@@ -83,6 +83,11 @@ func main() {
 	var disableTelemetry bool
 	var telemetryEndpoint string
 	var telemetryInterval string
+	var helmReleaseInterval string
+	var helmReleaseRetryInterval string
+	var helmReleaseInstallTimeout string
+	var helmReleaseUpgradeTimeout string
+	var helmReleaseMaxHistory int
 	var cozyValuesSecretName string
 	var cozyValuesSecretNamespace string
 	var cozyValuesNamespaceSelector string
@@ -107,6 +112,28 @@ func main() {
 		"Endpoint for sending telemetry data")
 	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
 		"Interval between telemetry data collection (e.g. 15m, 1h)")
+	flag.StringVar(&helmReleaseInterval, "helmrelease-interval", "5m",
+		"Reconcile interval applied to HelmReleases created by the Package reconciler. "+
+			"Lower values speed up dependency-blocked retries (e.g. during E2E install) at the cost of "+
+			"controller load. Production default 5m matches existing behaviour.")
+	flag.StringVar(&helmReleaseRetryInterval, "helmrelease-retry-interval", "30s",
+		"Retry interval applied to Install.Strategy and Upgrade.Strategy of HelmReleases created "+
+			"by the Package reconciler. With Strategy.Name=RetryOnFailure, this controls how long the "+
+			"controller waits between failed install/upgrade attempts. Decoupled from --helmrelease-interval "+
+			"(which is the healthy reconcile cadence) so failures recover fast without polling healthy "+
+			"releases at the same fast cadence.")
+	flag.StringVar(&helmReleaseInstallTimeout, "helmrelease-install-timeout", "10m",
+		"Timeout for the Helm install action of HelmReleases created by the Package reconciler "+
+			"(Spec.Install.Timeout). Bounds how long an individual Kubernetes operation (Job/hook/wait) "+
+			"may take during install.")
+	flag.StringVar(&helmReleaseUpgradeTimeout, "helmrelease-upgrade-timeout", "10m",
+		"Timeout for the Helm upgrade action of HelmReleases created by the Package reconciler "+
+			"(Spec.Upgrade.Timeout). Bounds how long an individual Kubernetes operation (Job/hook/wait) "+
+			"may take during upgrade.")
+	flag.IntVar(&helmReleaseMaxHistory, "helmrelease-max-history", 5,
+		"Number of release revisions Helm keeps for HelmReleases created by the Package reconciler "+
+			"(Spec.MaxHistory). 0 means unlimited; 5 matches Helm's default. Lower values reduce "+
+			"per-release Secret accumulation in clusters that bounce HRs frequently (e.g. E2E sandboxes).")
 	flag.StringVar(&platformSourceURL, "platform-source-url", "", "Platform source URL (oci:// or https://). If specified, generates OCIRepository or GitRepository resource.")
 	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-platform", "Name for the generated platform source resource and PackageSource")
 	flag.StringVar(&platformSourceRef, "platform-source-ref", "", "Reference specification as key=value pairs (e.g., 'branch=main' or 'digest=sha256:...,tag=v1.0'). For OCI: digest, semver, semverFilter, tag. For Git: branch, tag, semver, name, commit.")
@@ -122,6 +149,23 @@ func main() {
 
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
+	parseFlag := func(flagName, raw string) time.Duration {
+		d, err := parsePositiveDuration(flagName, raw)
+		if err != nil {
+			setupLog.Error(err, "invalid duration flag")
+			os.Exit(1)
+		}
+		return d
+	}
+	hrIntervalDuration := parseFlag("--helmrelease-interval", helmReleaseInterval)
+	hrRetryIntervalDuration := parseFlag("--helmrelease-retry-interval", helmReleaseRetryInterval)
+	hrInstallTimeoutDuration := parseFlag("--helmrelease-install-timeout", helmReleaseInstallTimeout)
+	hrUpgradeTimeoutDuration := parseFlag("--helmrelease-upgrade-timeout", helmReleaseUpgradeTimeout)
+	if helmReleaseMaxHistory < 0 {
+		setupLog.Error(fmt.Errorf("--helmrelease-max-history must be >= 0"), "invalid value", "value", helmReleaseMaxHistory)
+		os.Exit(1)
+	}
+
 	config := ctrl.GetConfigOrDie()
 
 	// Create a direct client (without cache) for pre-start operations
@@ -258,8 +302,13 @@ func main() {
 
 	// Setup Package reconciler
 	if err := (&operator.PackageReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:                    mgr.GetClient(),
+		Scheme:                    mgr.GetScheme(),
+		HelmReleaseInterval:       hrIntervalDuration,
+		HelmReleaseRetryInterval:  hrRetryIntervalDuration,
+		HelmReleaseInstallTimeout: hrInstallTimeoutDuration,
+		HelmReleaseUpgradeTimeout: hrUpgradeTimeoutDuration,
+		HelmReleaseMaxHistory:     helmReleaseMaxHistory,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Package")
 		os.Exit(1)
@@ -390,6 +439,21 @@ func installPlatformSourceResource(ctx context.Context, k8sClient client.Client,
 	return nil
 }
 
+// parsePositiveDuration parses raw as a time.Duration and rejects malformed
+// or non-positive values. Flux HelmRelease fields (Interval, Timeout,
+// RetryInterval) require strictly positive durations, so a misconfigured
+// flag must fail fast at startup rather than propagating into every HR.
+func parsePositiveDuration(flagName, raw string) (time.Duration, error) {
+	d, err := time.ParseDuration(raw)
+	if err != nil {
+		return 0, fmt.Errorf("invalid duration for %s=%q: %w", flagName, raw, err)
+	}
+	if d <= 0 {
+		return 0, fmt.Errorf("%s must be > 0 (got %q)", flagName, raw)
+	}
+	return d, nil
+}
+
 // parsePlatformSourceURL parses the source URL and returns the source type and repository URL.
 // Supports formats:
 //   - oci://registry.example.com/repo
 
@@ -19,6 +19,7 @@ package main
 import (
 	"context"
 	"testing"
+	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -572,3 +573,38 @@ func TestGenerateGitRepository_InvalidRef(t *testing.T) {
 		t.Fatal("expected error for invalid Git ref key, got nil")
 	}
 }
+
+func TestParsePositiveDuration(t *testing.T) {
+	tests := []struct {
+		name    string
+		raw     string
+		want    time.Duration
+		wantErr bool
+	}{
+		{name: "valid seconds", raw: "30s", want: 30 * time.Second},
+		{name: "valid minutes", raw: "5m", want: 5 * time.Minute},
+		{name: "valid compound", raw: "1h30m", want: 90 * time.Minute},
+		{name: "zero rejected", raw: "0s", wantErr: true},
+		{name: "negative rejected", raw: "-5m", wantErr: true},
+		{name: "malformed rejected", raw: "5x", wantErr: true},
+		{name: "empty rejected", raw: "", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parsePositiveDuration("--test-flag", tt.raw)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected error for %q, got nil", tt.raw)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error for %q: %v", tt.raw, err)
+			}
+			if got != tt.want {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
@@ -37,6 +37,7 @@
     --install \
     --namespace cozy-system \
     --create-namespace \
+    --set cozystackOperator.helmReleaseInterval=30s \
     --wait \
     --timeout 2m
 
@@ -185,16 +186,7 @@ EOF
   timeout 60 sh -ec 'until kubectl get hr -n tenant-root etcd ingress monitoring seaweedfs tenant-root >/dev/null 2>&1; do sleep 1; done'
   kubectl wait hr/etcd hr/ingress hr/tenant-root hr/seaweedfs -n tenant-root --timeout=4m --for=condition=ready
 
-  # TODO: Workaround ingress unvailability issue
-  if ! kubectl wait hr/monitoring -n tenant-root --timeout=2m --for=condition=ready; then
-    flux reconcile hr monitoring -n tenant-root --force
-    kubectl wait hr/monitoring -n tenant-root --timeout=2m --for=condition=ready
-  fi
-
-  if ! kubectl wait hr/seaweedfs-system -n tenant-root --timeout=2m --for=condition=ready; then
-    flux reconcile hr seaweedfs-system -n tenant-root --force
-    kubectl wait hr/seaweedfs-system -n tenant-root --timeout=2m --for=condition=ready
-  fi
+  kubectl wait hr/monitoring hr/seaweedfs-system -n tenant-root --timeout=2m --for=condition=ready
 
 
   # Expose Cozystack services through ingress
 
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
@@ -58,7 +59,43 @@ func parseCRDPolicy(install *cozyv1alpha1.ComponentInstall) helmv2.CRDsPolicy {
 // PackageReconciler reconciles Package resources
 type PackageReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	Scheme                    *runtime.Scheme
+	HelmReleaseInterval       time.Duration
+	HelmReleaseRetryInterval  time.Duration
+	HelmReleaseInstallTimeout time.Duration
+	HelmReleaseUpgradeTimeout time.Duration
+	HelmReleaseMaxHistory     int
+}
+
+// buildHelmReleaseSpec assembles the Spec applied to every generated
+// HelmRelease. RetryInterval drives recovery from failed install/upgrade
+// attempts; Interval polls healthy releases.
+func (r *PackageReconciler) buildHelmReleaseSpec(componentInstall *cozyv1alpha1.ComponentInstall, artifactName string) helmv2.HelmReleaseSpec {
+	maxHistory := r.HelmReleaseMaxHistory
+	return helmv2.HelmReleaseSpec{
+		Interval:   metav1.Duration{Duration: r.HelmReleaseInterval},
+		MaxHistory: &maxHistory,
+		ChartRef: &helmv2.CrossNamespaceSourceReference{
+			Kind:      "ExternalArtifact",
+			Name:      artifactName,
+			Namespace: "cozy-system",
+		},
+		Install: &helmv2.Install{
+			Timeout: &metav1.Duration{Duration: r.HelmReleaseInstallTimeout},
+			Strategy: &helmv2.InstallStrategy{
+				Name:          string(helmv2.ActionStrategyRetryOnFailure),
+				RetryInterval: &metav1.Duration{Duration: r.HelmReleaseRetryInterval},
+			},
+		},
+		Upgrade: &helmv2.Upgrade{
+			Timeout: &metav1.Duration{Duration: r.HelmReleaseUpgradeTimeout},
+			Strategy: &helmv2.UpgradeStrategy{
+				Name:          string(helmv2.ActionStrategyRetryOnFailure),
+				RetryInterval: &metav1.Duration{Duration: r.HelmReleaseRetryInterval},
+			},
+			CRDs: parseCRDPolicy(componentInstall),
+		},
+	}
 }
 
 // +kubebuilder:rbac:groups=cozystack.io,resources=packages,verbs=get;list;watch;create;update;patch;delete
@@ -213,27 +250,7 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 				Namespace: namespace,
 				Labels:    labels,
 			},
-			Spec: helmv2.HelmReleaseSpec{
-				Interval: metav1.Duration{Duration: 5 * 60 * 1000000000}, // 5m
-				ChartRef: &helmv2.CrossNamespaceSourceReference{
-					Kind:      "ExternalArtifact",
-					Name:      artifactName,
-					Namespace: "cozy-system",
-				},
-				Install: &helmv2.Install{
-					Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
-					Remediation: &helmv2.InstallRemediation{
-						Retries: -1,
-					},
-				},
-				Upgrade: &helmv2.Upgrade{
-					Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
-					Remediation: &helmv2.UpgradeRemediation{
-						Retries: -1,
-					},
-					CRDs: parseCRDPolicy(component.Install),
-				},
-			},
+			Spec: r.buildHelmReleaseSpec(component.Install, artifactName),
 		}
 
 		// Add valuesFrom for cozystack-values secret unless disabled by annotation on PackageSource
 
@@ -21,6 +21,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
@@ -71,6 +72,101 @@ func TestParseCRDPolicy(t *testing.T) {
 	}
 }
 
+func TestBuildHelmReleaseSpec(t *testing.T) {
+	r := &PackageReconciler{
+		HelmReleaseInterval:       42 * time.Second,
+		HelmReleaseRetryInterval:  17 * time.Second,
+		HelmReleaseInstallTimeout: 11 * time.Minute,
+		HelmReleaseUpgradeTimeout: 13 * time.Minute,
+		HelmReleaseMaxHistory:     7,
+	}
+	componentInstall := &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Skip"}
+
+	spec := r.buildHelmReleaseSpec(componentInstall, "ps-variant-component")
+
+	if spec.Interval.Duration != 42*time.Second {
+		t.Errorf("Interval = %v, want 42s", spec.Interval.Duration)
+	}
+	if spec.MaxHistory == nil {
+		t.Fatal("MaxHistory is nil, want pointer to 7")
+	}
+	if *spec.MaxHistory != 7 {
+		t.Errorf("MaxHistory = %d, want 7", *spec.MaxHistory)
+	}
+
+	if spec.ChartRef == nil {
+		t.Fatal("ChartRef is nil")
+	}
+	if spec.ChartRef.Kind != "ExternalArtifact" {
+		t.Errorf("ChartRef.Kind = %q, want ExternalArtifact", spec.ChartRef.Kind)
+	}
+	if spec.ChartRef.Name != "ps-variant-component" {
+		t.Errorf("ChartRef.Name = %q, want ps-variant-component", spec.ChartRef.Name)
+	}
+	if spec.ChartRef.Namespace != "cozy-system" {
+		t.Errorf("ChartRef.Namespace = %q, want cozy-system", spec.ChartRef.Namespace)
+	}
+
+	if spec.Install == nil {
+		t.Fatal("Install is nil")
+	}
+	if spec.Install.Timeout == nil || spec.Install.Timeout.Duration != 11*time.Minute {
+		t.Errorf("Install.Timeout = %v, want 11m", spec.Install.Timeout)
+	}
+	if spec.Install.Strategy == nil {
+		t.Fatal("Install.Strategy is nil")
+	}
+	if spec.Install.Strategy.Name != string(helmv2.ActionStrategyRetryOnFailure) {
+		t.Errorf("Install.Strategy.Name = %q, want %q", spec.Install.Strategy.Name, helmv2.ActionStrategyRetryOnFailure)
+	}
+	if spec.Install.Strategy.RetryInterval == nil || spec.Install.Strategy.RetryInterval.Duration != 17*time.Second {
+		t.Errorf("Install.Strategy.RetryInterval = %v, want 17s", spec.Install.Strategy.RetryInterval)
+	}
+	// Remediation must remain nil: helm-controller's XValidation rule rejects
+	// Strategy.Name=RetryOnFailure with RetryInterval set alongside a
+	// Remediation entry, so a future "for safety" re-introduction of
+	// Remediation{Retries: -1} would silently break every HR.
+	if spec.Install.Remediation != nil {
+		t.Errorf("Install.Remediation = %+v, want nil", spec.Install.Remediation)
+	}
+
+	if spec.Upgrade == nil {
+		t.Fatal("Upgrade is nil")
+	}
+	if spec.Upgrade.Timeout == nil || spec.Upgrade.Timeout.Duration != 13*time.Minute {
+		t.Errorf("Upgrade.Timeout = %v, want 13m", spec.Upgrade.Timeout)
+	}
+	if spec.Upgrade.Strategy == nil {
+		t.Fatal("Upgrade.Strategy is nil")
+	}
+	if spec.Upgrade.Strategy.Name != string(helmv2.ActionStrategyRetryOnFailure) {
+		t.Errorf("Upgrade.Strategy.Name = %q, want %q", spec.Upgrade.Strategy.Name, helmv2.ActionStrategyRetryOnFailure)
+	}
+	if spec.Upgrade.Strategy.RetryInterval == nil || spec.Upgrade.Strategy.RetryInterval.Duration != 17*time.Second {
+		t.Errorf("Upgrade.Strategy.RetryInterval = %v, want 17s", spec.Upgrade.Strategy.RetryInterval)
+	}
+	if spec.Upgrade.Remediation != nil {
+		t.Errorf("Upgrade.Remediation = %+v, want nil", spec.Upgrade.Remediation)
+	}
+	if spec.Upgrade.CRDs != helmv2.Skip {
+		t.Errorf("Upgrade.CRDs = %q, want Skip", spec.Upgrade.CRDs)
+	}
+}
+
+// TestBuildHelmReleaseSpecZeroMaxHistory pins that MaxHistory=0 (unlimited
+// history per Helm semantics) survives the spec build — i.e. is set as a
+// non-nil pointer to 0 rather than dropped or replaced with a default.
+func TestBuildHelmReleaseSpecZeroMaxHistory(t *testing.T) {
+	r := &PackageReconciler{HelmReleaseMaxHistory: 0}
+	spec := r.buildHelmReleaseSpec(nil, "x")
+	if spec.MaxHistory == nil {
+		t.Fatal("MaxHistory is nil for HelmReleaseMaxHistory=0; want pointer to 0")
+	}
+	if *spec.MaxHistory != 0 {
+		t.Errorf("MaxHistory = %d, want 0", *spec.MaxHistory)
+	}
+}
+
 // TestPackageSourceCRDHasUpgradeCRDsEnum guards the generated CRD schema: the
 // invalid-value case from the spec is enforced at the API server via a
 // kubebuilder enum marker, not in the reconciler. If someone drops the marker
 
@@ -58,6 +58,21 @@ spec:
         {{- if .Values.cozystackOperator.disableTelemetry }}
         - --disable-telemetry
         {{- end }}
+        {{- if ne (toString .Values.cozystackOperator.helmReleaseInterval) "" }}
+        - --helmrelease-interval={{ .Values.cozystackOperator.helmReleaseInterval }}
+        {{- end }}
+        {{- if ne (toString .Values.cozystackOperator.helmReleaseRetryInterval) "" }}
+        - --helmrelease-retry-interval={{ .Values.cozystackOperator.helmReleaseRetryInterval }}
+        {{- end }}
+        {{- if ne (toString .Values.cozystackOperator.helmReleaseInstallTimeout) "" }}
+        - --helmrelease-install-timeout={{ .Values.cozystackOperator.helmReleaseInstallTimeout }}
+        {{- end }}
+        {{- if ne (toString .Values.cozystackOperator.helmReleaseUpgradeTimeout) "" }}
+        - --helmrelease-upgrade-timeout={{ .Values.cozystackOperator.helmReleaseUpgradeTimeout }}
+        {{- end }}
+        {{- if ne (toString .Values.cozystackOperator.helmReleaseMaxHistory) "" }}
+        - --helmrelease-max-history={{ .Values.cozystackOperator.helmReleaseMaxHistory }}
+        {{- end }}
         - --platform-source-name=cozystack-platform
         - --platform-source-url={{ .Values.cozystackOperator.platformSourceUrl }}
         {{- if .Values.cozystackOperator.platformSourceRef }}