diff --git a/charts/substrate/README.md b/charts/substrate/README.md
index 4ae503fd25..b0070daae7 100644
--- a/charts/substrate/README.md
+++ b/charts/substrate/README.md
@@ -65,6 +65,7 @@ See `values.yaml` for the full set; the important keys:
 | `atelet.storageBackend` | `s3` | Default snapshot backend, wired to RustFS when `rustfs.enabled=true` |
 | `atelet.imageCredentialProviderConfig` | `""` | Host path to the kubelet credential provider config; set together with the bin directory |
 | `atelet.imageCredentialProviderConfigYAML` | `""` | Credential provider config as text, rendered into a ConfigMap, for nodes where that file cannot be authored or must differ from the kubelet's; mutually exclusive with the host path |
+| `atelet.nodeSelector` | `{}` | Node labels atelet pods must match; must cover the nodes of every WorkerPool |
 | `atelet.imageCredentialProviderBinDir` | `""` | Host path to the kubelet credential provider binaries; both paths are mounted read-only |
 | `credentialProvider.namespacePolicies` | `[]` | Default-deny atespace-to-namespace grants; the chart includes get-only Secret RBAC for the provider |
 | `ateApi.actorJWTIssuer` | `https://<idp-service>.<namespace>.svc` | Issuer placed in actor JWTs; set a stable URL reachable by relying parties |
diff --git a/charts/substrate/templates/atelet.yaml b/charts/substrate/templates/atelet.yaml
index 42d0ed60e3..779afc0ec4 100644
--- a/charts/substrate/templates/atelet.yaml
+++ b/charts/substrate/templates/atelet.yaml
@@ -128,6 +128,10 @@ spec:
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "atelet" .) }}
       priorityClassName: {{ include "substrate.fullname" (list "ate-node-critical" .) }}
+      {{- with .Values.atelet.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       # Run on nodes reserved for any WorkerPool sandbox class.
       tolerations:
       - key: ate.dev/sandboxClass
diff --git a/charts/substrate/tests/control_plane_test.yaml b/charts/substrate/tests/control_plane_test.yaml
index 6929288577..8623f3ada1 100644
--- a/charts/substrate/tests/control_plane_test.yaml
+++ b/charts/substrate/tests/control_plane_test.yaml
@@ -107,6 +107,28 @@ tests:
         key: cloud.google.com/compute-class
         operator: Exists
         effect: NoSchedule
+- it: schedules atelet on every node by default
+  template: atelet.yaml
+  documentSelector:
+    path: kind
+    value: DaemonSet
+  asserts:
+  - notExists:
+      path: spec.template.spec.nodeSelector
+- it: restricts atelet to nodes matching atelet.nodeSelector
+  template: atelet.yaml
+  documentSelector:
+    path: kind
+    value: DaemonSet
+  set:
+    atelet:
+      nodeSelector:
+        pool: agents
+  asserts:
+  - equal:
+      path: spec.template.spec.nodeSelector
+      value:
+        pool: agents
 - it: probes the credential provider on its health listener
   template: k8s-credential-provider.yaml
   documentSelector:
diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml
index 336fd71cac..674060f073 100644
--- a/charts/substrate/values.yaml
+++ b/charts/substrate/values.yaml
@@ -84,6 +84,9 @@ atelet:
   imageCredentialProviderConfigYAML: ""
   imageCredentialProviderBinDir: ""
   storageBackend: s3
+  # Restricts atelet to matching nodes. Every node that runs WorkerPool pods
+  # needs an atelet, so cover each pool's nodeSelector here.
+  nodeSelector: {}
   extraArgs: []
   extraEnv: []
   resources: