diff --git a/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml b/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml
index ec99311a..ad9d85a8 100644
--- a/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml
+++ b/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml
@@ -19,8 +19,10 @@ spec:
         type: ClusterIP
       envoyDeployment:
         pod:
+          {{- if .Values.aiGateway.nodeSelector }}
           nodeSelector:
-            cluster-bloom/first-node: "true"
+            {{- toYaml .Values.aiGateway.nodeSelector | nindent 12 }}
+          {{- end }}
           priorityClassName: "system-cluster-critical"
   telemetry:
     accessLog:
diff --git a/sources/envoy-gateway-config/templates/coredns-config.yaml b/sources/envoy-gateway-config/templates/coredns-config.yaml
index 2cc2102b..8693e438 100644
--- a/sources/envoy-gateway-config/templates/coredns-config.yaml
+++ b/sources/envoy-gateway-config/templates/coredns-config.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.rkeCoreDNS.enabled }}
 # CoreDNS Configuration for Wildcard Domain Routing
 # Copied from kgateway-config with service reference update
 # Makes *.domain resolve to envoy-gateway service
@@ -34,4 +35,5 @@ spec:
           parameters: "30"
         - name: loop
         - name: reload
-        - name: loadbalance
\ No newline at end of file
+        - name: loadbalance
+{{- end }}
\ No newline at end of file
diff --git a/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml b/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml
index 8cc5166a..5b181ad1 100644
--- a/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml
+++ b/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml
@@ -13,13 +13,23 @@ spec:
     type: Kubernetes
     kubernetes:
       envoyService:
+        {{- if .Values.appsGateway.envoyServiceAnnotations }}
+        annotations:
+          {{- toYaml .Values.appsGateway.envoyServiceAnnotations | nindent 10 }}
+        {{- end }}
+        {{- if .Values.appsGateway.envoyServicePatch }}
+        patch:
+          {{- toYaml .Values.appsGateway.envoyServicePatch | nindent 10 }}
+        {{- end }}
         # LoadBalancer: the apps gateway is the external front door and owns the VIP on :443
         # (HTTPS terminate + k8s TLS-passthrough listeners).
         type: {{ .Values.appsGateway.serviceType }}
       envoyDeployment:
         pod:
+          {{- if .Values.appsGateway.nodeSelector }}
           nodeSelector:
-            cluster-bloom/first-node: "true"
+            {{- toYaml .Values.appsGateway.nodeSelector | nindent 12 }}
+          {{- end }}
           priorityClassName: "system-cluster-critical"
   telemetry:
     accessLog:
diff --git a/sources/envoy-gateway-config/values.yaml b/sources/envoy-gateway-config/values.yaml
index b513a69f..75808ec5 100644
--- a/sources/envoy-gateway-config/values.yaml
+++ b/sources/envoy-gateway-config/values.yaml
@@ -8,6 +8,10 @@ ports:
 # on the same :443 VIP by SNI. No separate tls-passthrough gateway.
 appsGateway:
   serviceType: LoadBalancer
+  nodeSelector:
+    cluster-bloom/first-node: "true"
+  envoyServiceAnnotations:
+  envoyServicePatch:
 
 # Stable ClusterIP `https` selecting the apps-gateway data plane, used by CoreDNS for the
 # *.domain rewrite (in-cluster resolution).
@@ -27,3 +31,10 @@ aiGateway:
   # Stable ClusterIP `ai-gateway` (CoreDNS target / passthrough backend).
   dnsService:
     enabled: true
+  nodeSelector:
+    cluster-bloom/first-node: "true"
+
+# Configure RKE2 CoreDNS for Wilcdcard Domain Routing by making *.domain resolve to
+# envoy-gateway service
+rkeCoreDNS:
+  enabled: true