diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b90f48aa..ffa45d8e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 ## Unreleased
 
 CHANGES:
+* `global.enabled` now works as documented, that is, setting `global.enabled` to false will disable everything, with individual components able to be turned on individually [GH-703](https://github.com/hashicorp/vault-helm/pull/703)
+* Default value of `-` used for injector and server to indicate that they follow `global.enabled`. [GH-703](https://github.com/hashicorp/vault-helm/pull/703)
 * Vault default image to 1.9.3
 * CSI provider default image to 1.0.0
 
diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index 945269897..144008e1e 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -31,6 +31,50 @@ Expand the name of the chart.
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/*
+Compute if the csi driver is enabled.
+*/}}
+{{- define "vault.csiEnabled" -}}
+{{- $_ := set . "csiEnabled" (or
+  (eq (.Values.csi.enabled | toString) "true")
+  (and (eq (.Values.csi.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the injector is enabled.
+*/}}
+{{- define "vault.injectorEnabled" -}}
+{{- $_ := set . "injectorEnabled" (or
+  (eq (.Values.injector.enabled | toString) "true")
+  (and (eq (.Values.injector.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server is enabled.
+*/}}
+{{- define "vault.serverEnabled" -}}
+{{- $_ := set . "serverEnabled" (or
+  (eq (.Values.server.enabled | toString) "true")
+  (and (eq (.Values.server.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server service is enabled.
+*/}}
+{{- define "vault.serverServiceEnabled" -}}
+{{- template "vault.serverEnabled" . -}}
+{{- $_ := set . "serverServiceEnabled" (and .serverEnabled (eq (.Values.server.service.enabled | toString) "true")) -}}
+{{- end -}}
+
+{{/*
+Compute if the ui is enabled.
+*/}}
+{{- define "vault.uiEnabled" -}}
+{{- $_ := set . "uiEnabled" (or
+  (eq (.Values.ui.enabled | toString) "true")
+  (and (eq (.Values.ui.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
 {{/*
 Compute the maximum number of unavailable replicas for the PodDisruptionBudget.
 This defaults to (n/2)-1 where n is the number of members of the server cluster.
@@ -51,9 +95,10 @@ Set the variable 'mode' to the server mode requested by the user to simplify
 template logic.
 */}}
 {{- define "vault.mode" -}}
+  {{- template "vault.serverEnabled" . -}}
   {{- if .Values.injector.externalVaultAddr -}}
     {{- $_ := set . "mode" "external" -}}
-  {{- else if ne (.Values.server.enabled | toString) "true" -}}
+  {{- else if not .serverEnabled -}}
     {{- $_ := set . "mode" "external" -}}
   {{- else if eq (.Values.server.dev.enabled | toString) "true" -}}
     {{- $_ := set . "mode" "dev" -}}
diff --git a/templates/csi-clusterrole.yaml b/templates/csi-clusterrole.yaml
index a19e520f5..ec6a3d2b9 100644
--- a/templates/csi-clusterrole.yaml
+++ b/templates/csi-clusterrole.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.csi.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
diff --git a/templates/csi-clusterrolebinding.yaml b/templates/csi-clusterrolebinding.yaml
index 63d69c7b1..d5b62a5f0 100644
--- a/templates/csi-clusterrolebinding.yaml
+++ b/templates/csi-clusterrolebinding.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.csi.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
diff --git a/templates/csi-daemonset.yaml b/templates/csi-daemonset.yaml
index 430889061..5c21752d6 100644
--- a/templates/csi-daemonset.yaml
+++ b/templates/csi-daemonset.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.csi.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
diff --git a/templates/csi-serviceaccount.yaml b/templates/csi-serviceaccount.yaml
index eb9a78404..8d6fa5329 100644
--- a/templates/csi-serviceaccount.yaml
+++ b/templates/csi-serviceaccount.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.csi.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
diff --git a/templates/injector-certs-secret.yaml b/templates/injector-certs-secret.yaml
index e0d96b2fd..e88685b5e 100644
--- a/templates/injector-certs-secret.yaml
+++ b/templates/injector-certs-secret.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -9,3 +11,4 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/injector-clusterrole.yaml b/templates/injector-clusterrole.yaml
index 4ff25abe5..6a0d6be1a 100644
--- a/templates/injector-clusterrole.yaml
+++ b/templates/injector-clusterrole.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -10,7 +11,7 @@ metadata:
 rules:
 - apiGroups: ["admissionregistration.k8s.io"]
   resources: ["mutatingwebhookconfigurations"]
-  verbs: 
+  verbs:
     - "get"
     - "list"
     - "watch"
diff --git a/templates/injector-clusterrolebinding.yaml b/templates/injector-clusterrolebinding.yaml
index 35d30b393..4c193f8a2 100644
--- a/templates/injector-clusterrolebinding.yaml
+++ b/templates/injector-clusterrolebinding.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
diff --git a/templates/injector-deployment.yaml b/templates/injector-deployment.yaml
index 95e2c2da8..9a50c7db9 100644
--- a/templates/injector-deployment.yaml
+++ b/templates/injector-deployment.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
 # Deployment for the injector
 apiVersion: apps/v1
 kind: Deployment
diff --git a/templates/injector-mutating-webhook.yaml b/templates/injector-mutating-webhook.yaml
index b0a6ac07b..f873f61c9 100644
--- a/templates/injector-mutating-webhook.yaml
+++ b/templates/injector-mutating-webhook.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
 {{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1" }}
 apiVersion: admissionregistration.k8s.io/v1
 {{- else }}
diff --git a/templates/injector-network-policy.yaml b/templates/injector-network-policy.yaml
index 7a399a538..68892d23b 100644
--- a/templates/injector-network-policy.yaml
+++ b/templates/injector-network-policy.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.openshift | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.openshift | toString) "true" }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -19,3 +21,4 @@ spec:
       - port: 8080
         protocol: TCP
 {{ end }}
+{{ end }}
diff --git a/templates/injector-psp-role.yaml b/templates/injector-psp-role.yaml
index 20c87bb2a..5d23c7556 100644
--- a/templates/injector-psp-role.yaml
+++ b/templates/injector-psp-role.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.psp.enable | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -15,3 +17,4 @@ rules:
   resourceNames:
     - {{ template "vault.fullname" . }}-agent-injector
 {{- end }}
+{{- end }}
diff --git a/templates/injector-psp-rolebinding.yaml b/templates/injector-psp-rolebinding.yaml
index d6d0d5e24..4f6b0a851 100644
--- a/templates/injector-psp-rolebinding.yaml
+++ b/templates/injector-psp-rolebinding.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.psp.enable | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -16,3 +18,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ template "vault.fullname" . }}-agent-injector
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/injector-psp.yaml b/templates/injector-psp.yaml
index c024ac107..1eee2fcd0 100644
--- a/templates/injector-psp.yaml
+++ b/templates/injector-psp.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.psp.enable | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
@@ -41,3 +43,4 @@ spec:
         max: 65535
   readOnlyRootFilesystem: false
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/injector-role.yaml b/templates/injector-role.yaml
index c8ecfddd0..08c8264cc 100644
--- a/templates/injector-role.yaml
+++ b/templates/injector-role.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -24,3 +26,4 @@ rules:
       - "patch"
       - "delete"
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/injector-rolebinding.yaml b/templates/injector-rolebinding.yaml
index 401873fb8..ea0db11b9 100644
--- a/templates/injector-rolebinding.yaml
+++ b/templates/injector-rolebinding.yaml
@@ -1,4 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -17,3 +19,4 @@ subjects:
     name: {{ template "vault.fullname" . }}-agent-injector
     namespace: {{ .Release.Namespace }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/injector-service.yaml b/templates/injector-service.yaml
index 3138b7a5b..5e747d6f1 100644
--- a/templates/injector-service.yaml
+++ b/templates/injector-service.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/templates/injector-serviceaccount.yaml b/templates/injector-serviceaccount.yaml
index a28d38fab..ebc57b56f 100644
--- a/templates/injector-serviceaccount.yaml
+++ b/templates/injector-serviceaccount.yaml
@@ -1,4 +1,5 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
diff --git a/templates/server-clusterrolebinding.yaml b/templates/server-clusterrolebinding.yaml
index e5e0f5fec..2db23a519 100644
--- a/templates/server-clusterrolebinding.yaml
+++ b/templates/server-clusterrolebinding.yaml
@@ -1,5 +1,7 @@
 {{ template "vault.mode" . }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") (eq (.Values.server.authDelegator.enabled | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.server.authDelegator.enabled | toString) "true") }}
 {{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- else }}
@@ -22,3 +24,4 @@ subjects:
   name: {{ template "vault.serviceAccount.name" . }}
   namespace: {{ .Release.Namespace }}
 {{ end }}
+{{ end }}
diff --git a/templates/server-config-configmap.yaml b/templates/server-config-configmap.yaml
index b8093ad03..969dcf38e 100644
--- a/templates/server-config-configmap.yaml
+++ b/templates/server-config-configmap.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq (.Values.global.enabled | toString) "true") (ne .mode "dev") -}}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if ne .mode "dev" -}}
 {{ if or (.Values.server.standalone.config) (.Values.server.ha.config) -}}
 apiVersion: v1
 kind: ConfigMap
@@ -36,3 +38,4 @@ data:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-discovery-role.yaml b/templates/server-discovery-role.yaml
index 4a39cec21..3e8544c77 100644
--- a/templates/server-discovery-role.yaml
+++ b/templates/server-discovery-role.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq .mode "ha" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -17,3 +19,4 @@ rules:
   verbs: ["get", "watch", "list", "update", "patch"]
 {{ end }}
 {{ end }}
+{{ end }}
\ No newline at end of file
diff --git a/templates/server-discovery-rolebinding.yaml b/templates/server-discovery-rolebinding.yaml
index 47526650b..8ceb48274 100644
--- a/templates/server-discovery-rolebinding.yaml
+++ b/templates/server-discovery-rolebinding.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq .mode "ha" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
 {{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- else }}
@@ -25,3 +27,4 @@ subjects:
   namespace: {{ .Release.Namespace }}
 {{ end }}
 {{ end }}
+{{ end }}
\ No newline at end of file
diff --git a/templates/server-disruptionbudget.yaml b/templates/server-disruptionbudget.yaml
index 3c45cc04e..60fc8446b 100644
--- a/templates/server-disruptionbudget.yaml
+++ b/templates/server-disruptionbudget.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" -}}
-{{- if and (eq (.Values.global.enabled | toString) "true") (eq .mode "ha") (eq (.Values.server.ha.disruptionBudget.enabled | toString) "true") -}}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if and (eq .mode "ha") (eq (.Values.server.ha.disruptionBudget.enabled | toString) "true") -}}
 # PodDisruptionBudget to prevent degrading the server cluster through
 # voluntary cluster changes.
 apiVersion: policy/v1beta1
@@ -22,3 +24,4 @@ spec:
       component: server
 {{- end -}}
 {{- end -}}
+{{- end -}}
\ No newline at end of file
diff --git a/templates/server-ha-active-service.yaml b/templates/server-ha-active-service.yaml
index 88ad80608..525fc8c9c 100644
--- a/templates/server-ha-active-service.yaml
+++ b/templates/server-ha-active-service.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq .mode "ha" ) (eq (.Values.server.service.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
 # Service for active Vault pod
 apiVersion: v1
 kind: Service
@@ -40,3 +42,4 @@ spec:
     vault-active: "true"
 {{- end }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-ha-standby-service.yaml b/templates/server-ha-standby-service.yaml
index 014d6b58b..03260ffaf 100644
--- a/templates/server-ha-standby-service.yaml
+++ b/templates/server-ha-standby-service.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq .mode "ha" ) (eq (.Values.server.service.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
 # Service for standby Vault pod
 apiVersion: v1
 kind: Service
@@ -40,3 +42,4 @@ spec:
     vault-active: "false"
 {{- end }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-headless-service.yaml b/templates/server-headless-service.yaml
index 7e564c041..fffaaacbb 100644
--- a/templates/server-headless-service.yaml
+++ b/templates/server-headless-service.yaml
@@ -1,6 +1,7 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq (.Values.server.service.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
 # Service for Vault cluster
 apiVersion: v1
 kind: Service
diff --git a/templates/server-ingress.yaml b/templates/server-ingress.yaml
index 48c76a828..c81e5f5ce 100644
--- a/templates/server-ingress.yaml
+++ b/templates/server-ingress.yaml
@@ -4,7 +4,9 @@
 {{- if .Values.server.ingress.enabled -}}
 {{- $extraPaths := .Values.server.ingress.extraPaths -}}
 {{- $serviceName := include "vault.fullname" . -}}
-{{- if and (eq .mode "ha" ) (eq (.Values.server.service.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.server.ingress.activeService | toString) "true") }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.ingress.activeService | toString) "true") }}
 {{- $serviceName = printf "%s-%s" $serviceName "active" -}}
 {{- end }}
 {{- $servicePort := .Values.server.service.port -}}
@@ -72,3 +74,4 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-psp-role.yaml b/templates/server-psp-role.yaml
index fd12e1eb3..608624b5b 100644
--- a/templates/server-psp-role.yaml
+++ b/templates/server-psp-role.yaml
@@ -1,5 +1,7 @@
 {{ template "vault.mode" . }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.psp.enable | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -16,3 +18,4 @@ rules:
   resourceNames:
     - {{ template "vault.fullname" . }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-psp-rolebinding.yaml b/templates/server-psp-rolebinding.yaml
index b2a43c834..f6255ebdf 100644
--- a/templates/server-psp-rolebinding.yaml
+++ b/templates/server-psp-rolebinding.yaml
@@ -1,5 +1,7 @@
 {{ template "vault.mode" . }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.psp.enable | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -17,3 +19,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ template "vault.fullname" . }}
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-psp.yaml b/templates/server-psp.yaml
index 2d9426819..cca688373 100644
--- a/templates/server-psp.yaml
+++ b/templates/server-psp.yaml
@@ -1,5 +1,7 @@
 {{ template "vault.mode" . }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") (eq (.Values.global.psp.enable | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
@@ -45,3 +47,4 @@ spec:
         max: 65535
   readOnlyRootFilesystem: false
 {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/server-service.yaml b/templates/server-service.yaml
index b1dc3c34e..3a9b0e7e5 100644
--- a/templates/server-service.yaml
+++ b/templates/server-service.yaml
@@ -1,6 +1,7 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (eq (.Values.server.service.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
 # Service for Vault cluster
 apiVersion: v1
 kind: Service
diff --git a/templates/server-serviceaccount.yaml b/templates/server-serviceaccount.yaml
index 925b166bb..4ff73a687 100644
--- a/templates/server-serviceaccount.yaml
+++ b/templates/server-serviceaccount.yaml
@@ -1,5 +1,6 @@
 {{ template "vault.mode" . }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
 {{- if (eq (.Values.server.serviceAccount.create | toString) "true" ) }}
 apiVersion: v1
 kind: ServiceAccount
diff --git a/templates/server-statefulset.yaml b/templates/server-statefulset.yaml
index cbcda967d..7deea5ed6 100644
--- a/templates/server-statefulset.yaml
+++ b/templates/server-statefulset.yaml
@@ -1,6 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") }}
+{{- if ne .mode "" }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
 # StatefulSet to run the actual vault server cluster.
 apiVersion: apps/v1
 kind: StatefulSet
@@ -206,3 +208,4 @@ spec:
   {{ template "vault.volumeclaims" . }}
 {{ end }}
 {{ end }}
+{{ end }}
\ No newline at end of file
diff --git a/templates/tests/server-test.yaml b/templates/tests/server-test.yaml
index d983b9df6..ef1aae848 100644
--- a/templates/tests/server-test.yaml
+++ b/templates/tests/server-test.yaml
@@ -1,6 +1,7 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") }}
+{{- template "vault.serverEnabled" . -}}
+{{- if .serverEnabled -}}
 apiVersion: v1
 kind: Pod
 metadata:
diff --git a/templates/ui-service.yaml b/templates/ui-service.yaml
index ea27de282..d45afdda4 100644
--- a/templates/ui-service.yaml
+++ b/templates/ui-service.yaml
@@ -1,7 +1,8 @@
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
-{{- if and (ne .mode "") (eq (.Values.global.enabled | toString) "true") }}
-{{- if eq (.Values.ui.enabled | toString) "true" }}
+{{- template "vault.uiEnabled" . -}}
+{{- if .uiEnabled -}}
+
 apiVersion: v1
 kind: Service
 metadata:
@@ -34,4 +35,3 @@ spec:
   {{- include "service.loadBalancer" .Values.ui }}
 {{- end -}}
 {{- end }}
-{{- end }}
diff --git a/test/unit/csi-daemonset.bats b/test/unit/csi-daemonset.bats
index 61ef1ef74..23b43cc1f 100644
--- a/test/unit/csi-daemonset.bats
+++ b/test/unit/csi-daemonset.bats
@@ -27,7 +27,7 @@ load _helpers
       --set "global.enabled=false" \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
-  [ "${actual}" = "false" ]
+  [ "${actual}" = "true" ]
 }
 
