diff --git a/jenkins/README.md b/jenkins/README.md
index c564a20..d0dbd20 100644
--- a/jenkins/README.md
+++ b/jenkins/README.md
@@ -19,7 +19,7 @@ To experiment with a new/temporary one consider creating a new OAuth application
 * Make sure the Authorization callback URL is something like https://jenkins.terasology.io/securityRealm/finishLogin
 * Description can be anything, like "Jenkins for The Terasology Foundation"
 
-For the sake of local development ease you can use `jenkins-secret-do-not-recomment.yaml` to prepare the secrets for Kubernetes, just enter the right values as instructed by comments and run `kubectl apply -f jenkins-secret-do-not-recommit.yaml -n jenkins` - you may need to create the namespace first. HOWEVER you do of course not want to commit the actual values, and we should aim to use proper external secrets manager like Vault or some Argo-flavored thing (which does also have a plugin for Vault)
+For the sake of local development ease you can use `jenkins-secret-do-not-recommit.yaml` to prepare the secrets for Kubernetes, just enter the right values as instructed by comments and run `kubectl apply -f jenkins-secret-do-not-recommit.yaml -n jenkins` - you may need to create the namespace first. HOWEVER you do of course not want to commit the actual values, and we should aim to use proper external secrets manager like Vault or some Argo-flavored thing (which does also have a plugin for Vault)
 
 ## GitHub API via GitHub App
 
@@ -53,6 +53,8 @@ The key generated from the GitHub application was included in this repo as `tera
 
 Note: For testing a new Jenkins the existing GitHub app can simply be used directly - it will work even with a test Jenkins at a different URL.
 
+Note: At some point "Checks" became a needed permissions to update commit status on GitHub after builds. Make sure the GitHub app under Permissions & Events / Repository Permissions / Checks is set to "Read and write"
+
 ## Various secrets
 
 Jenkins has built up a lot of credentials over the years, and all the original instructions are in the https://github.com/MovingBlocks/InfraPlayground repo - for this rejuvenation attempt let us see how few we can get away with (passwords can be found in a password safe somewhere or the old repo):
diff --git a/jenkins/values-agents.yaml b/jenkins/values-agents.yaml
index 3a80250..18b0978 100644
--- a/jenkins/values-agents.yaml
+++ b/jenkins/values-agents.yaml
@@ -44,6 +44,26 @@ jenkins:
                       resourceLimitCpu: "750m"
                       resourceLimitMemory: "4096Mi"
 
+                  # New pre-cached agent for Vertex AI access to run embeddings from a pipeline and such
+                  # Jenkins UI actually has a spot for service account, can we use that instead of a yaml block?
+                  - name: "python-agent-ai"
+                    label: "python-ai"
+                    nodeUsageMode: "EXCLUSIVE"
+                    containers:
+                    - name: builder
+                      image: "us-east1-docker.pkg.dev/teralivekubernetes/logistics/jenkins-python-ai-agent:latest"
+                      command: "sleep"
+                      args: "infinity"
+                      resourceRequestCpu: "250m"
+                      resourceRequestMemory: "2048Mi"
+                      resourceLimitCpu: "750m"
+                      resourceLimitMemory: "4096Mi"
+                    yaml: |
+                      apiVersion: v1
+                      kind: Pod
+                      spec:
+                        serviceAccountName: um-vertex-ai-sa
+
                   # TODO: Rebuild atop latest inbound solely using jnlp container rather than an extra (and remove DS default container declaration)
                   # Android builds for Gestalt and Destination Sol
                   - name: "android-agent"
@@ -130,7 +150,8 @@ jenkins:
                           key: "PATH" # Note: Trying to prepend the existing var by including :$PATH broke the Jenkins agent connection process - hard coding instead
                           value: "/opt/jdk8u432-b06/bin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin"
 
-                  # Note that "lib", "light" and "light-java" label jobs tend to be an old generation from back when the JDK was not explicitly called out - leave those on JDK 11 for now
+                  # "lib", "light" and "light-java" are an old generation of labels from before the JDK was called out explicitly, so they deliberately overlap with the JDK 17 template below.
+                  # Jobs are expected to ask compositely ("java11 && light"); a job requesting bare "light" may land on either JDK, which is acceptable for how rare those are.
                   - name: "pre-cached-jdk11"
                     label: "lib light java11 light-java"
                     nodeUsageMode: "EXCLUSIVE"
@@ -175,7 +196,7 @@ jenkins:
                           value: "/opt/jdk-11.0.25+9/bin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin"
 
                   - name: "pre-cached-jdk17"
-                    label: "ts-module java17"
+                    label: "ts-module java17 light light-java"
                     nodeUsageMode: "EXCLUSIVE"
                     containers:
                     - name: jnlp  # Override the default Jenkins container with our extended image
diff --git a/jenkins/values.yaml b/jenkins/values.yaml
index bd741cb..5866a97 100644
--- a/jenkins/values.yaml
+++ b/jenkins/values.yaml
@@ -15,10 +15,10 @@ jenkins:
       tag: "2.479.2-lts"
     resources:
       requests:
-        cpu: "250m"
-        memory: "4Gi"
+        cpu: "100m"
+        memory: "2.5Gi"
       limits:
-        cpu: "2000m"
+        cpu: "1500m"
         memory: "8Gi"
     JCasC:
       defaultConfig: false  # Disable the default JCasC configuration (don't want two Kubernetes clouds) - replacement config in values-jcasc-general.yaml