diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/README.md b/packs/nvidia-vss-data-infrastructure-3.3.2/README.md
new file mode 100644
index 00000000..79be9425
--- /dev/null
+++ b/packs/nvidia-vss-data-infrastructure-3.3.2/README.md
@@ -0,0 +1,3 @@
+# NVIDIA VSS Data Infrastructure
+
+NVIDIA VSS 3.x shared data infrastructure (install-priority 5, present in EVERY profile). Owns the cross-pack hf-token-secret and the P5 vss-platform ConfigMap (single source of truth for VSS_PLATFORM), plus the data stores. Platform-invariant: all images are standard public ones (Elasticsearch/Kafka/Redis/Postgres/Kibana/Logstash/Phoenix) so this pack has NO VSS Platform presets. Only phoenix/redis/postgres run in the base profile; elasticsearch/kafka/kibana/logstash are authored for the search/alerts profiles. Installs first so hf-token-secret and the data stores exist before the model backends (vllm/nims), core, and ingress consume them.
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/charts/nvidia-vss-data-infrastructure-3.3.2.tgz b/packs/nvidia-vss-data-infrastructure-3.3.2/charts/nvidia-vss-data-infrastructure-3.3.2.tgz
new file mode 100644
index 00000000..c669ac65
Binary files /dev/null and b/packs/nvidia-vss-data-infrastructure-3.3.2/charts/nvidia-vss-data-infrastructure-3.3.2.tgz differ
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/logo.png b/packs/nvidia-vss-data-infrastructure-3.3.2/logo.png
new file mode 100644
index 00000000..a98c7869
Binary files /dev/null and b/packs/nvidia-vss-data-infrastructure-3.3.2/logo.png differ
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/manifests/hf-token-secret.yaml b/packs/nvidia-vss-data-infrastructure-3.3.2/manifests/hf-token-secret.yaml
new file mode 100644
index 00000000..39611547
--- /dev/null
+++ b/packs/nvidia-vss-data-infrastructure-3.3.2/manifests/hf-token-secret.yaml
@@ -0,0 +1,18 @@
+# Shared HuggingFace token secret. Lives in the data-infrastructure pack because
+# that layer (install-priority 5) is present in EVERY VSS profile and installs
+# first -- so the secret exists before the model backends (vllm/nim) and the
+# vss-agent (application) consume it. HF_TOKEN is a masked cluster-profile
+# variable; required for the gated Cosmos-Reason2-8B VLM weights (and any gated
+# LLM weights). The HF_TOKEN cluster variable is resolved in values.yaml as
+# .Values.hfToken -- a spectro-var macro does NOT resolve inside a kubeManifest
+# body ("map has no entry for spectro"), and Palette templates comments too, so
+# it must be routed through .Values (never write macro braces in a manifest).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hf-token-secret
+  namespace: {{ .Values.namespace }}
+type: Opaque
+stringData:
+  HF_TOKEN: "{{ .Values.hfToken }}"
+  HUGGING_FACE_HUB_TOKEN: "{{ .Values.hfToken }}"
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/manifests/vss-platform.yaml b/packs/nvidia-vss-data-infrastructure-3.3.2/manifests/vss-platform.yaml
new file mode 100644
index 00000000..4c4bfe95
--- /dev/null
+++ b/packs/nvidia-vss-data-infrastructure-3.3.2/manifests/vss-platform.yaml
@@ -0,0 +1,20 @@
+# P5 single-source-of-truth: records the selected VSS hardware platform in-cluster.
+# Set ONE profile variable, VSS_PLATFORM (a Dropdown of the platform names), and
+# select the matching "VSS Platform" preset in every VSS pack. This ConfigMap makes
+# the chosen platform auditable (kubectl get cm vss-platform -n nvidia-vss) so a
+# preflight/CI or operator can confirm the per-pack presets agree with it. Lives in
+# the data-infrastructure pack (priority 5, present in every profile).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vss-platform
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/part-of: nvidia-vss
+data:
+  VSS_PLATFORM: "{{ .Values.vssPlatform }}"
+  note: >-
+    Source of truth for the VSS hardware platform. In VSS 3.x ALL FIVE packs
+    (data-infrastructure + nims + vllm + core + ingress) are in EVERY profile — the
+    vLLM pack is the LLM for all platforms, so there is no include/omit choice. Every
+    pack's "VSS Platform" preset MUST match this value. See 3X-MIGRATION.md.
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/pack.json b/packs/nvidia-vss-data-infrastructure-3.3.2/pack.json
new file mode 100644
index 00000000..cbcaf9a0
--- /dev/null
+++ b/packs/nvidia-vss-data-infrastructure-3.3.2/pack.json
@@ -0,0 +1,23 @@
+{
+  "addonType": "system app",
+  "annotations": {
+    "source": "community",
+    "contributor": "spectrocloud",
+    "docsURL": "https://docs.nvidia.com/vss/latest/index.html",
+    "description": "NVIDIA VSS 3.x shared data infrastructure (install-priority 5, present in EVERY profile). Owns the cross-pack hf-token-secret and the P5 vss-platform ConfigMap (single source of truth for VSS_PLATFORM), plus the data stores. Platform-invariant: all images are standard public ones (Elasticsearch/Kafka/Redis/Postgres/Kibana/Logstash/Phoenix) so this pack has NO VSS Platform presets. Only phoenix/redis/postgres run in the base profile; elasticsearch/kafka/kibana/logstash are authored for the search/alerts profiles. Installs first so hf-token-secret and the data stores exist before the model backends (vllm/nims), core, and ingress consume them."
+  },
+  "cloudTypes": [
+    "all"
+  ],
+  "displayName": "NVIDIA VSS Data Infrastructure",
+  "kubeManifests": [
+    "manifests/hf-token-secret.yaml",
+    "manifests/vss-platform.yaml"
+  ],
+  "layer": "addon",
+  "name": "nvidia-vss-data-infrastructure",
+  "version": "3.3.2",
+  "charts": [
+    "charts/nvidia-vss-data-infrastructure-3.2.1.tgz"
+  ]
+}
\ No newline at end of file
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/schema.yaml b/packs/nvidia-vss-data-infrastructure-3.3.2/schema.yaml
new file mode 100644
index 00000000..326fba1b
--- /dev/null
+++ b/packs/nvidia-vss-data-infrastructure-3.3.2/schema.yaml
@@ -0,0 +1,45 @@
+# Pack value constraints for the VSS data-infrastructure pack.
+# Keys are full dotted paths into values.yaml. This pack is platform-invariant
+# (no "VSS Platform" presets); only the genuinely operator-tunable keys are
+# constrained here. The config-blob ConfigMaps (redis-config, postgres-config,
+# logstash-*, etc.) are populated out-of-band and are not schema keys.
+namespace:
+  schema: '{{ required | format "${string}" | hints "Kubernetes namespace for all VSS data stores (matches pack.namespace; nvidia-vss)." }}'
+
+# ── images ──────────────────────────────────────────────────────────────────────
+redis.image:
+  schema: '{{ required | format "${string}" | hints "Redis image (public, e.g. redis:8.2.2-alpine)." }}'
+postgres.image:
+  schema: '{{ required | format "${string}" | hints "Postgres image (public, e.g. postgres:17.6-alpine)." }}'
+phoenix.image:
+  schema: '{{ required | format "${string}" | hints "Arize Phoenix image (public, e.g. arizephoenix/phoenix:version-8.12.1)." }}'
+elasticsearch.image:
+  schema: '{{ format "${string}" | hints "Elasticsearch image (search/alerts only; BUILT ELK 9.x image — set to your published tag)." }}'
+kafka.image:
+  schema: '{{ format "${string}" | hints "Kafka image (search/alerts only, e.g. confluentinc/cp-kafka:8.1.1)." }}'
+kibana.image:
+  schema: '{{ format "${string}" | hints "Kibana image (search/alerts only, e.g. docker.elastic.co/kibana/kibana:9.3.0)." }}'
+logstash.image:
+  schema: '{{ format "${string}" | hints "Logstash image (search/alerts only, e.g. docker.elastic.co/logstash/logstash:9.3.0)." }}'
+
+# ── storage sizes ─────────────────────────────────────────────────────────────
+redis.dataStorageSize:
+  schema: '{{ format "${string}" | hints "Redis data PVC size (e.g. 10Gi)." }}'
+redis.logStorageSize:
+  schema: '{{ format "${string}" | hints "Redis log PVC size (e.g. 2Gi)." }}'
+postgres.dataStorageSize:
+  schema: '{{ format "${string}" | hints "Postgres data PVC size (e.g. 20Gi)." }}'
+phoenix.storageSize:
+  schema: '{{ format "${string}" | hints "Phoenix data PVC size (e.g. 5Gi)." }}'
+elasticsearch.dataStorageSize:
+  schema: '{{ format "${string}" | hints "Elasticsearch data PVC size (e.g. 30Gi)." }}'
+elasticsearch.logStorageSize:
+  schema: '{{ format "${string}" | hints "Elasticsearch log PVC size (e.g. 5Gi)." }}'
+kafka.dataStorageSize:
+  schema: '{{ format "${string}" | hints "Kafka log-dir PVC size (e.g. 20Gi)." }}'
+
+# ── misc tunables ─────────────────────────────────────────────────────────────
+kibana.publicBaseUrl:
+  schema: '{{ format "${string}" | hints "Kibana SERVER_PUBLICBASEURL (e.g. http://localhost:5601)." }}'
+logstash.streamType:
+  schema: '{{ format "${string}" | hints "Logstash STREAM_TYPE: kafka (3.x base search) or redis." }}'
diff --git a/packs/nvidia-vss-data-infrastructure-3.3.2/values.yaml b/packs/nvidia-vss-data-infrastructure-3.3.2/values.yaml
new file mode 100644
index 00000000..406fdd4c
--- /dev/null
+++ b/packs/nvidia-vss-data-infrastructure-3.3.2/values.yaml
@@ -0,0 +1,40 @@
+pack:
+  namespace: nvidia-vss
+  spectrocloud.com/install-priority: '5'
+  content:
+    images:
+    - image: cgr.dev/chainguard/redis:latest
+    - image: cgr.dev/chainguard/postgres:latest
+    - image: cgr.dev/chainguard/python:latest-dev
+    - image: cgr.dev/chainguard/wolfi-base:latest
+namespace: nvidia-vss
+redis:
+  image: cgr.dev/chainguard/redis:latest
+  dataStorageSize: 10Gi
+  logStorageSize: 2Gi
+postgres:
+  image: cgr.dev/chainguard/postgres:latest
+  dataStorageSize: 20Gi
+phoenix:
+  image: cgr.dev/chainguard/python:latest-dev
+  storageSize: 5Gi
+elasticsearch:
+  image: cgr.dev/chainguard/wolfi-base:latest
+  dataStorageSize: 30Gi
+  logStorageSize: 5Gi
+kafka:
+  image: confluentinc/cp-kafka:8.1.1
+  dataStorageSize: 20Gi
+kibana:
+  image: docker.elastic.co/kibana/kibana:9.3.0
+  publicBaseUrl: http://localhost:5601
+logstash:
+  image: docker.elastic.co/logstash/logstash:9.3.0
+  streamType: kafka
+manifests:
+  hf-token-secret:
+    namespace: nvidia-vss
+    hfToken: '{{.spectro.var.HF_TOKEN}}'
+  vss-platform:
+    namespace: nvidia-vss
+    vssPlatform: '{{.spectro.var.VSS_PLATFORM}}'