diff --git a/.checkov.yaml b/.checkov.yaml
index 51b974eb..8a8c8b89 100644
--- a/.checkov.yaml
+++ b/.checkov.yaml
@@ -2,4 +2,11 @@
 # Cloud Run false-positives (CKV_K8S_21/28/30) are suppressed via per-file
 # inline checkov:skip comments in deploy/gcp/cloudrun-service.yaml rather than
 # globally here, so future real Kubernetes manifests are not silently exempted.
+#
+# The knowledge-explorer Helm chart's unconditional templates (service.yaml,
+# deployment.yaml, configmap.yaml) set metadata.namespace to .Release.Namespace,
+# which is only bound at `helm install`/`helm template` time. Checkov's helm
+# framework renders the chart without a namespace override, so it always
+# resolves to "default" and trips CKV_K8S_21 even though the chart is
+# namespace-agnostic by design. Suppressed the same way, per-file.
 skip-check: []
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4ddeea8..938e1e14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Checkov flagged the knowledge-explorer Helm chart for using the default Kubernetes namespace** ([code scanning alert #779](https://github.com/semantica-agi/semantica/security/code-scanning/779), [#778](https://github.com/semantica-agi/semantica/security/code-scanning/778), [#777](https://github.com/semantica-agi/semantica/security/code-scanning/777), `CKV_K8S_21`) by @KaifAhmad1
+  - `templates/service.yaml`, `templates/deployment.yaml`, and `templates/configmap.yaml` all already set `metadata.namespace` to `{{ .Release.Namespace }}`, which is only bound at `helm install`/`helm template` time; Checkov's helm framework renders the chart without a namespace override, so it always resolves to `default` and trips `CKV_K8S_21` even though the chart is namespace-agnostic by design
+  - Added a `# checkov:skip=CKV_K8S_21` comment to each of the three files, following the same per-file suppression convention already used for the Cloud Run false positives in `deploy/gcp/cloudrun-service.yaml`, and documented the reasoning in `.checkov.yaml`
+
 - **No React error boundaries around lazy-loaded Explorer workspaces — a single render error crashed the whole app** (#768, #794) by @Sameer6305
   - Added an `ErrorBoundary` class component (`explorer/src/ErrorBoundary.tsx`) and wrapped each lazy-loaded workspace's `<Suspense>` block in `App.tsx` with it, keyed on the active sub-view so navigating away from and back to a crashed tab remounts it cleanly
   - Failed retries are capped at 3 before the fallback UI switches from "Try Again" to a "Reload Application" dead-end, preventing infinite retry loops on deterministic crashes; raw error/stack details are logged via `console.error` only and never rendered into the fallback UI
diff --git a/deploy/helm/knowledge-explorer/templates/configmap.yaml b/deploy/helm/knowledge-explorer/templates/configmap.yaml
index 753ed65f..2b53173f 100644
--- a/deploy/helm/knowledge-explorer/templates/configmap.yaml
+++ b/deploy/helm/knowledge-explorer/templates/configmap.yaml
@@ -1,3 +1,4 @@
+# checkov:skip=CKV_K8S_21:namespace is set to .Release.Namespace below, supplied at install time via `helm install -n <namespace>`; Checkov's helm-chart renderer runs without a namespace override and always resolves this to "default", which is a scanner artifact, not the deployed value
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/deploy/helm/knowledge-explorer/templates/deployment.yaml b/deploy/helm/knowledge-explorer/templates/deployment.yaml
index 09acc837..f14bbefa 100644
--- a/deploy/helm/knowledge-explorer/templates/deployment.yaml
+++ b/deploy/helm/knowledge-explorer/templates/deployment.yaml
@@ -1,3 +1,4 @@
+# checkov:skip=CKV_K8S_21:namespace is set to .Release.Namespace below, supplied at install time via `helm install -n <namespace>`; Checkov's helm-chart renderer runs without a namespace override and always resolves this to "default", which is a scanner artifact, not the deployed value
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/deploy/helm/knowledge-explorer/templates/service.yaml b/deploy/helm/knowledge-explorer/templates/service.yaml
index d165c9f3..bee01cd4 100644
--- a/deploy/helm/knowledge-explorer/templates/service.yaml
+++ b/deploy/helm/knowledge-explorer/templates/service.yaml
@@ -1,3 +1,4 @@
+# checkov:skip=CKV_K8S_21:namespace is set to .Release.Namespace below, supplied at install time via `helm install -n <namespace>`; Checkov's helm-chart renderer runs without a namespace override and always resolves this to "default", which is a scanner artifact, not the deployed value
 apiVersion: v1
 kind: Service
 metadata: