diff --git a/helm/testnet-wallet/README.md b/helm/testnet-wallet/README.md
index 06e8eb1a6..5ee0e8635 100644
--- a/helm/testnet-wallet/README.md
+++ b/helm/testnet-wallet/README.md
@@ -2,7 +2,9 @@
 
 Deploys the Interledger TestNet Wallet application to Kubernetes. The chart manages two workloads:
 
-- **backend** — NestJS API (`test-wallet-backend` image, port `4003`)
+- **backend** — NestJS API (`test-wallet-backend` image, HTTP port `4003`),
+  optionally hosting the issuer and merchant HSM adapters on ports `50051` and
+  `50052`
 - **frontend** — Next.js UI (`test-wallet-frontend` image, port `4003`)
 
 ## Dependencies
@@ -75,6 +77,63 @@ Defined under `secretsMaps.backend.contentMap`. Secrets are only created by the
 
 Secrets are mounted into the backend container via individual `env[].valueFrom.secretKeyRef` entries (not `envFrom`).
 
+### Atalla HSM adapters
+
+The backend can serve the issuer and the merchant HSM adapter contracts over
+gRPC. One process runs both servers. `serverRole` chooses which servers start:
+`both`, `issuer`, or `merchant`.
+
+The adapters are off by default. Only the cards environments run them, so a
+deployment without an HSM starts without any Atalla configuration.
+
+`templates/configMap.backend.yaml` adds the `HSM_*` and `ATALLA_*` keys to the
+backend ConfigMap, and only when `enabled` is true. They are not
+`configMaps.backend.contentMap` entries: the backend rejects an empty
+`ATALLA_HOST` or `ATALLA_PORT` when `HSM_ENABLED` is true, and a contentMap
+entry would write an empty string in every environment that leaves the value
+unset. The render fails if `enabled` is true and either value is missing.
+
+```yaml
+config:
+  backend:
+    hsm:
+      enabled: true
+      serverRole: both
+      grpcHost: '0.0.0.0'
+      issuerPort: 50051
+      merchantPort: 50052
+
+      atalla:
+        host: 10.0.0.1
+        port: 13506
+        timeoutMs: 2000
+        poolSize: 1
+        tls:
+          enabled: true
+          # Skips the hostname check only. The transport still sets
+          # rejectUnauthorized, so the HSM certificate must chain to the CA at
+          # caCertPath.
+          skipServerIdentityCheck: true
+          # Paths, not PEM text. The backend reads each file at start-up.
+          caCertPath: /etc/atalla/tls/ca.crt
+          clientCertPath: /etc/atalla/tls/client.crt
+          clientKeyPath: /etc/atalla/tls/client.key
+```
+
+The issuer and merchant listeners are cleartext h2c services. Reach them inside
+the namespace only, and keep the gRPC ports off the Ingress.
+
+`enabled: true` is not enough on its own. Helm replaces a list rather than
+merging it, so the environment's values file must also write out, in full:
+
+- `deployments.backend.ports`, with the gRPC container ports added
+- `services.backend.ports`, with the matching Service ports added
+- `deployments.backend.volumes` and `deployments.backend.volumeMounts`, for the
+  Atalla TLS files at the paths above
+
+`env/cards-playground/wallet/testnet-wallet.yaml` in `testnet-deploy` is the
+worked example.
+
 ## Image Tags
 
 By default both deployments use the chart's `appVersion` as the image tag. To pin a specific tag for one image: