diff --git a/.gitea/workflows/chart-release.yml b/.gitea/workflows/chart-release.yml
index adcc009..c024b7f 100644
--- a/.gitea/workflows/chart-release.yml
+++ b/.gitea/workflows/chart-release.yml
@@ -59,6 +59,23 @@ jobs:
                     --set server.replicaCount=3 \
                     --set web.replicaCount=3 > /dev/null
 
+            # The reaper deletes whole instances, so "does this env appear only
+            # in cloud mode" is worth asserting rather than eyeballing.
+            - name: Check the reaper is cloud-only
+              run: |
+                  set -eu
+                  if helm template test "$CHART_DIR" | grep -q FREE_INSTANCE_REAP_AFTER; then
+                      echo "FREE_INSTANCE_REAP_AFTER is set on a self-hosted render"
+                      exit 1
+                  fi
+                  if ! helm template test "$CHART_DIR" \
+                        --set server.env.deploymentType=cloud \
+                      | grep -q FREE_INSTANCE_REAP_AFTER; then
+                      echo "FREE_INSTANCE_REAP_AFTER is missing from a cloud render"
+                      exit 1
+                  fi
+                  echo "ok: reaper configured in cloud mode only"
+
             - name: Render against external Redis and MongoDB
               run: |
                   helm template test "$CHART_DIR" \
diff --git a/deploy/chart/vantage/templates/_helpers.tpl b/deploy/chart/vantage/templates/_helpers.tpl
index 677c83a..367114e 100644
--- a/deploy/chart/vantage/templates/_helpers.tpl
+++ b/deploy/chart/vantage/templates/_helpers.tpl
@@ -72,11 +72,12 @@ both read it.
   value: {{ .Values.server.env.proxyAdvertiseHost | quote }}
 - name: PROXY_LISTEN_HOST
   value: {{ .Values.server.env.proxyListenHost | quote }}
-# The address guacd dials to reach a console relay. It must name one pod, not
-# the Service: the relay listener is bound by whichever pod holds that agent's
-# command stream, and a Service would send guacd to a different one. POD_IP
-# takes precedence over PROXY_ADVERTISE_HOST in the server for exactly this
-# reason, so the setting above stays meaningful only outside Kubernetes.
+{{- if eq .Values.server.env.deploymentType "cloud" }}
+- name: VANTAGE_DEPLOYMENT
+  value: "cloud"
+- name: FREE_INSTANCE_REAP_AFTER
+  value: {{ .Values.server.env.freeInstanceReapAfter | quote }}
+{{- end }}
 - name: POD_IP
   valueFrom:
     fieldRef: