diff --git a/charts/cert-manager/README.md b/charts/cert-manager/README.md
index 872ba1d..bba0bc8 100644
--- a/charts/cert-manager/README.md
+++ b/charts/cert-manager/README.md
@@ -4,7 +4,7 @@
 
 cert-manager can obtain certificates from a [variety of certificate authorities](https://cert-manager.io/docs/configuration/issuers/), including:
 [Let's Encrypt](https://cert-manager.io/docs/configuration/acme/), [HashiCorp Vault](https://cert-manager.io/docs/configuration/vault/),
-[Venafi](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
+[CyberArk](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
 
 ## Prerequisites
 
@@ -26,7 +26,7 @@
   cert-manager jetstack/cert-manager \
   --namespace cert-manager \
   --create-namespace \
-  --version v1.19.6 \
+  --version v1.20.3 \
   --set crds.enabled=true
 ```
 
@@ -269,6 +269,11 @@
 This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%). it cannot be used if `minAvailable` is set.
 
 
+#### **podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
 #### **featureGates** ~ `string`
 > Default value:
 > ```yaml
@@ -283,17 +288,51 @@
 > ```
 
 The maximum number of challenges that can be scheduled as 'processing' at once.
+#### **imageRegistry** ~ `string`
+> Default value:
+> ```yaml
+> quay.io
+> ```
+
+The container registry used for all cert-manager images by default. This can include path prefixes (e.g. `artifactory.example.com/docker`).
+
+#### **imageNamespace** ~ `string`
+> Default value:
+> ```yaml
+> jetstack
+> ```
+
+The repository namespace used for all cert-manager images by default.  
+Examples:  
+- jetstack  
+- cert-manager
+
 #### **image.registry** ~ `string`
 
-The container registry to pull the manager image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-controller
+> ```
+
+The image name for the cert-manager controller.  
+This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
 
 #### **image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-controller
+> ""
 > ```
 
-The container image for the cert-manager controller.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).  
+Example: quay.io/jetstack/cert-manager-controller
 
 #### **image.tag** ~ `string`
 
@@ -301,7 +340,7 @@
 
 #### **image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **image.pullPolicy** ~ `string`
 > Default value:
@@ -401,25 +440,21 @@
   kubernetesAPIBurst: 9000
   numberOfConcurrentWorkers: 200
   enableGatewayAPI: true
-  # Feature gates as of v1.18.1. Listed with their default values.
+  # Feature gates as of v1.20.0. Listed with their default values.
   # See https://cert-manager.io/docs/cli/controller/
   featureGates:
-    AdditionalCertificateOutputFormats: true # GA - default=true
     AllAlpha: false # ALPHA - default=false
     AllBeta: false # BETA - default=false
+    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
     ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
     ExperimentalGatewayAPISupport: true # BETA - default=true
     LiteralCertificateSubject: true # BETA - default=true
     NameConstraints: true # BETA - default=true
-    OtherNames: false # ALPHA - default=false
+    OtherNames: true # BETA - default=true
     SecretsFilteredCaching: true # BETA - default=true
     ServerSideApply: false # ALPHA - default=false
     StableCertificateRequestName: true # BETA - default=true
     UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-    UseDomainQualifiedFinalizer: true # GA - default=true
-    ValidateCAA: false # ALPHA - default=false
-    DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
-    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
   # Configure the metrics server for TLS
   # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
   metricsTLSConfig:
@@ -428,6 +463,13 @@
       secretName: "cert-manager-metrics-ca"
       dnsNames:
       - cert-manager-metrics
+  # Configure PEM size limits for certificate validation
+  # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+  pemSizeLimitsConfig:
+    maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)
+    maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)
+    maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)
+    maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)
 ```
 #### **dns01RecursiveNameservers** ~ `string`
 > Default value:
@@ -476,6 +518,43 @@
 extraArgs:
   - --controllers=*,-certificaterequests-approver
 ```
+#### **extraContainers** ~ `array`
+> Default value:
+> ```yaml
+> []
+> ```
+
+Extra containers to add to the pod spec in the deployment of the cert-manager controller. For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+
+```yaml
+extraEnv:
+  - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+  - value: http://127.0.0.1:9911
+extraContainers:
+  - name: rolesanywhere-credential-helper
+    image: public.ecr.aws/rolesanywhere/credential-helper:latest
+    command: [aws_signing_helper]
+    args:
+      - serve
+      - --private-key
+      - /etc/cert/tls.key
+      - --certificate
+      - /etc/cert/tls.crt
+      - --role-arn
+      - $ROLE_ARN
+      - --profile-arn
+      - $PROFILE_ARN
+      - --trust-anchor-arn
+      - $TRUST_ANCHOR_ARN
+    volumeMounts:
+      - name: cert
+        mountPath: /etc/cert/
+        readOnly: true
+volumes:
+  - name: cert
+    secret:
+      secretName: cert
+```
 #### **extraEnv** ~ `array`
 > Default value:
 > ```yaml
@@ -601,6 +680,45 @@
   
 This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
 
+#### **networkPolicy.enabled** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+Create network policies for cert-manager.
+#### **networkPolicy.ingress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: http-metrics
+>       protocol: TCP
+>     - port: http-healthz
+>       protocol: TCP
+> ```
+
+Ingress rule for the cert-manager network policy.  
+By default all pods are allowed access to:  
+  http-metrics and http-healthz ports
+
+#### **networkPolicy.egress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: 80
+>       protocol: TCP
+>     - port: 443
+>       protocol: TCP
+>     - port: 53
+>       protocol: TCP
+>     - port: 53
+>       protocol: UDP
+>     - port: 6443
+>       protocol: TCP
+> ```
+
+Egress rule for the cert-manager network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
+
 #### **ingressShim.defaultIssuerName** ~ `string`
 
 Optional default issuer to use for ingress resources.
@@ -1012,6 +1130,11 @@
 It cannot be used if `minAvailable` is set.
 
 
+#### **webhook.podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
 #### **webhook.deploymentAnnotations** ~ `object`
 
 Optional additional annotations to add to the webhook Deployment.
@@ -1221,15 +1344,28 @@
 Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
 #### **webhook.image.registry** ~ `string`
 
-The container registry to pull the webhook image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `webhook.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `webhook.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **webhook.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-webhook
+> ```
+
+The image name for the cert-manager webhook.
 
 #### **webhook.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-webhook
+> ""
 > ```
 
-The container image for the cert-manager webhook
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
 
 #### **webhook.image.tag** ~ `string`
 
@@ -1237,7 +1373,7 @@
 
 #### **webhook.image.digest** ~ `string`
 
-Setting a digest will override any tag
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **webhook.image.pullPolicy** ~ `string`
 > Default value:
@@ -1323,14 +1459,18 @@
 #### **webhook.networkPolicy.ingress** ~ `array`
 > Default value:
 > ```yaml
-> - from:
->     - ipBlock:
->         cidr: 0.0.0.0/0
->     - ipBlock:
->         cidr: ::/0
+> - ports:
+>     - port: https
+>       protocol: TCP
+>     - port: healthcheck
+>       protocol: TCP
+>     - port: http-metrics
+>       protocol: TCP
 > ```
 
-Ingress rule for the webhook network policy. By default, it allows all inbound traffic.
+Ingress rule for the webhook network policy.  
+By default all pods are allowed access to:  
+  https, http-metrics, and http-healthz ports
 
 #### **webhook.networkPolicy.egress** ~ `array`
 > Default value:
@@ -1346,11 +1486,6 @@
 >       protocol: UDP
 >     - port: 6443
 >       protocol: TCP
->   to:
->     - ipBlock:
->         cidr: 0.0.0.0/0
->     - ipBlock:
->         cidr: ::/0
 > ```
 
 Egress rule for the webhook network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1376,6 +1511,27 @@
 > ```
 
 enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.
+#### **webhook.enableClientVerification** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+enableClientVerification turns on client verification of requests made to the webhook server
+#### **webhook.clientCAFile** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+the client CA file to be used for verification
+#### **webhook.apiserverClientCertSubjects** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+Subject names to verify for the client certificate. Multiple values may be supplied as a comma-separated list.
 ### CA Injector
 
 #### **cainjector.enabled** ~ `bool`
@@ -1466,6 +1622,43 @@
 
 Container Security Context to be set on the cainjector component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
 
+#### **cainjector.networkPolicy.enabled** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+Create network policies for the cainjector.
+#### **cainjector.networkPolicy.ingress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: http-metrics
+>       protocol: TCP
+> ```
+
+Ingress rule for the webhook cainjector policy.  
+By default all pods are allowed access to:  
+  http-metrics port
+
+#### **cainjector.networkPolicy.egress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: 80
+>       protocol: TCP
+>     - port: 443
+>       protocol: TCP
+>     - port: 53
+>       protocol: TCP
+>     - port: 53
+>       protocol: UDP
+>     - port: 6443
+>       protocol: TCP
+> ```
+
+Egress rule for the cainjector network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
+
 #### **cainjector.podDisruptionBudget.enabled** ~ `bool`
 > Default value:
 > ```yaml
@@ -1490,6 +1683,11 @@
 Cannot be used if `minAvailable` is set.
 
 
+#### **cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
 #### **cainjector.deploymentAnnotations** ~ `object`
 
 Optional additional annotations to add to the cainjector Deployment.
@@ -1631,15 +1829,28 @@
 Optional additional labels to add to the CA Injector metrics Service.
 #### **cainjector.image.registry** ~ `string`
 
-The container registry to pull the cainjector image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `cainjector.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `cainjector.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **cainjector.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-cainjector
+> ```
+
+The image name for the cert-manager cainjector.
 
 #### **cainjector.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-cainjector
+> ""
 > ```
 
-The container image for the cert-manager cainjector
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
 
 #### **cainjector.image.tag** ~ `string`
 
@@ -1647,7 +1858,7 @@
 
 #### **cainjector.image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **cainjector.image.pullPolicy** ~ `string`
 > Default value:
@@ -1712,15 +1923,28 @@
 
 #### **acmesolver.image.registry** ~ `string`
 
-The container registry to pull the acmesolver image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `acmesolver.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `acmesolver.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **acmesolver.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-acmesolver
+> ```
+
+The image name for the cert-manager acmesolver.
 
 #### **acmesolver.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-acmesolver
+> ""
 > ```
 
-The container image for the cert-manager acmesolver.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
 
 #### **acmesolver.image.tag** ~ `string`
 
@@ -1728,7 +1952,7 @@
 
 #### **acmesolver.image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **acmesolver.image.pullPolicy** ~ `string`
 > Default value:
@@ -1895,15 +2119,28 @@
 Optional additional labels to add to the startupapicheck Pods.
 #### **startupapicheck.image.registry** ~ `string`
 
-The container registry to pull the startupapicheck image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `startupapicheck.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **startupapicheck.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-startupapicheck
+> ```
+
+The image name for the cert-manager startupapicheck.
 
 #### **startupapicheck.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-startupapicheck
+> ""
 > ```
 
-The container image for the cert-manager startupapicheck.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
 
 #### **startupapicheck.image.tag** ~ `string`
 
@@ -1911,7 +2148,7 @@
 
 #### **startupapicheck.image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **startupapicheck.image.pullPolicy** ~ `string`
 > Default value: