diff --git a/MosipNexus/Server/alembic/env.py b/MosipNexus/Server/alembic/env.py
index 05ebab6..4f8f952 100644
--- a/MosipNexus/Server/alembic/env.py
+++ b/MosipNexus/Server/alembic/env.py
@@ -21,7 +21,13 @@
     fileConfig(config.config_file_name)
 
 target_metadata = Base.metadata
-config.set_main_option("sqlalchemy.url", PG_CONNECTION)
+# set_main_option() writes through a ConfigParser, which treats "%" as the
+# start of interpolation syntax (%(name)s) — a password containing a
+# percent-encoded character (e.g. "@" -> "%40") raises
+# "invalid interpolation syntax" unless every literal "%" is escaped as "%%"
+# first. ConfigParser un-escapes "%%" -> "%" again on read, so this round-trips
+# back to the exact original PG_CONNECTION value.
+config.set_main_option("sqlalchemy.url", PG_CONNECTION.replace("%", "%%"))
 
 # Never touch LangChain-owned tables
 _SKIP_TABLES = {
diff --git a/MosipNexus/deploy/nexus-server/install.sh b/MosipNexus/deploy/nexus-server/install.sh
index 25d2e82..8a581bf 100755
--- a/MosipNexus/deploy/nexus-server/install.sh
+++ b/MosipNexus/deploy/nexus-server/install.sh
@@ -1,14 +1,15 @@
 #!/bin/bash
 # Installs / upgrades the MOSIP Nexus Server (RAG API, postgres, crawlers/jobs, MCP)
-## Usage: ./install.sh [kubeconfig] [extra-secrets-env-file] [values-file]
+## Usage: ./install.sh [kubeconfig] [extra-secrets-env-file]
 ##   kubeconfig              optional path to a kubeconfig (defaults to $KUBECONFIG /
 ##                           ~/.kube/config)
 ##   extra-secrets-env-file  optional local, gitignored dotenv file (KEY=value lines,
 ##                           same keys as Server/.env.example) for OPTIONAL Secret
 ##                           keys — GITHUB_TOKEN, GROQ_API_KEY, SMTP_*, AWS_*, ... Only
 ##                           read the first time the "nexus-env" Secret is created.
-##   values-file              optional local values override for NON-secret settings
-##                           (storageClassName, image.tag, routing.mode=nginx, ...)
+## Requires my-values.yaml (local, gitignored, non-secret overrides — storageClassName,
+## image.tag, routing.mode=nginx, ...) to exist in this directory — run from
+## deploy/nexus-server/, not elsewhere.
 ## Env: ROLLOUT_TIMEOUT  max time to wait for the rollout (default 10m) —
 ##      `kubectl rollout status` has no timeout by default and would otherwise
 ##      block indefinitely if the Deployment can't become ready.
@@ -32,7 +33,7 @@ if [ $# -ge 1 ] && [ -n "$1" ] ; then
   export KUBECONFIG=$1
 fi
 
-NS=mosip-nexus
+NS=nexus
 RELEASE=nexus-server
 CHART_REPO=mosip
 CHART_REPO_URL=https://mosip.github.io/mosip-helm
@@ -41,10 +42,6 @@ CHART_VERSION="${CHART_VERSION:-1.0.0}"
 SECRET_NAME=nexus-env
 ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-10m}"
 EXTRA_SECRETS_FILE="${2:-}"
-VALUES_ARGS=()
-if [ $# -ge 3 ] && [ -n "$3" ] ; then
-  VALUES_ARGS=(-f "$3")
-fi
 
 # Pure-bash percent-encoding — POSTGRES_PASSWORD can contain characters
 # (@ : / # ?) that would otherwise corrupt the derived PG_CONNECTION URL.
@@ -163,7 +160,7 @@ function installing_nexus_server() {
   echo "Installing/upgrading $RELEASE from $CHART_REPO/$CHART_NAME @ $CHART_VERSION (published chart)"
   helm -n "$NS" upgrade --install "$RELEASE" "$CHART_REPO/$CHART_NAME" \
     --version "$CHART_VERSION" \
-    "${VALUES_ARGS[@]}" \
+    -f my-values.yaml \
     --set secret.existingSecret="$SECRET_NAME" \
     --wait
 
diff --git a/MosipNexus/deploy/nexus-ui/install.sh b/MosipNexus/deploy/nexus-ui/install.sh
index aa687b2..4452085 100755
--- a/MosipNexus/deploy/nexus-ui/install.sh
+++ b/MosipNexus/deploy/nexus-ui/install.sh
@@ -1,11 +1,13 @@
 #!/bin/bash
 # Installs / upgrades the MOSIP Nexus UI (React + nginx)
-## Usage: ./install.sh [kubeconfig] [values-file]
+## Usage: ./install.sh [kubeconfig]
 ##
 ## Prerequisite: deploy/nexus-server/install.sh already ran successfully in
 ## the same namespace — this chart's nginx proxies same-origin /api/* to the
 ## "nexus-api" Service created by that release.
 ## Installs from the published chart (mosip/nexus-ui @ https://mosip.github.io/mosip-helm).
+## Requires my-values.yaml (local, gitignored, non-secret overrides — image.tag, ...)
+## to exist in this directory — run from deploy/nexus-ui/, not elsewhere.
 ## Env: ROLLOUT_TIMEOUT  max time to wait for the rollout (default 10m).
 ##      CHART_VERSION   published nexus-ui chart version to install (default
 ##      1.0.0). A routine redeploy always gets exactly this version, not
@@ -23,10 +25,6 @@ CHART_REPO_URL=https://mosip.github.io/mosip-helm
 CHART_NAME=nexus-ui
 CHART_VERSION="${CHART_VERSION:-1.0.0}"
 ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-10m}"
-VALUES_ARGS=()
-if [ $# -ge 2 ] && [ -n "$2" ] ; then
-  VALUES_ARGS=(-f "$2")
-fi
 
 function installing_nexus_ui() {
   if ! kubectl -n "$NS" get svc nexus-api >/dev/null 2>&1 ; then
@@ -50,7 +48,7 @@ function installing_nexus_ui() {
 
   echo "Installing/upgrading $RELEASE from $CHART_REPO/$CHART_NAME @ $CHART_VERSION (published chart)"
   helm -n "$NS" upgrade --install "$RELEASE" "$CHART_REPO/$CHART_NAME" \
-    --version "$CHART_VERSION" "${VALUES_ARGS[@]}" --wait
+    --version "$CHART_VERSION" -f my-values.yaml --wait
 
   kubectl -n "$NS" rollout status deployment/nexus-ui --timeout="$ROLLOUT_TIMEOUT"
   echo "Installed $RELEASE"