.yaml
index 671844a..534f23f 100644
--- a/apps/overlays/au-syd1/logging/values-vector-archiver.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-archiver.yaml
@@ -20,6 +20,9 @@ existingConfigMaps:
   - vector-archiver-config
 
 env:
+  # Vector 0.57 disables ${VAR} config interpolation by default; auth needs it.
+  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
+    value: "true"
   - name: NATS_CONSUMER_PASSWORD
     valueFrom:
       secretKeyRef:
diff --git a/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml b/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml
index 12fe8b7..dcb4942 100644
--- a/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml
@@ -20,6 +20,9 @@ existingConfigMaps:
   - vector-vm-ingest-config
 
 env:
+  # Vector 0.57 disables ${VAR} config interpolation by default; auth needs it.
+  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
+    value: "true"
   - name: NATS_PRODUCER_PASSWORD
     valueFrom:
       secretKeyRef: