diff --git a/charts/diode/Chart.lock b/charts/diode/Chart.lock
index 193373dd..222db41a 100644
--- a/charts/diode/Chart.lock
+++ b/charts/diode/Chart.lock
@@ -17,5 +17,5 @@ dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
   version: v1.12.0
-digest: sha256:61907df8f8ab4bd2fd67195670bb6f920392f6af0655f22dce06a68fd381a1ba
-generated: "2025-05-30T12:44:47.769834-04:00"
+digest: sha256:2856fe78498db6124a167e5716405777af9b72b2995b0e0cb3a92e23fca8996e
+generated: "2025-08-25T12:49:19.940917-04:00"
diff --git a/charts/diode/Chart.yaml b/charts/diode/Chart.yaml
index 97a0207d..238a357c 100644
--- a/charts/diode/Chart.yaml
+++ b/charts/diode/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: diode
 description: A Helm chart for Diode
 type: application
-version: 1.6.2
+version: 1.7.0
 appVersion: "1.5.0"
 home: https://github.com/netboxlabs/diode
 sources:
@@ -34,7 +34,7 @@ dependencies:
   - name: ingress-nginx
     version: 4.12.1
     repository: https://kubernetes.github.io/ingress-nginx
-    condition: ingressNginx.enabled
+    condition: ingressNginx.controller.enabled
   - name: cert-manager
     version: v1.12.0
     repository: https://charts.jetstack.io
diff --git a/charts/diode/README.md b/charts/diode/README.md
index d37eead1..ea658cc7 100644
--- a/charts/diode/README.md
+++ b/charts/diode/README.md
@@ -2,7 +2,7 @@
 
 A Helm chart for Diode
 
-![Version: 1.6.2](https://img.shields.io/badge/Version-1.6.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
+![Version: 1.7.0](https://img.shields.io/badge/Version-1.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
 
 ## Prerequisites
 
@@ -339,9 +339,10 @@ helm show values diode/diode
 | hydra.job.extraInitContainers | string or list | `"{{ include \"diode.hydra.extrainitcontainers\" . }}"` | extra init containers |
 | hydra.secret.enabled | bool | `false` | secret enabled |
 | hydra.secret.nameOverride | string | `"diode-hydra-secret"` | existing secret name |
-| ingressNginx | object | `{"annotations":{},"controller":{"allowSnippetAnnotations":true},"enabled":true,"extraHttpPaths":[],"grpcAnnotations":{"nginx.ingress.kubernetes.io/proxy-body-size":"25m","nginx.ingress.kubernetes.io/ssl-redirect":"true"},"hostname":"","httpAnnotations":{"nginx.ingress.kubernetes.io/ssl-redirect":"true"},"ingressClass":"nginx","pathPrefix":"/diode","tls":{}}` | ref: https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/values.yaml |
-| ingressNginx.controller | object | `{"allowSnippetAnnotations":true}` | ingress annotations |
+| ingressNginx | object | `{"annotations":{},"controller":{"allowSnippetAnnotations":true,"enabled":true},"enabled":true,"extraHttpPaths":[],"grpcAnnotations":{"nginx.ingress.kubernetes.io/proxy-body-size":"25m","nginx.ingress.kubernetes.io/ssl-redirect":"true"},"hostname":"","httpAnnotations":{"nginx.ingress.kubernetes.io/ssl-redirect":"true"},"ingressClass":"nginx","pathPrefix":"/diode","tls":{}}` | ref: https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/values.yaml |
+| ingressNginx.controller | object | `{"allowSnippetAnnotations":true,"enabled":true}` | ingress annotations |
 | ingressNginx.controller.allowSnippetAnnotations | bool | `true` | allow snippet annotations |
+| ingressNginx.controller.enabled | bool | `true` | deploy an ingress-nginx controller chart in addition to `Ingress` resources |
 | ingressNginx.enabled | bool | `true` | ingress-nginx enabled |
 | ingressNginx.extraHttpPaths | list | `[]` | ingress extra http paths |
 | ingressNginx.grpcAnnotations | object | `{"nginx.ingress.kubernetes.io/proxy-body-size":"25m","nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | ingress grpc annotations |
diff --git a/charts/diode/values.yaml b/charts/diode/values.yaml
index 1ea5ce05..92af7839 100644
--- a/charts/diode/values.yaml
+++ b/charts/diode/values.yaml
@@ -401,6 +401,8 @@ ingressNginx:
   ingressClass: nginx
   # -- ingress annotations
   controller:
+    # -- deploy an ingress-nginx controller chart in addition to `Ingress` resources
+    enabled: true
     # -- allow snippet annotations
     allowSnippetAnnotations: true
   annotations: {}
diff --git a/diode-server/auth/server.go b/diode-server/auth/server.go
index cdb5d49f..e4c1a059 100644
--- a/diode-server/auth/server.go
+++ b/diode-server/auth/server.go
@@ -119,14 +119,14 @@ type ClientInfoDecorator interface {
 }
 
 // NewServer creates a new auth server
-func NewServer(_ context.Context, logger *slog.Logger, tokenParser TokenParser, clientManager ClientManager, tokenOwnership TokenOwnershipProvider) (*Server, error) {
+func NewServer(ctx context.Context, logger *slog.Logger, tokenParser TokenParser, clientManager ClientManager, tokenOwnership TokenOwnershipProvider) (*Server, error) {
 	var cfg Config
 	envconfig.MustProcess("", &cfg)
 
 	mux := http.NewServeMux()
 
 	jwkSetURL := cfg.OAuth2.PublicServerURL + "/.well-known/jwks.json"
-	k, err := keyfunc.NewDefault([]string{jwkSetURL})
+	k, err := keyfunc.NewDefaultCtx(ctx, []string{jwkSetURL})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create keyfunc: %w", err)
 	}
diff --git a/diode-server/auth/server_hydra_integration_test.go b/diode-server/auth/server_hydra_integration_test.go
index 01c61b56..038646bf 100644
--- a/diode-server/auth/server_hydra_integration_test.go
+++ b/diode-server/auth/server_hydra_integration_test.go
@@ -19,14 +19,15 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/require"
-	testcontainers "github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/wait"
 
 	"github.com/netboxlabs/diode/diode-server/auth"
 )
 
 func TestServerHydraIntegration(t *testing.T) {
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	creq := testcontainers.ContainerRequest{
 		Image:        "oryd/hydra:v2.3.0",
diff --git a/diode-server/auth/server_test.go b/diode-server/auth/server_test.go
index 0d4b9676..08ce1755 100644
--- a/diode-server/auth/server_test.go
+++ b/diode-server/auth/server_test.go
@@ -54,7 +54,8 @@ func (o ownerInvalid) ValidateTokenOwnership(_ auth.TokenOwnershipValidationData
 }
 
 func TestNewServer(t *testing.T) {
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	setupEnv()
 	defer teardownEnv()
@@ -76,7 +77,8 @@ func TestNewServer(t *testing.T) {
 }
 
 func TestIntrospectForInvalidTokens(t *testing.T) {
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	setupEnv()
 	defer teardownEnv()
@@ -279,7 +281,8 @@ func TestIntrospectForValidTokens(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			ctx := context.Background()
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
 
 			var ownerProvider auth.TokenOwnershipProvider = &auth.DefaultTokenOwner{}
 			if test.invalidOwner {
@@ -424,7 +427,8 @@ func TestCreateClient(t *testing.T) {
 		},
 	}
 
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	setupEnv()
 	defer teardownEnv()
 
@@ -614,7 +618,8 @@ func TestListClients(t *testing.T) {
 		},
 	}
 
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	setupEnv()
 	defer teardownEnv()
 
@@ -769,7 +774,8 @@ func TestDeleteClient(t *testing.T) {
 		},
 	}
 
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	setupEnv()
 	defer teardownEnv()
 
@@ -905,7 +911,8 @@ func TestGetClient(t *testing.T) {
 		},
 	}
 
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	setupEnv()
 	defer teardownEnv()
 
diff --git a/diode-server/cmd/auth/main.go b/diode-server/cmd/auth/main.go
index 8feb2e3c..5935ced3 100644
--- a/diode-server/cmd/auth/main.go
+++ b/diode-server/cmd/auth/main.go
@@ -23,7 +23,8 @@ const (
 )
 
 func main() {
-	ctx := context.Background()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	s := server.New(ctx, applicationName, version.Release())
 
 	defer s.Recover(sentry.CurrentHub())
diff --git a/diode-server/ingester/component.go b/diode-server/ingester/component.go
index a5a41e9d..1e7adf65 100644
--- a/diode-server/ingester/component.go
+++ b/diode-server/ingester/component.go
@@ -12,7 +12,9 @@ import (
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"go.opentelemetry.io/otel/attribute"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/reflection"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 
 	"github.com/netboxlabs/diode/diode-server/gen/diode/v1/diodepb"
@@ -166,18 +168,20 @@ func (c *Component) Ingest(ctx context.Context, in *diodepb.IngestRequest) (*dio
 	}
 	ctx = telemetry.ContextWithMetricAttributes(ctx, attrs...)
 
-	if err := c.redisStreamClient.XAdd(ctx, &redis.XAddArgs{
+	err = c.redisStreamClient.XAdd(ctx, &redis.XAddArgs{
 		Stream: streamID,
 		Values: msg,
-	}).Err(); err != nil {
+	}).Err()
+	if err != nil {
 		c.metrics.RecordIngestRequest(ctx, false)
 		c.logger.Error("failed to add element to the stream", "error", err, "streamID", streamID, "value", msg)
-	} else {
-		entityCount := int64(len(in.GetEntities()))
-		c.metrics.RecordIngestRequest(ctx, true)
-		c.metrics.RecordIngestEntities(ctx, entityCount)
+		return nil, status.Error(codes.Internal, "")
 	}
 
+	entityCount := int64(len(in.GetEntities()))
+	c.metrics.RecordIngestRequest(ctx, true)
+	c.metrics.RecordIngestEntities(ctx, entityCount)
+
 	return &diodepb.IngestResponse{Errors: errs}, nil
 }