Instead of pulling weights from S3 at startup, we've been packaging models as OCI artifacts and pulling them by digest, the same way we pull images. That gets us signing, replication and admission policy for free. For anyone else doing this: how are you handling large layers (tens of GB), registry limits, and caching on GPU nodes? Init container, CSI, image volumes? Trade-offs welcome.