diff --git a/charts/aisix/README.md b/charts/aisix/README.md
index 9358ac9..70abfd2 100644
--- a/charts/aisix/README.md
+++ b/charts/aisix/README.md
@@ -567,6 +567,7 @@ rejects. New installs set the value in its own key in `values.yaml` or under
 | config.observability.service_name | string | `"aisix"` | Service name reported in telemetry |
 | config.outbound.ssrf_protection.allowed_hosts | list | `[]` | Hosts such a fetch may reach although they resolve to a non-public address, as `host` or `host:port` (IPv6 with a port as `[addr]:port`). Behind a fake-ip DNS that maps public names into 198.18.0.0/15, list those hosts here |
 | config.outbound.ssrf_protection.enabled | bool | `true` | Only reach publicly routable addresses when fetching a URL an API caller supplied (today the media download). false turns the check off and ignores `allowed_hosts` |
+| config.proxy.expose_debug_headers | bool | `false` | Send the debug response headers on `/v1/chat/completions` (`x-aisix-call-id`, `x-aisix-served-by`, `x-aisix-route`, `x-aisix-cache*`). Off by default because they reveal which model behind a model group answered |
 | config.proxy.real_ip.header | string | `"x-forwarded-for"` | Header carrying the client IP |
 | config.proxy.real_ip.recursive | bool | `false` | Walk the header right to left past every trusted proxy |
 | config.proxy.real_ip.trusted_proxies | list | `[]` | CIDRs (or bare IPs) of proxies trusted to set the client-IP header |
diff --git a/charts/aisix/values.yaml b/charts/aisix/values.yaml
index 94c6dbf..5e665ff 100644
--- a/charts/aisix/values.yaml
+++ b/charts/aisix/values.yaml
@@ -254,6 +254,10 @@ config:
     # -- Entry-level URL rewrite rules, first match wins, e.g.
     # `[{name: per-server-mcp, match: "^/mcp-servers/([^/]+)/mcp$", rewrite: "/mcp/$1"}]`
     url_rewrites: []
+    # -- Send the debug response headers on `/v1/chat/completions`
+    # (`x-aisix-call-id`, `x-aisix-served-by`, `x-aisix-route`, `x-aisix-cache*`).
+    # Off by default because they reveal which model behind a model group answered
+    expose_debug_headers: false
   observability:
     # -- Service name reported in telemetry
     service_name: aisix