diff --git a/.gitignore b/.gitignore
index 99aa3d1..08a141a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,6 +43,11 @@ vendor/
 tmp/
 temp/
 *.log
+*.bak
+
+# Private keys (agent-generated, never commit)
+cmd/agent/*.key
+cmd/agent/*.pem
 
 # Database
 *.db
diff --git a/deploy/helm/certctl/templates/server-deployment.yaml b/deploy/helm/certctl/templates/server-deployment.yaml
index 16a9a79..7481587 100644
--- a/deploy/helm/certctl/templates/server-deployment.yaml
+++ b/deploy/helm/certctl/templates/server-deployment.yaml
@@ -181,16 +181,16 @@ spec:
         {{- if .Values.server.volumes }}
         {{- toYaml .Values.server.volumes | nindent 8 }}
         {{- end }}
-      {{- with .Values.nodeAffinity }}
+      {{- if .Values.nodeAffinity }}
       affinity:
         nodeAffinity:
-          {{- toYaml . | nindent 10 }}
+          {{- toYaml .Values.nodeAffinity | nindent 10 }}
       {{- else if .Values.podAntiAffinity }}
       affinity:
         podAntiAffinity:
-          {{- toYaml . | nindent 10 }}
+          {{- toYaml .Values.podAntiAffinity | nindent 10 }}
       {{- else if .Values.podAffinity }}
       affinity:
         podAffinity:
-          {{- toYaml . | nindent 10 }}
+          {{- toYaml .Values.podAffinity | nindent 10 }}
       {{- end }}
diff --git a/internal/service/digest.go b/internal/service/digest.go
index d98bf5c..7002101 100644
--- a/internal/service/digest.go
+++ b/internal/service/digest.go
@@ -122,10 +122,7 @@ func (s *DigestService) GenerateDigest(ctx context.Context) (*DigestData, error)
 		s.logger.Warn("failed to get status counts for digest", "error", err)
 	} else if counts, ok := statusRaw.([]CertificateStatusCount); ok {
 		for _, c := range counts {
-			digest.StatusCounts = append(digest.StatusCounts, DigestStatusCount{
-				Status: c.Status,
-				Count:  c.Count,
-			})
+			digest.StatusCounts = append(digest.StatusCounts, DigestStatusCount(c))
 		}
 	}