diff --git a/charts/cert-manager/values.schema.json b/charts/cert-manager/values.schema.json
index 7f90b6c..24e8b39 100644
--- a/charts/cert-manager/values.schema.json
+++ b/charts/cert-manager/values.schema.json
@@ -57,6 +57,9 @@
         "extraArgs": {
           "$ref": "#/$defs/helm-values.extraArgs"
         },
+        "extraContainers": {
+          "$ref": "#/$defs/helm-values.extraContainers"
+        },
         "extraEnv": {
           "$ref": "#/$defs/helm-values.extraEnv"
         },
@@ -84,6 +87,12 @@
         "image": {
           "$ref": "#/$defs/helm-values.image"
         },
+        "imageNamespace": {
+          "$ref": "#/$defs/helm-values.imageNamespace"
+        },
+        "imageRegistry": {
+          "$ref": "#/$defs/helm-values.imageRegistry"
+        },
         "ingressShim": {
           "$ref": "#/$defs/helm-values.ingressShim"
         },
@@ -102,6 +111,9 @@
         "namespace": {
           "$ref": "#/$defs/helm-values.namespace"
         },
+        "networkPolicy": {
+          "$ref": "#/$defs/helm-values.networkPolicy"
+        },
         "no_proxy": {
           "$ref": "#/$defs/helm-values.no_proxy"
         },
@@ -189,6 +201,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.acmesolver.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.acmesolver.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.acmesolver.image.pullPolicy"
         },
@@ -205,7 +220,12 @@
       "type": "object"
     },
     "helm-values.acmesolver.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.acmesolver.image.name": {
+      "default": "cert-manager-acmesolver",
+      "description": "The image name for the cert-manager acmesolver.",
       "type": "string"
     },
     "helm-values.acmesolver.image.pullPolicy": {
@@ -214,12 +234,12 @@
       "type": "string"
     },
     "helm-values.acmesolver.image.registry": {
-      "description": "The container registry to pull the acmesolver image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `acmesolver.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `acmesolver.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.acmesolver.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-acmesolver",
-      "description": "The container image for the cert-manager acmesolver.",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).",
       "type": "string"
     },
     "helm-values.acmesolver.image.tag": {
@@ -280,6 +300,9 @@
         "image": {
           "$ref": "#/$defs/helm-values.cainjector.image"
         },
+        "networkPolicy": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy"
+        },
         "nodeSelector": {
           "$ref": "#/$defs/helm-values.cainjector.nodeSelector"
         },
@@ -392,6 +415,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.cainjector.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.cainjector.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.cainjector.image.pullPolicy"
         },
@@ -408,7 +434,12 @@
       "type": "object"
     },
     "helm-values.cainjector.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.cainjector.image.name": {
+      "default": "cert-manager-cainjector",
+      "description": "The image name for the cert-manager cainjector.",
       "type": "string"
     },
     "helm-values.cainjector.image.pullPolicy": {
@@ -417,18 +448,84 @@
       "type": "string"
     },
     "helm-values.cainjector.image.registry": {
-      "description": "The container registry to pull the cainjector image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `cainjector.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `cainjector.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.cainjector.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-cainjector",
-      "description": "The container image for the cert-manager cainjector",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).",
       "type": "string"
     },
     "helm-values.cainjector.image.tag": {
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion will be used.",
       "type": "string"
     },
+    "helm-values.cainjector.networkPolicy": {
+      "additionalProperties": false,
+      "properties": {
+        "egress": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy.egress"
+        },
+        "enabled": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy.enabled"
+        },
+        "ingress": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy.ingress"
+        }
+      },
+      "type": "object"
+    },
+    "helm-values.cainjector.networkPolicy.egress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": 80,
+              "protocol": "TCP"
+            },
+            {
+              "port": 443,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "UDP"
+            },
+            {
+              "port": 6443,
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Egress rule for the cainjector network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.",
+      "items": {},
+      "type": "array"
+    },
+    "helm-values.cainjector.networkPolicy.enabled": {
+      "default": false,
+      "description": "Create network policies for the cainjector.",
+      "type": "boolean"
+    },
+    "helm-values.cainjector.networkPolicy.ingress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": "http-metrics",
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Ingress rule for the webhook cainjector policy.\nBy default all pods are allowed access to:\n  http-metrics port",
+      "items": {},
+      "type": "array"
+    },
     "helm-values.cainjector.nodeSelector": {
       "default": {
         "kubernetes.io/os": "linux"
@@ -451,6 +548,9 @@
         },
         "minAvailable": {
           "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.minAvailable"
+        },
+        "unhealthyPodEvictionPolicy": {
+          "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy"
         }
       },
       "type": "object"
@@ -466,6 +566,10 @@
     "helm-values.cainjector.podDisruptionBudget.minAvailable": {
       "description": "`minAvailable` configures the minimum available pods for disruptions. It can either be set to\nan integer (e.g., 1) or a percentage value (e.g., 25%).\nCannot be used if `maxUnavailable` is set."
