diff --git a/CHANGELOG.md b/CHANGELOG.md
index e779d8f..6a56e20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,15 @@ Two version streams move independently:
 
 ### Chart
 
+- **`chart/1.10.0`** — New `deploymentAnnotations` value, rendered onto the
+  `Deployment` object's own `metadata.annotations`. Until now the chart only
+  exposed `podAnnotations`, which lands on the pod template — so controllers
+  that watch the workload metadata had no way in. The motivating case is
+  Stakater Reloader (`reloader.stakater.com/auto: "true"`): the TLS secret is
+  mounted with `subPath`, which kubelet never refreshes in place, so a renewed
+  certificate is only picked up when the pods restart. Without the annotation
+  the proxy keeps serving the expired certificate after cert-manager rotates
+  it, and every TLS client fails with `x509: certificate has expired`.
 - **`chart/1.9.3`** — Dashboard usability + Go runtime panels.
   - `Job` picker now defaults to **All** (`allValue: ".*s3proxy.*"`) and
     restricts its dropdown to jobs whose name contains `s3proxy` via the
diff --git a/charts/s3proxy/Chart.yaml b/charts/s3proxy/Chart.yaml
index 7884401..8a8d384 100644
--- a/charts/s3proxy/Chart.yaml
+++ b/charts/s3proxy/Chart.yaml
@@ -18,5 +18,5 @@ maintainers:
 annotations:
   org.opencontainers.image.source: "https://github.com/intrinsec/s3proxy/"
 type: application
-version: 1.9.3
+version: 1.10.0
 appVersion: "1.8.1"
diff --git a/charts/s3proxy/templates/deployment.yaml b/charts/s3proxy/templates/deployment.yaml
index f7e2471..2520d6c 100644
--- a/charts/s3proxy/templates/deployment.yaml
+++ b/charts/s3proxy/templates/deployment.yaml
@@ -4,6 +4,10 @@ metadata:
   name: {{ include "s3proxy.fullname" . }}
   labels:
     {{- include "s3proxy.labels" . | nindent 4 }}
+  {{- with .Values.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
diff --git a/charts/s3proxy/values.schema.json b/charts/s3proxy/values.schema.json
index 38ee718..ef1ef02 100644
--- a/charts/s3proxy/values.schema.json
+++ b/charts/s3proxy/values.schema.json
@@ -99,6 +99,7 @@
       "type": "object",
       "additionalProperties": true
     },
+    "deploymentAnnotations": { "type": "object" },
     "podAnnotations": { "type": "object" },
     "podLabels": { "type": "object" },
     "podSecurityContext": { "type": "object" },
diff --git a/charts/s3proxy/values.yaml b/charts/s3proxy/values.yaml
index 4cc25b1..df55c2b 100644
--- a/charts/s3proxy/values.yaml
+++ b/charts/s3proxy/values.yaml
@@ -80,6 +80,15 @@ valsSecret: {}
 #   secretKey: ref+vault://s3proxy/secrets/secret-key
 #   encryptKey: ref+vault://s3proxy/secrets/encrypt-key
 
+# Annotations set on the Deployment object itself (not the pod template).
+# Required by controllers that watch the workload metadata, e.g. Stakater
+# Reloader, which restarts the pods when the TLS secret is renewed:
+#   deploymentAnnotations:
+#     reloader.stakater.com/auto: "true"
+# The cert secret is mounted with subPath, so kubelet never refreshes it
+# in-place — a pod restart is the only way to pick up a renewed certificate.
+deploymentAnnotations: {}
+
 podAnnotations: {}
 podLabels: {}