diff --git a/README.md b/README.md
index a0dffa2..57425e6 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,10 @@ wget -O argocd.yaml https://raw.githubusercontent.com/GlueOps/docs-argocd/main/a
     - Replace `placeholder_tenant_key` with your tenant/company key. Example: `antoniostacos`
     - Replace `placeholder_cluster_environment` with your cluster_environment name. Example: `nonprod`
     - The `placeholder_argocd_oidc_client_secret_from_dex` that you specify needs to be the same one you use in the `platform.yaml` for ArgoCD. If they do not match you will not be able to login.
+    - The OTEL observability extension is **always installed** — there is no enable/disable input. It is defined in `argocd.yaml` and loaded by ArgoCD itself, so it applies to every Argo application without changing app templates.
+      - `otel_extension_version` pins the GitHub release tag of the extension bundle from [GlueOps/argo-cd-ui-extention](https://github.com/GlueOps/argo-cd-ui-extention). Optional; defaults to `v0.1.5`.
+      - The extension's **backend API is not deployed by this module**. It ships with the GlueOps platform chart as the `glueops-argocd-extension-backend` Application; this module only points `extension.config` at its in-cluster Service.
+    - If you are installing from the downloaded template directly instead of using Terraform, you must substitute every `placeholder_*` yourself. They are all ordinary scalar values, so `argocd.yaml.tpl` is valid YAML as downloaded. The OTEL extension config, its RBAC policies and its `server.extensions` block are written literally in the template -- only `placeholder_otel_extension_version` is substituted, and it is a plain string.
 
 - Install ArgoCD
 
@@ -38,14 +42,21 @@ kubectl get pods -n glueops-core
 
 ```hcl
 module "argocd_helm_values" {
-  source              = "git::https://github.com/GlueOps/docs-argocd.git"
+  source              = "git::https://github.com/GlueOps/docs-argocd.git?ref=v0.20.0"
   tenant_key          = "antoniostacos"
   cluster_environment = "nonprod"
-  client_secret       = "Zsbui/29YEqoGOzuI8snlqGcdaRYPSLocwLXDB5GhZY="
-  glueops_root_domain = "onglueops.com"
+  # Must match the dex client secret used in platform.yaml, or login will fail.
+  client_secret        = "<dex argocd client secret>"
+  glueops_root_domain  = "onglueops.com"
+  argocd_rbac_policies = "      g, glueops-rocks:super_admins, role:admin\n"
+  argocd_app_version   = "v3.2.12"
+  gatekeeper_tag       = "v0.1.1"
+
+  # Optional. Defaults to v0.1.5.
+  otel_extension_version = "v0.1.5"
 }
 
 output "argocd_helm_values" {
-  value = module.argocd_yaml.argocd
+  value = module.argocd_helm_values.helm_values
 }
 ```
diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl
index 61c3edc..3f05fd9 100644
--- a/argocd.yaml.tpl
+++ b/argocd.yaml.tpl
@@ -139,6 +139,7 @@ applicationSet:
 configs:
   params:
     server.insecure: true
+    server.enable.proxy.extension: true
   cm:
     # @ignored
     timeout.reconciliation: 10s
@@ -208,15 +209,39 @@ configs:
       allowedAudiences:
         - argocd
         - toolbox
+    # The backend Service name and namespace are fixed constants in
+    # platform-helm-chart-platform; nothing here is per-cluster.
+    extension.config: |
+      extensions:
+        - name: otel-extension
+          backend:
+            services:
+              - url: http://argocd-extension-backend-api.glueops-core-argocd-extension-backend.svc.cluster.local:8000
   rbac:
     # -- A good reference for this is: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/
     # This default policy is for GlueOps orgs/teams only. Please change it to reflect your own orgs/teams.
     # `development` is the project that all developers are expected to deploy under
     # @default -- `''` (See [values.yaml])
+    # Extensions are denied unless a policy allows them. Only Argo CD built-in
+    # roles are referenced: custom roles come from each tenant's own
+    # argocd_rbac_policies, so naming one here would dangle on other clusters.
     policy.csv: |
       placeholder_argocd_rbac_policies
+      p, role:readonly, extensions, invoke, otel-extension, allow
+      p, role:admin, extensions, invoke, otel-extension, allow
   # @ignored
 server:
+  extensions:
+    enabled: true
+    # Pinned to the gpkg mirror: the chart defaults this installer image to
+    # quay.io, and a pull failure blocks argocd-server from starting at all.
+    image:
+      repository: quay.repo.gpkg.io/argoprojlabs/argocd-extension-installer
+    extensionList:
+      - name: otel-extension
+        env:
+          - name: EXTENSION_URL
+            value: "https://github.com/GlueOps/argo-cd-ui-extention/releases/download/placeholder_otel_extension_version/extension.tar.gz"
   # @ignored
   metrics:
     enabled: true
diff --git a/main.tf b/main.tf
index 2dbf4d7..cf3eb73 100644
--- a/main.tf
+++ b/main.tf
@@ -1,10 +1,12 @@
 terraform {
+  required_version = ">= 1.2.0"
+
   required_providers {
     http = {
-      source  = "hashicorp/http"
+      source = "hashicorp/http"
     }
     local = {
-      source  = "hashicorp/local"
+      source = "hashicorp/local"
     }
   }
 }
@@ -56,18 +58,49 @@ variable "gatekeeper_tag" {
   description = "Image tag (SHA or semver) for ghcr.repo.gpkg.io/glueops/gatekeeper.platform.glueops.dev"
 }
 
+# The OTEL extension frontend is always on, for every cluster -- there is no
+# enable/disable switch. That is safe because the frontend renders NOTHING when it
+# has no links to show (see StatusPanel in GlueOps/argo-cd-ui-extention): a cluster
+# whose backend is not up yet shows no panel at all, rather than an error box.
+#
+# Scope: this module configures the FRONTEND only. The backend (Deployment/Service
+# argocd-extension-backend-api) is owned by platform-helm-chart-platform, which
+# deploys it as an Argo CD Application into glueops-core-argocd-extension-backend.
+# This module must never deploy a second copy of it.
+variable "otel_extension_version" {
+  type        = string
+  description = "GitHub release tag for the ArgoCD OTEL extension tarball."
+  default     = "v0.1.5"
+
+  validation {
+    condition     = trimspace(var.otel_extension_version) != ""
+    error_message = "otel_extension_version must be non-empty"
+  }
+
+  validation {
+    condition     = length(regexall("\\s", trimspace(var.otel_extension_version))) == 0
+    error_message = "otel_extension_version must not contain whitespace"
+  }
+}
+
+locals {
+  otel_extension_version_trimmed = trimspace(var.otel_extension_version)
+}
+
 
 output "helm_values" {
   value = replace(replace(replace(replace(replace(
     replace(
       replace(
-        data.local_file.argocd_template.content,
-      "placeholder_tenant_key", var.tenant_key),
+        replace(
+          data.local_file.argocd_template.content,
+        "placeholder_tenant_key", var.tenant_key),
       "placeholder_cluster_environment", var.cluster_environment),
-      "placeholder_argocd_oidc_client_secret_from_dex", var.client_secret),
-      "placeholder_glueops_root_domain", var.glueops_root_domain),
-      "      placeholder_argocd_rbac_policies", var.argocd_rbac_policies),
-      "placeholder_argocd_app_version", var.argocd_app_version),
-    "placeholder_gatekeeper_tag", var.gatekeeper_tag
+    "placeholder_argocd_oidc_client_secret_from_dex", var.client_secret),
+    "placeholder_glueops_root_domain", var.glueops_root_domain),
+    "      placeholder_argocd_rbac_policies", var.argocd_rbac_policies),
+    "placeholder_argocd_app_version", var.argocd_app_version),
+    "placeholder_gatekeeper_tag", var.gatekeeper_tag),
+    "placeholder_otel_extension_version", local.otel_extension_version_trimmed
   )
 }