diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 727e2bea..7b5cb645 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.14.0"
+  ".": "0.14.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9462a6f1..00a9a0cb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.14.1](https://github.com/developmentseed/eoapi-k8s/compare/v0.14.0...v0.14.1) (2026-07-23)
+
+
+### Fixed
+
+* **docs:** updated release information. ([#571](https://github.com/developmentseed/eoapi-k8s/issues/571)) ([693cdb6](https://github.com/developmentseed/eoapi-k8s/commit/693cdb67cc7e1625220bd8cd143a256159abaf99))
+
+
+### Maintenance
+
+* bump minimal version of kubernetes to 1.32 ([#567](https://github.com/developmentseed/eoapi-k8s/issues/567)) ([be183e7](https://github.com/developmentseed/eoapi-k8s/commit/be183e78a152f55f1781ee76498bea875ba07a8c))
+* **deps:** updated actions/checkout digest to 3d3c42e ([#564](https://github.com/developmentseed/eoapi-k8s/issues/564)) ([d70a976](https://github.com/developmentseed/eoapi-k8s/commit/d70a97623edc33e0ff68237adae9f5b1892de6e8))
+* **deps:** updated helm release prometheus to 29.18.0. ([#565](https://github.com/developmentseed/eoapi-k8s/issues/565)) ([5d83768](https://github.com/developmentseed/eoapi-k8s/commit/5d83768feef31c479c4fc976f038a7e489427912))
+* **deps:** updated helm release prometheus to 29.19.0. ([#570](https://github.com/developmentseed/eoapi-k8s/issues/570)) ([88d305d](https://github.com/developmentseed/eoapi-k8s/commit/88d305d103a1c0d56fb7c785f14efed8c9cd27ff))
+
 ## [0.14.0](https://github.com/developmentseed/eoapi-k8s/compare/v0.13.4...v0.14.0) (2026-07-20)
 
 
diff --git a/charts/eoapi/Chart.yaml b/charts/eoapi/Chart.yaml
index 80b0afc8..7d59caaa 100644
--- a/charts/eoapi/Chart.yaml
+++ b/charts/eoapi/Chart.yaml
@@ -25,7 +25,7 @@ annotations:
     - stac
     - raster
     - vector
-version: 0.14.0
+version: 0.14.1
 appVersion: 6.3.1
 dependencies:
   - name: postgrescluster
diff --git a/charts/eoapi/profiles/experimental.yaml b/charts/eoapi/profiles/experimental.yaml
index 5d448922..932eec3c 100644
--- a/charts/eoapi/profiles/experimental.yaml
+++ b/charts/eoapi/profiles/experimental.yaml
@@ -386,8 +386,8 @@ testing:
     enabled: true
     replicaCount: 1
     image:
-      repository: ghcr.io/alukach/mock-oidc-server
-      tag: latest
+      name: ghcr.io/alukach/mock-oidc-server
+      digest: sha256:5972adac0b6e3a094ea043be0f1851c65e3fd54e17a546f0b71dedd17c7a2d6a
       pullPolicy: IfNotPresent
     port: 8888
     clientId: "test-client"
diff --git a/charts/eoapi/templates/_helpers/core.tpl b/charts/eoapi/templates/_helpers/core.tpl
index 8a68021e..e48ec119 100644
--- a/charts/eoapi/templates/_helpers/core.tpl
+++ b/charts/eoapi/templates/_helpers/core.tpl
@@ -73,3 +73,15 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Resolve a container image reference from an image values map.
+Uses name + tag, or name@digest when digest is set.
+*/}}
+{{- define "eoapi.containerImage" -}}
+{{- if .digest -}}
+{{- printf "%s@%s" .name .digest -}}
+{{- else -}}
+{{- printf "%s:%s" .name (required "image.tag is required when digest is unset" .tag) -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/eoapi/templates/_helpers/services.tpl b/charts/eoapi/templates/_helpers/services.tpl
index 9c4c349f..e9a5bd7a 100644
--- a/charts/eoapi/templates/_helpers/services.tpl
+++ b/charts/eoapi/templates/_helpers/services.tpl
@@ -43,7 +43,8 @@ Helper function for common init containers to wait for pgstac jobs
 {{- if .Values.pgstacBootstrap.enabled }}
 initContainers:
 - name: wait-for-pgstac-jobs
-  image: alpine/kubectl:1.34.1
+  image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.waitImage }}
+  imagePullPolicy: {{ .Values.pgstacBootstrap.waitImage.pullPolicy | default "IfNotPresent" }}
   securityContext:
     runAsNonRoot: true
     runAsUser: 65534
diff --git a/charts/eoapi/templates/core/cloudevents-sink.yaml b/charts/eoapi/templates/core/cloudevents-sink.yaml
index 4f3c5400..f2528084 100644
--- a/charts/eoapi/templates/core/cloudevents-sink.yaml
+++ b/charts/eoapi/templates/core/cloudevents-sink.yaml
@@ -29,7 +29,8 @@ spec:
     spec:
       containers:
       - name: cloudevents-sink
-        image: gcr.io/knative-samples/helloworld-go:latest
+        image: {{ include "eoapi.containerImage" .Values.knative.cloudEventsSink.image }}
+        imagePullPolicy: {{ .Values.knative.cloudEventsSink.image.pullPolicy | default "IfNotPresent" }}
         ports:
         - containerPort: 8080
         env:
diff --git a/charts/eoapi/templates/core/knative-init.yaml b/charts/eoapi/templates/core/knative-init.yaml
index 602809c3..88df4d1c 100644
--- a/charts/eoapi/templates/core/knative-init.yaml
+++ b/charts/eoapi/templates/core/knative-init.yaml
@@ -22,8 +22,8 @@ spec:
       serviceAccountName: {{ include "eoapi.serviceAccountName" . }}
       containers:
       - name: knative-init
-        image: alpine/kubectl:1.34.1
-        imagePullPolicy: IfNotPresent
+        image: {{ include "eoapi.containerImage" .Values.knative.jobs.init.image }}
+        imagePullPolicy: {{ .Values.knative.jobs.init.image.pullPolicy | default "IfNotPresent" }}
         securityContext:
           runAsNonRoot: true
           runAsUser: 65534
diff --git a/charts/eoapi/templates/database/pgstacbootstrap/eoap-superuser-initdb.yaml b/charts/eoapi/templates/database/pgstacbootstrap/eoap-superuser-initdb.yaml
index 7218ebbf..3e338778 100644
--- a/charts/eoapi/templates/database/pgstacbootstrap/eoap-superuser-initdb.yaml
+++ b/charts/eoapi/templates/database/pgstacbootstrap/eoap-superuser-initdb.yaml
@@ -22,7 +22,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-eoapiuser-permissions
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"
diff --git a/charts/eoapi/templates/database/pgstacbootstrap/extent-updater.yaml b/charts/eoapi/templates/database/pgstacbootstrap/extent-updater.yaml
index 6dd3ad23..44e554ee 100644
--- a/charts/eoapi/templates/database/pgstacbootstrap/extent-updater.yaml
+++ b/charts/eoapi/templates/database/pgstacbootstrap/extent-updater.yaml
@@ -25,8 +25,8 @@ spec:
           restartPolicy: OnFailure
           containers:
           - name: extent-updater
-            image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
-            imagePullPolicy: IfNotPresent
+            image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+            imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
             command:
               - "/bin/sh"
               - "-c"
diff --git a/charts/eoapi/templates/database/pgstacbootstrap/job.yaml b/charts/eoapi/templates/database/pgstacbootstrap/job.yaml
index 7bfa04c2..b7ae29f0 100644
--- a/charts/eoapi/templates/database/pgstacbootstrap/job.yaml
+++ b/charts/eoapi/templates/database/pgstacbootstrap/job.yaml
@@ -39,7 +39,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-migrate
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"
@@ -107,7 +108,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-load-samples
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"
@@ -178,7 +180,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-load-queryables
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"
diff --git a/charts/eoapi/templates/database/pgstacbootstrap/queue-processor.yaml b/charts/eoapi/templates/database/pgstacbootstrap/queue-processor.yaml
index 839adf78..1126756f 100644
--- a/charts/eoapi/templates/database/pgstacbootstrap/queue-processor.yaml
+++ b/charts/eoapi/templates/database/pgstacbootstrap/queue-processor.yaml
@@ -25,8 +25,8 @@ spec:
           restartPolicy: OnFailure
           containers:
           - name: queue-processor
-            image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
-            imagePullPolicy: IfNotPresent
+            image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+            imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
             command:
               - "/bin/sh"
               - "-c"
diff --git a/charts/eoapi/templates/services/browser/deployment.yaml b/charts/eoapi/templates/services/browser/deployment.yaml
index 65a5428b..80d5c0af 100644
--- a/charts/eoapi/templates/services/browser/deployment.yaml
+++ b/charts/eoapi/templates/services/browser/deployment.yaml
@@ -21,7 +21,8 @@ spec:
     spec:
       containers:
         - name: browser
-          image: {{ .Values.browser.image.name }}:{{ .Values.browser.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.browser.image }}
+          imagePullPolicy: {{ .Values.browser.image.pullPolicy | default "IfNotPresent" }}
           ports:
           - containerPort: 8080
           env:
diff --git a/charts/eoapi/templates/services/doc-server.yaml b/charts/eoapi/templates/services/doc-server.yaml
index 87c2efb2..3cdace70 100644
--- a/charts/eoapi/templates/services/doc-server.yaml
+++ b/charts/eoapi/templates/services/doc-server.yaml
@@ -51,7 +51,8 @@ spec:
     spec:
       containers:
       - name: doc-server
-        image: nginxinc/nginx-unprivileged:alpine
+        image: {{ include "eoapi.containerImage" .Values.docServer.image }}
+        imagePullPolicy: {{ .Values.docServer.image.pullPolicy | default "IfNotPresent" }}
         volumeMounts:
         - name: {{ .Release.Name }}-doc-html
           mountPath: /usr/share/nginx/html
diff --git a/charts/eoapi/templates/services/multidim/deployment.yaml b/charts/eoapi/templates/services/multidim/deployment.yaml
index 0a62c7aa..2c8383c3 100644
--- a/charts/eoapi/templates/services/multidim/deployment.yaml
+++ b/charts/eoapi/templates/services/multidim/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.multidim.image.name }}:{{ .Values.multidim.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.multidim.image }}
+        imagePullPolicy: {{ .Values.multidim.image.pullPolicy | default "IfNotPresent" }}
         name: multidim
         command:
           {{- toYaml .Values.multidim.command | nindent 10 }}
diff --git a/charts/eoapi/templates/services/raster/deployment.yaml b/charts/eoapi/templates/services/raster/deployment.yaml
index 1ee5cf1d..de47f73d 100644
--- a/charts/eoapi/templates/services/raster/deployment.yaml
+++ b/charts/eoapi/templates/services/raster/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.raster.image.name }}:{{ .Values.raster.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.raster.image }}
+        imagePullPolicy: {{ .Values.raster.image.pullPolicy | default "IfNotPresent" }}
         name: raster
         command:
           {{- toYaml .Values.raster.command | nindent 10 }}
diff --git a/charts/eoapi/templates/services/stac/deployment.yaml b/charts/eoapi/templates/services/stac/deployment.yaml
index c94633de..747b8b2a 100644
--- a/charts/eoapi/templates/services/stac/deployment.yaml
+++ b/charts/eoapi/templates/services/stac/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.stac.image.name }}:{{ .Values.stac.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.stac.image }}
+        imagePullPolicy: {{ .Values.stac.image.pullPolicy | default "IfNotPresent" }}
         name: stac
         command:
           {{- toYaml .Values.stac.command | nindent 10 }}
diff --git a/charts/eoapi/templates/services/vector/deployment.yaml b/charts/eoapi/templates/services/vector/deployment.yaml
index b40c8a08..0e8e6306 100644
--- a/charts/eoapi/templates/services/vector/deployment.yaml
+++ b/charts/eoapi/templates/services/vector/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.vector.image.name }}:{{ .Values.vector.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.vector.image }}
+        imagePullPolicy: {{ .Values.vector.image.pullPolicy | default "IfNotPresent" }}
         name: vector
         command:
           {{- toYaml .Values.vector.command | nindent 10 }}
diff --git a/charts/eoapi/templates/testing/deployment.yaml b/charts/eoapi/templates/testing/deployment.yaml
index fb5bc9df..2243bbc3 100644
--- a/charts/eoapi/templates/testing/deployment.yaml
+++ b/charts/eoapi/templates/testing/deployment.yaml
@@ -28,8 +28,8 @@ spec:
       {{- end }}
       containers:
       - name: mock-oidc
-        image: "{{ if .Values.testing.mockOidcServer.image }}{{ .Values.testing.mockOidcServer.image.repository | default "ghcr.io/alukach/mock-oidc-server" }}:{{ .Values.testing.mockOidcServer.image.tag | default "latest" }}{{ else }}ghcr.io/alukach/mock-oidc-server:latest{{ end }}"
-        imagePullPolicy: {{ if .Values.testing.mockOidcServer.image }}{{ .Values.testing.mockOidcServer.image.pullPolicy | default "IfNotPresent" }}{{ else }}IfNotPresent{{ end }}
+        image: {{ include "eoapi.containerImage" .Values.testing.mockOidcServer.image }}
+        imagePullPolicy: {{ .Values.testing.mockOidcServer.image.pullPolicy | default "IfNotPresent" }}
         env:
         - name: MOCK_OIDC_PORT
           value: "{{ .Values.testing.mockOidcServer.port | default 8888 }}"
diff --git a/charts/eoapi/tests/doc-server_test.yaml b/charts/eoapi/tests/doc-server_test.yaml
index 5b91ece4..9ec7a402 100644
--- a/charts/eoapi/tests/doc-server_test.yaml
+++ b/charts/eoapi/tests/doc-server_test.yaml
@@ -1,5 +1,6 @@
 suite: doc-server tests
 templates:
+  - templates/_helpers/core.tpl
   - templates/services/doc-server.yaml
 tests:
   - it: "renders landing page by default"
diff --git a/charts/eoapi/tests/image_tests.yaml b/charts/eoapi/tests/image_tests.yaml
new file mode 100644
index 00000000..4039bdfe
--- /dev/null
+++ b/charts/eoapi/tests/image_tests.yaml
@@ -0,0 +1,57 @@
+suite: container image configuration
+templates:
+  - templates/_helpers/core.tpl
+  - templates/_helpers/services.tpl
+  - templates/_helpers/database.tpl
+  - templates/services/stac/deployment.yaml
+  - templates/services/stac/configmap.yaml
+  - templates/services/doc-server.yaml
+  - templates/core/cloudevents-sink.yaml
+  - templates/core/knative-init.yaml
+  - templates/testing/deployment.yaml
+tests:
+  - it: stac deployment uses default image and pullPolicy
+    template: templates/services/stac/deployment.yaml
+    set:
+      stac.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/stac-utils/stac-fastapi-pgstac:6.3.1
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+
+  - it: stac deployment honors image override and Always pullPolicy
+    template: templates/services/stac/deployment.yaml
+    set:
+      stac:
+        enabled: true
+        image:
+          name: example.com/stac
+          tag: custom
+          pullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: example.com/stac:custom
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+
+  - it: doc-server uses pinned nginx image
+    template: templates/services/doc-server.yaml
+    set:
+      docServer:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: nginxinc/nginx-unprivileged:1.27.4-alpine
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
diff --git a/charts/eoapi/values.schema.json b/charts/eoapi/values.schema.json
index 8574e812..5d70d991 100644
--- a/charts/eoapi/values.schema.json
+++ b/charts/eoapi/values.schema.json
@@ -259,17 +259,10 @@
           "description": "Enable PgSTAC bootstrap"
         },
         "image": {
-          "type": "object",
-          "properties": {
-            "name": {
-              "type": "string",
-              "description": "PgSTAC bootstrap image name"
-            },
-            "tag": {
-              "type": "string",
-              "description": "PgSTAC bootstrap image tag"
-            }
-          }
+          "$ref": "#/definitions/containerImage"
+        },
+        "waitImage": {
+          "$ref": "#/definitions/containerImage"
         },
         "configMaps": {
           "type": "object",
@@ -568,17 +561,7 @@
           "description": "Number of replicas"
         },
         "image": {
-          "type": "object",
-          "properties": {
-            "name": {
-              "type": "string",
-              "description": "Image name"
-            },
-            "tag": {
-              "type": "string",
-              "description": "Image tag"
-            }
-          }
+          "$ref": "#/definitions/containerImage"
         },
         "ingress": {
           "type": "object",
@@ -613,6 +596,9 @@
           "default": "",
           "description": "When set, root path / redirects to this URL instead of showing the landing page (e.g. /browser/)"
         },
+        "image": {
+          "$ref": "#/definitions/containerImage"
+        },
         "settings": {
           "type": "object",
           "properties": {
@@ -802,6 +788,44 @@
             "enabled": {
               "type": "boolean",
               "description": "Enable mock OIDC server"
+            },
+            "image": {
+              "$ref": "#/definitions/containerImage"
+            }
+          }
+        }
+      }
+    },
+    "knative": {
+      "type": "object",
+      "description": "Optional Knative components for CloudEvents and serverless workloads",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable Knative components"
+        },
+        "cloudEventsSink": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Enable CloudEvents sink"
+            },
+            "image": {
+              "$ref": "#/definitions/containerImage"
+            }
+          }
+        },
+        "jobs": {
+          "type": "object",
+          "properties": {
+            "init": {
+              "type": "object",
+              "properties": {
+                "image": {
+                  "$ref": "#/definitions/containerImage"
+                }
+              }
             }
           }
         }
@@ -943,17 +967,7 @@
           }
         },
         "image": {
-          "type": "object",
-          "properties": {
-            "name": {
-              "type": "string",
-              "description": "Image name"
-            },
-            "tag": {
-              "type": "string",
-              "description": "Image tag"
-            }
-          }
+          "$ref": "#/definitions/containerImage"
         },
         "command": {
           "type": "array",
@@ -996,6 +1010,34 @@
           }
         }
       }
+    },
+    "containerImage": {
+      "type": "object",
+      "description": "Container image reference. Prefer digest over tag when pinning immutable images.",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Image name (registry/repository)"
+        },
+        "tag": {
+          "type": "string",
+          "description": "Image tag (ignored when digest is set)"
+        },
+        "digest": {
+          "type": "string",
+          "description": "Optional image digest (sha256:...). When set, overrides tag. Refresh when upgrading."