 # priorityClassName
diff --git a/test/unit/injector-deployment.bats b/test/unit/injector-deployment.bats
index 93f8a0f81..bfbd3eb5e 100755
--- a/test/unit/injector-deployment.bats
+++ b/test/unit/injector-deployment.bats
@@ -26,12 +26,22 @@ load _helpers
   local actual=$( (helm template \
       --show-only templates/injector-deployment.yaml  \
       --set 'global.enabled=false' \
-      --set 'injector.enabled=true' \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
   [ "${actual}" = "false" ]
 }
 
+@test "injector/deployment: enable with injector.enabled true and global.enabled false" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/injector-deployment.yaml  \
+      --set 'injector.enabled=true' \
+      --set 'global.enabled=false' \
+      . | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
 @test "injector/deployment: image defaults to injector.image" {
   cd `chart_dir`
   local actual=$(helm template \
diff --git a/test/unit/injector-psp-role.bats b/test/unit/injector-psp-role.bats
index c6dc522af..8e7acd7d5 100644
--- a/test/unit/injector-psp-role.bats
+++ b/test/unit/injector-psp-role.bats
@@ -22,7 +22,7 @@ load _helpers
   [ "${actual}" = "true" ]
 }
 
-@test "injector/PodSecurityPolicy-Role: disable with global.enabled" {
+@test "injector/PodSecurityPolicy-Role: ignore global.enabled" {
   cd `chart_dir`
   local actual=$( (helm template \
       --show-only templates/injector-psp-role.yaml  \
@@ -31,5 +31,5 @@ load _helpers
       --set 'global.psp.enable=true' \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
-  [ "${actual}" = "false" ]
+  [ "${actual}" = "true" ]
 }
diff --git a/test/unit/injector-psp-rolebinding.bats b/test/unit/injector-psp-rolebinding.bats
index f8a8255fb..88bfe7900 100644
--- a/test/unit/injector-psp-rolebinding.bats
+++ b/test/unit/injector-psp-rolebinding.bats
@@ -22,7 +22,7 @@ load _helpers
   [ "${actual}" = "true" ]
 }
 
-@test "injector/PodSecurityPolicy-RoleBinding: disable with global.enabled" {
+@test "injector/PodSecurityPolicy-RoleBinding: ignore global.enabled" {
   cd `chart_dir`
   local actual=$( (helm template \
       --show-only templates/injector-psp-rolebinding.yaml  \
@@ -31,5 +31,5 @@ load _helpers
       --set 'global.psp.enable=true' \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
-  [ "${actual}" = "false" ]
+  [ "${actual}" = "true" ]
 }
diff --git a/test/unit/injector-psp.bats b/test/unit/injector-psp.bats
index fa14b0f1e..a415358b2 100644
--- a/test/unit/injector-psp.bats
+++ b/test/unit/injector-psp.bats
@@ -22,7 +22,7 @@ load _helpers
   [ "${actual}" = "true" ]
 }
 
-@test "injector/PodSecurityPolicy: disable with global.enabled" {
+@test "injector/PodSecurityPolicy: ignore global.enabled" {
   cd `chart_dir`
   local actual=$( (helm template \
       --show-only templates/injector-psp.yaml  \
@@ -31,7 +31,7 @@ load _helpers
       --set 'global.psp.enable=true' \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
-  [ "${actual}" = "false" ]
+  [ "${actual}" = "true" ]
 }
 
 @test "injector/PodSecurityPolicy: annotations are templated correctly by default" {
diff --git a/test/unit/injector-service.bats b/test/unit/injector-service.bats
index ad4800991..027eaa080 100755
--- a/test/unit/injector-service.bats
+++ b/test/unit/injector-service.bats
@@ -52,7 +52,7 @@ load _helpers
       --set 'injector.enabled=true' \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
-  [ "${actual}" = "false" ]
+  [ "${actual}" = "true" ]
 }
 
 @test "injector/Service: generic annotations" {
diff --git a/test/unit/schema.bats b/test/unit/schema.bats
index a42614bf6..9a61d7d5a 100644
--- a/test/unit/schema.bats
+++ b/test/unit/schema.bats
@@ -7,9 +7,9 @@ load _helpers
 # schema, setting it as a string fails 'helm template'.
 @test "schema: csi enabled datatype" {
   cd `chart_dir`
-  run helm template . --set csi.enabled="nope"
+  run helm template . --set csi.enabled="123"
   [ "$status" -eq 1 ]
-  [ "${lines[2]}" = "- csi.enabled: Invalid type. Expected: boolean, given: string" ]
+  [ "${lines[2]}" = "- csi.enabled: Invalid type. Expected: [boolean,string], given: integer" ]
 
   run helm template . --set csi.enabled=true
   [ "$status" -eq 0 ]
@@ -17,9 +17,9 @@ load _helpers
 
 @test "schema: injector enabled datatype" {
   cd `chart_dir`
-  run helm template . --set injector.enabled="nope"
+  run helm template . --set injector.enabled="123"
   [ "$status" -eq 1 ]
-  [ "${lines[2]}" = "- injector.enabled: Invalid type. Expected: boolean, given: string" ]
+  [ "${lines[2]}" = "- injector.enabled: Invalid type. Expected: [boolean,string], given: integer" ]
 
   run helm template . --set injector.enabled=true
   [ "$status" -eq 0 ]
@@ -27,9 +27,9 @@ load _helpers
 
 @test "schema: server enabled datatype" {
   cd `chart_dir`
-  run helm template . --set server.enabled="nope"
+  run helm template . --set server.enabled="123"
   [ "$status" -eq 1 ]
-  [ "${lines[2]}" = "- server.enabled: Invalid type. Expected: boolean, given: string" ]
+  [ "${lines[2]}" = "- server.enabled: Invalid type. Expected: [boolean,string], given: integer" ]
 
   run helm template . --set server.enabled=true
   [ "$status" -eq 0 ]
@@ -37,9 +37,9 @@ load _helpers
 
 @test "schema: ui enabled datatype" {
   cd `chart_dir`
-  run helm template . --set ui.enabled="nope"
+  run helm template . --set ui.enabled="123"
   [ "$status" -eq 1 ]
-  [ "${lines[2]}" = "- ui.enabled: Invalid type. Expected: boolean, given: string" ]
+  [ "${lines[2]}" = "- ui.enabled: Invalid type. Expected: [boolean,string], given: integer" ]
 
   run helm template . --set ui.enabled=true
   [ "$status" -eq 0 ]
diff --git a/test/unit/server-test.bats b/test/unit/server-test.bats
index 5fd65d561..de82f84c3 100644
--- a/test/unit/server-test.bats
+++ b/test/unit/server-test.bats
@@ -66,14 +66,25 @@ load _helpers
   [ "${actual}" = "true" ]
 }
 
-@test "server/standalone-server-test-Pod: disable with global.enabled" {
+@test "server/standalone-server-test-Pod: not disabled with global.enabled" {
   cd `chart_dir`
   local actual=$( (helm template \
       --show-only templates/tests/server-test.yaml  \
       --set 'global.enabled=false' \
+      --set 'server.enabled=true' \
       --set 'server.standalone.enabled=true' \
       . || echo "---") | tee /dev/stderr |
       yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
+@test "server/standalone-server-test-Pod: disable with global.enabled" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/tests/server-test.yaml  \
+      --set 'global.enabled=false' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
   [ "${actual}" = "false" ]
 }
 
diff --git a/test/unit/ui-service.bats b/test/unit/ui-service.bats
index 0603303cd..384098f89 100755
--- a/test/unit/ui-service.bats
+++ b/test/unit/ui-service.bats
@@ -53,6 +53,18 @@ load _helpers
   [ "${actual}" = "false" ]
 }
 
+@test "ui/Service: 'disable with global, enable with ui.enabled'" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/ui-service.yaml  \
+      --set 'global.enabled=false' \
+      --set 'server.enabled=true' \
+      --set 'ui.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
 @test "ui/Service: disable with injector.externalVaultAddr" {
   cd `chart_dir`
   local actual=$( (helm template \
diff --git a/values.schema.json b/values.schema.json
index 981bb7c23..523784825 100644
--- a/values.schema.json
+++ b/values.schema.json
@@ -43,7 +43,10 @@
                     "type": "boolean"
                 },
                 "enabled": {
-                    "type": "boolean"
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
                 },
                 "extraArgs": {
                     "type": "array"
@@ -266,7 +269,10 @@
                     }
                 },
                 "enabled": {
-                    "type": "boolean"
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
                 },
                 "externalVaultAddr": {
                     "type": "string"
@@ -507,7 +513,10 @@
                     }
                 },
                 "enabled": {
-                    "type": "boolean"
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
                 },
                 "enterpriseLicense": {
                     "type": "object",
@@ -874,7 +883,10 @@
                     ]
                 },
                 "enabled": {
-                    "type": "boolean"
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
                 },
                 "externalPort": {
                     "type": "integer"
diff --git a/values.yaml b/values.yaml
index 20d85d59b..4d967f886 100644
--- a/values.yaml
+++ b/values.yaml
@@ -26,7 +26,8 @@ global:
 
 injector:
   # True if you want to enable vault agent injection.
-  enabled: true
+  # @default: global.enabled
+  enabled: "-"
 
   replicas: 1
 
@@ -266,8 +267,9 @@ injector:
   #   type: RollingUpdate
 
 server:
-  # If not set to true, Vault server will not be installed. See vault.mode in _helpers.tpl for implementation details
-  enabled: true
+  # If true, or "-" with global.enabled true, Vault server will be installed.
+  # See vault.mode in _helpers.tpl for implementation details.
+  enabled: "-"
 
   # [Enterprise Only] This value refers to a Kubernetes secret that you have
   # created that contains your enterprise license. If you are not using an
@@ -878,7 +880,7 @@ csi:
     # This should be a YAML map of the labels to apply to the csi provider pod
     extraLabels: {}
 
-   
+
 
   # Priority class for csi pods
   priorityClassName: ""