     },
+    "helm-values.cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy": {
+      "description": "This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.",
+      "type": "string"
+    },
     "helm-values.cainjector.podLabels": {
       "default": {},
       "description": "Optional additional labels to add to the CA Injector Pods.",
@@ -579,7 +683,7 @@
     },
     "helm-values.config": {
       "default": {},
-      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.18.1. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AdditionalCertificateOutputFormats: true # GA - default=true\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: false # ALPHA - default=false\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n    UseDomainQualifiedFinalizer: true # GA - default=true\n    ValidateCAA: false # ALPHA - default=false\n    DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics",
+      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.20.0. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: true # BETA - default=true\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics\n  # Configure PEM size limits for certificate validation\n  # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)\n  pemSizeLimitsConfig:\n    maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)\n    maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)\n    maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)\n    maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)",
       "type": "object"
     },
     "helm-values.containerSecurityContext": {
@@ -662,6 +766,12 @@
       "items": {},
       "type": "array"
     },
+    "helm-values.extraContainers": {
+      "default": [],
+      "description": "Extra containers to add to the pod spec in the deployment of the cert-manager controller. For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):\nextraEnv:\n  - name: AWS_EC2_METADATA_SERVICE_ENDPOINT\n  - value: http://127.0.0.1:9911\nextraContainers:\n  - name: rolesanywhere-credential-helper\n    image: public.ecr.aws/rolesanywhere/credential-helper:latest\n    command: [aws_signing_helper]\n    args:\n      - serve\n      - --private-key\n      - /etc/cert/tls.key\n      - --certificate\n      - /etc/cert/tls.crt\n      - --role-arn\n      - $ROLE_ARN\n      - --profile-arn\n      - $PROFILE_ARN\n      - --trust-anchor-arn\n      - $TRUST_ANCHOR_ARN\n    volumeMounts:\n      - name: cert\n        mountPath: /etc/cert/\n        readOnly: true\nvolumes:\n  - name: cert\n    secret:\n      secretName: cert",
+      "items": {},
+      "type": "array"
+    },
     "helm-values.extraEnv": {
       "default": [],
       "description": "Additional environment variables to pass to cert-manager controller binary.\nFor example:\nextraEnv:\n- name: SOME_VAR\n  value: 'some value'",
@@ -849,6 +959,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.image.pullPolicy"
         },
@@ -865,7 +978,12 @@
       "type": "object"
     },
     "helm-values.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.image.name": {
+      "default": "cert-manager-controller",
+      "description": "The image name for the cert-manager controller.\nThis is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.",
       "type": "string"
     },
     "helm-values.image.pullPolicy": {
@@ -874,18 +992,28 @@
       "type": "string"
     },
     "helm-values.image.registry": {
-      "description": "The container registry to pull the manager image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-controller",
-      "description": "The container image for the cert-manager controller.",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).\nExample: quay.io/jetstack/cert-manager-controller",
       "type": "string"
     },
     "helm-values.image.tag": {
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
       "type": "string"
     },
+    "helm-values.imageNamespace": {
+      "default": "jetstack",
+      "description": "The repository namespace used for all cert-manager images by default.\nExamples:\n- jetstack\n- cert-manager",
+      "type": "string"
+    },
+    "helm-values.imageRegistry": {
+      "default": "quay.io",
+      "description": "The container registry used for all cert-manager images by default. This can include path prefixes (e.g. `artifactory.example.com/docker`).",
+      "type": "string"
+    },
     "helm-values.ingressShim": {
       "additionalProperties": false,
       "properties": {
@@ -944,6 +1072,76 @@
       "description": "This namespace allows you to define where the services are installed into. If not set then they use the namespace of the release. This is helpful when installing cert manager as a chart dependency (sub chart).",
       "type": "string"
     },
+    "helm-values.networkPolicy": {
+      "additionalProperties": false,
+      "properties": {
+        "egress": {
+          "$ref": "#/$defs/helm-values.networkPolicy.egress"
+        },
+        "enabled": {
+          "$ref": "#/$defs/helm-values.networkPolicy.enabled"
+        },
+        "ingress": {
+          "$ref": "#/$defs/helm-values.networkPolicy.ingress"
+        }
+      },
+      "type": "object"
+    },
+    "helm-values.networkPolicy.egress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": 80,
+              "protocol": "TCP"
+            },
+            {
+              "port": 443,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "UDP"
+            },
+            {
+              "port": 6443,
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Egress rule for the cert-manager network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.",
+      "items": {},
+      "type": "array"
+    },
+    "helm-values.networkPolicy.enabled": {
+      "default": false,
+      "description": "Create network policies for cert-manager.",
+      "type": "boolean"
+    },
+    "helm-values.networkPolicy.ingress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": "http-metrics",
+              "protocol": "TCP"
+            },
+            {
+              "port": "http-healthz",
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Ingress rule for the cert-manager network policy.\nBy default all pods are allowed access to:\n  http-metrics and http-healthz ports",
+      "items": {},
+      "type": "array"
+    },
     "helm-values.no_proxy": {
       "description": "Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.",
       "type": "string"
@@ -970,6 +1168,9 @@
         },
         "minAvailable": {
           "$ref": "#/$defs/helm-values.podDisruptionBudget.minAvailable"
+        },
+        "unhealthyPodEvictionPolicy": {
+          "$ref": "#/$defs/helm-values.podDisruptionBudget.unhealthyPodEvictionPolicy"
         }
       },
       "type": "object"
@@ -985,6 +1186,10 @@
     "helm-values.podDisruptionBudget.minAvailable": {
       "description": "This configures the minimum available pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `maxUnavailable` is set."
     },
+    "helm-values.podDisruptionBudget.unhealthyPodEvictionPolicy": {
+      "description": "This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.",
+      "type": "string"
+    },
     "helm-values.podDnsConfig": {
       "description": "Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy settings. However, when a Pod's dnsPolicy is set to \"None\", the dnsConfig field has to be specified. For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).",
       "type": "object"
@@ -1401,6 +1606,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.startupapicheck.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.startupapicheck.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.startupapicheck.image.pullPolicy"
         },
@@ -1417,7 +1625,12 @@
       "type": "object"
     },
     "helm-values.startupapicheck.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.startupapicheck.image.name": {
+      "default": "cert-manager-startupapicheck",
+      "description": "The image name for the cert-manager startupapicheck.",
       "type": "string"
     },
     "helm-values.startupapicheck.image.pullPolicy": {
@@ -1426,12 +1639,12 @@
       "type": "string"
     },
     "helm-values.startupapicheck.image.registry": {
-      "description": "The container registry to pull the startupapicheck image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `startupapicheck.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.startupapicheck.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-startupapicheck",
-      "description": "The container image for the cert-manager startupapicheck.",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).",
       "type": "string"
     },
     "helm-values.startupapicheck.image.tag": {
@@ -1602,9 +1815,15 @@
         "affinity": {
           "$ref": "#/$defs/helm-values.webhook.affinity"
         },
+        "apiserverClientCertSubjects": {
+          "$ref": "#/$defs/helm-values.webhook.apiserverClientCertSubjects"
+        },
         "automountServiceAccountToken": {
           "$ref": "#/$defs/helm-values.webhook.automountServiceAccountToken"
         },
+        "clientCAFile": {
+          "$ref": "#/$defs/helm-values.webhook.clientCAFile"
+        },
         "config": {
           "$ref": "#/$defs/helm-values.webhook.config"
         },
@@ -1614,6 +1833,9 @@
         "deploymentAnnotations": {
           "$ref": "#/$defs/helm-values.webhook.deploymentAnnotations"
         },
+        "enableClientVerification": {
+          "$ref": "#/$defs/helm-values.webhook.enableClientVerification"
+        },
         "enableServiceLinks": {
           "$ref": "#/$defs/helm-values.webhook.enableServiceLinks"
         },
@@ -1727,10 +1949,20 @@
       "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
       "type": "object"
     },
+    "helm-values.webhook.apiserverClientCertSubjects": {
+      "default": "",
+      "description": "Subject names to verify for the client certificate. Multiple values may be supplied as a comma-separated list.",
+      "type": "string"
+    },
     "helm-values.webhook.automountServiceAccountToken": {
       "description": "Automounting API credentials for a particular pod.",
       "type": "boolean"
     },
+    "helm-values.webhook.clientCAFile": {
+      "default": "",
+      "description": "the client CA file to be used for verification",
+      "type": "string"
+    },
     "helm-values.webhook.config": {
       "default": {},
       "description": "This is used to configure options for the webhook pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\napiVersion: webhook.config.cert-manager.io/v1alpha1\nkind: WebhookConfiguration\n# The port that the webhook listens on for requests.\n# In GKE private clusters, by default Kubernetes apiservers are allowed to\n# talk to the cluster nodes only on 443 and 10250. Configuring\n# securePort: 10250 therefore will work out-of-the-box without needing to add firewall\n# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.\n# This should be uncommented and set as a default by the chart once\n# the apiVersion of WebhookConfiguration graduates beyond v1alpha1.\nsecurePort: 10250\n# Configure the metrics server for TLS\n# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\nmetricsTLSConfig:\n  dynamic:\n    secretNamespace: \"cert-manager\"\n    secretName: \"cert-manager-metrics-ca\"\n    dnsNames:\n    - cert-manager-metrics",
@@ -1753,6 +1985,11 @@
       "description": "Optional additional annotations to add to the webhook Deployment.",
       "type": "object"
     },
+    "helm-values.webhook.enableClientVerification": {
+      "default": false,
+      "description": "enableClientVerification turns on client verification of requests made to the webhook server",
+      "type": "boolean"
+    },
     "helm-values.webhook.enableServiceLinks": {
       "default": false,
       "description": "enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.",
@@ -1786,6 +2023,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.webhook.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.webhook.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.webhook.image.pullPolicy"
         },
@@ -1802,7 +2042,12 @@
       "type": "object"
     },
     "helm-values.webhook.image.digest": {
-      "description": "Setting a digest will override any tag",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.webhook.image.name": {
+      "default": "cert-manager-webhook",
+      "description": "The image name for the cert-manager webhook.",
       "type": "string"
     },
     "helm-values.webhook.image.pullPolicy": {
@@ -1811,12 +2056,12 @@
       "type": "string"
     },
     "helm-values.webhook.image.registry": {
-      "description": "The container registry to pull the webhook image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `webhook.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `webhook.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.webhook.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-webhook",
-      "description": "The container image for the cert-manager webhook",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).",
       "type": "string"
     },
     "helm-values.webhook.image.tag": {
@@ -1895,18 +2140,6 @@
               "port": 6443,
               "protocol": "TCP"
             }
-          ],
-          "to": [
-            {
-              "ipBlock": {
-                "cidr": "0.0.0.0/0"
-              }
-            },
-            {
-              "ipBlock": {
-                "cidr": "::/0"
-              }
-            }
           ]
         }
       ],
@@ -1922,21 +2155,23 @@
     "helm-values.webhook.networkPolicy.ingress": {
       "default": [
         {
-          "from": [
+          "ports": [
             {
-              "ipBlock": {
-                "cidr": "0.0.0.0/0"
-              }
+              "port": "https",
+              "protocol": "TCP"
             },
             {
-              "ipBlock": {
-                "cidr": "::/0"
-              }
+              "port": "healthcheck",
+              "protocol": "TCP"
+            },
+            {
+              "port": "http-metrics",
+              "protocol": "TCP"
             }
           ]
         }
       ],
-      "description": "Ingress rule for the webhook network policy. By default, it allows all inbound traffic.",
+      "description": "Ingress rule for the webhook network policy.\nBy default all pods are allowed access to:\n  https, http-metrics, and http-healthz ports",
       "items": {},
       "type": "array"
     },
@@ -1962,6 +2197,9 @@
         },
         "minAvailable": {
           "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.minAvailable"
+        },
+        "unhealthyPodEvictionPolicy": {
+          "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.unhealthyPodEvictionPolicy"
         }
       },
       "type": "object"
@@ -1977,6 +2215,10 @@
     "helm-values.webhook.podDisruptionBudget.minAvailable": {
       "description": "This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `maxUnavailable` is set."
     },
+    "helm-values.webhook.podDisruptionBudget.unhealthyPodEvictionPolicy": {
+      "description": "This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.",
+      "type": "string"
+    },
     "helm-values.webhook.podLabels": {
       "default": {},
       "description": "Optional additional labels to add to the Webhook Pods.",