+        },
+        "pullPolicy": {
+          "type": "string",
+          "description": "Container image pull policy",
+          "default": "IfNotPresent",
+          "enum": [
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
+        }
+      }
     }
   }
 }
diff --git a/charts/eoapi/values.yaml b/charts/eoapi/values.yaml
index 41a4a9ca..bf7ba711 100644
--- a/charts/eoapi/values.yaml
+++ b/charts/eoapi/values.yaml
@@ -163,6 +163,12 @@ pgstacBootstrap:
   image:
     name: ghcr.io/stac-utils/pgstac-pypgstac
     tag: v0.10.0
+    pullPolicy: IfNotPresent
+  # kubectl image used by service initContainers waiting on pgstac jobs
+  waitImage:
+    name: alpine/kubectl
+    tag: "1.34.1"
+    pullPolicy: IfNotPresent
   configMaps:
     pgstacSettings:
       annotations:
@@ -318,6 +324,7 @@ raster:
   image:
     name: ghcr.io/stac-utils/titiler-pgstac
     tag: 3.0.0
+    pullPolicy: IfNotPresent
   command:
     - "uvicorn"
     - "titiler.pgstac.main:app"
@@ -383,6 +390,7 @@ multidim:
   image:
     name: ghcr.io/developmentseed/titiler-md-demo
     tag: 6406b10406287ba9d3f345706d0c2be5f0265e02
+    pullPolicy: IfNotPresent
   command:
     - "uvicorn"
     - "titiler_md_demo.main:app"
@@ -448,6 +456,7 @@ stac:
   image:
     name: ghcr.io/stac-utils/stac-fastapi-pgstac
     tag: 6.3.1
+    pullPolicy: IfNotPresent
   command:
     - "uvicorn"
     - "stac_fastapi.pgstac.app:app"
@@ -570,6 +579,7 @@ vector:
   image:
     name: ghcr.io/developmentseed/tipg
     tag: 1.4.0
+    pullPolicy: IfNotPresent
   command:
     - "uvicorn"
     - "tipg.main:app"
@@ -608,6 +618,7 @@ browser:
     # Patched eoapi image (runtime SB_pathPrefix); built from upstream v4.0.1 + patches/stac-browser/
     name: ghcr.io/developmentseed/eoapi-k8s/stac-browser
     tag: 4.0.1-eoapi.1
+    pullPolicy: IfNotPresent
   service:
     port: 8080
   ingress:
@@ -648,6 +659,10 @@ browser:
 docServer:
   enabled: true
   redirectTo: ""  # When set, root path redirects here instead of showing the landing page (e.g. "/browser/")
+  image:
+    name: nginxinc/nginx-unprivileged
+    tag: "1.27.4-alpine"
+    pullPolicy: IfNotPresent
   settings:
     resources: {}
 
@@ -703,6 +718,11 @@ eoapi-notifier:
 testing:
   mockOidcServer:
     enabled: false  # Only enabled in experimental profile
+    image:
+      name: ghcr.io/alukach/mock-oidc-server
+      # No version tags published; pin by digest (refresh when upgrading the image).
+      digest: sha256:5972adac0b6e3a094ea043be0f1851c65e3fd54e17a546f0b71dedd17c7a2d6a
+      pullPolicy: IfNotPresent
 
 ######################
 # KNATIVE
@@ -719,7 +739,11 @@ knative:
   # CloudEvents sink configuration (deployed when eoapi-notifier uses CloudEvents output)
   cloudEventsSink:
     enabled: false
-    image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9
+    # Sample Knative sink; pin by digest (refresh when upgrading the image).
+    image:
+      name: gcr.io/knative-samples/helloworld-go
+      digest: sha256:ec6672b354dc9db37b221ee76fea62147d0450028208aa964011f685b1e0a3e3
+      pullPolicy: IfNotPresent
     resources: {}
     service:
       annotations:
@@ -733,6 +757,10 @@ knative:
         helm.sh/hook-delete-policy: "before-hook-creation"
   jobs:
     init:
+      image:
+        name: alpine/kubectl
+        tag: "1.34.1"
+        pullPolicy: IfNotPresent
       annotations:
         helm.sh/hook: "post-install,post-upgrade"
         helm.sh/hook-weight: "0"