diff --git a/staging/istio-helm-ztunnel/Chart.yaml b/staging/istio-helm-ztunnel/Chart.yaml
index 97a23d5c9..5410bb5f2 100644
--- a/staging/istio-helm-ztunnel/Chart.yaml
+++ b/staging/istio-helm-ztunnel/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: istio-helm-ztunnel
 # 1.24.0 supports migration to ambient mesh mode from sidecar
 # Tracker: https://jira.nutanix.com/browse/NCN-112389
-version: 1.25.0
+version: 1.25.1
 appVersion: 1.29.0
 description: Helm chart for deploying Istio ztunnel for ambient mesh mode
 keywords:
diff --git a/staging/istio-helm-ztunnel/charts/ztunnel/templates/daemonset.yaml b/staging/istio-helm-ztunnel/charts/ztunnel/templates/daemonset.yaml
index 2c85867a0..4aefba087 100644
--- a/staging/istio-helm-ztunnel/charts/ztunnel/templates/daemonset.yaml
+++ b/staging/istio-helm-ztunnel/charts/ztunnel/templates/daemonset.yaml
@@ -162,11 +162,17 @@ spec:
               resource: limits.cpu
               divisor: "1"
         {{- with .Values.env }}
+        {{/* CA_ADDRESS and XDS_ADDRESS are already rendered above; skip them here so a
+             legacy override (ztunnel.env.CA_ADDRESS/XDS_ADDRESS) can't create a duplicate
+             env entry that strict server-side apply rejects. */}}
+        {{- $reserved := list "CA_ADDRESS" "XDS_ADDRESS" }}
         {{- range $key, $val := . }}
+        {{- if not (has $key $reserved) }}
         - name: {{ $key }}
           value: "{{ $val }}"
         {{- end }}
         {{- end }}
+        {{- end }}
         {{- if .Values.peerCaCrl.enabled }}
         - name: CRL_PATH
           value: "/var/run/secrets/istio/crl/ca-crl.pem"