diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml
index 54257c7..4bd3ebf 100644
--- a/charts/cert-manager/values.yaml
+++ b/charts/cert-manager/values.yaml
@@ -21,7 +21,7 @@
   # If a component-specific nodeSelector is also set, it will be merged and take precedence.
   # +docs:property
   nodeSelector: {}
-  
+
   # Labels to apply to all resources.
   # Please note that this does not add labels to the resources created dynamically by the controllers.
   # For these resources, you have to add the labels in the template in the cert-manager custom resource:
@@ -153,6 +153,13 @@
   # +docs:type=unknown
   # maxUnavailable: 1
 
+  # This configures how to act with unhealthy pods during eviction
+  # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+  # the cluster to work.
+  # +docs:property
+  # +docs:type=string
+  # unhealthyPodEvictionPolicy: AlwaysAllow
+
 # A comma-separated list of feature gates that should be enabled on the
 # controller pod.
 featureGates: ""
@@ -160,21 +167,47 @@
 # The maximum number of challenges that can be scheduled as 'processing' at once.
 maxConcurrentChallenges: 60
 
-image:
-  # The container registry to pull the manager image from.
-  # +docs:property
-  # registry: quay.io
+# The container registry used for all cert-manager images by default.
+# This can include path prefixes (e.g. `artifactory.example.com/docker`).
+# +docs:property
+imageRegistry: quay.io
 
-  # The container image for the cert-manager controller.
+# The repository namespace used for all cert-manager images by default.
+# Examples:
+# - jetstack
+# - cert-manager
+# +docs:property
+imageNamespace: jetstack
+
+image:
+  # Deprecated: per-component registry prefix.
+  #
+  # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+  # This applies both when `image.repository` is set and when the repository is computed from
+  # `imageRegistry` + `imageNamespace` + `image.name`.
+  #
+  # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+  # Prefer using the global `imageRegistry`/`imageNamespace` values.
   # +docs:property
-  repository: quay.io/jetstack/cert-manager-controller
+  # registry: ""
+
+  # The image name for the cert-manager controller.
+  # This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
+  # +docs:property
+  name: cert-manager-controller
+
+  # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
+  # Example: quay.io/jetstack/cert-manager-controller
+  # +docs:property
+  repository: ""
 
   # Override the image tag to deploy by setting this variable.
   # If no value is set, the chart's appVersion is used.
   # +docs:property
   # tag: vX.Y.Z
 
-  # Setting a digest will override any tag.
+  # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+  # both ("image:tag@digest"), though only the digest will be used for pulling.
   # +docs:property
   # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -254,25 +287,21 @@
 #    kubernetesAPIBurst: 9000
 #    numberOfConcurrentWorkers: 200
 #    enableGatewayAPI: true
-#    # Feature gates as of v1.18.1. Listed with their default values.
+#    # Feature gates as of v1.20.0. Listed with their default values.
 #    # See https://cert-manager.io/docs/cli/controller/
 #    featureGates:
-#      AdditionalCertificateOutputFormats: true # GA - default=true
 #      AllAlpha: false # ALPHA - default=false
 #      AllBeta: false # BETA - default=false
+#      ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
 #      ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
 #      ExperimentalGatewayAPISupport: true # BETA - default=true
 #      LiteralCertificateSubject: true # BETA - default=true
 #      NameConstraints: true # BETA - default=true
-#      OtherNames: false # ALPHA - default=false
+#      OtherNames: true # BETA - default=true
 #      SecretsFilteredCaching: true # BETA - default=true
 #      ServerSideApply: false # ALPHA - default=false
 #      StableCertificateRequestName: true # BETA - default=true
 #      UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-#      UseDomainQualifiedFinalizer: true # GA - default=true
-#      ValidateCAA: false # ALPHA - default=false
-#      DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
-#      ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
 #    # Configure the metrics server for TLS
 #    # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
 #    metricsTLSConfig:
@@ -281,6 +310,13 @@
 #        secretName: "cert-manager-metrics-ca"
 #        dnsNames:
 #        - cert-manager-metrics
+#    # Configure PEM size limits for certificate validation
+#    # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+#    pemSizeLimitsConfig:
+#      maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)
+#      maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)
+#      maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)
+#      maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)
 config: {}
 
 # Setting Nameservers for DNS01 Self Check.
@@ -320,6 +356,38 @@
 #    - --controllers=*,-certificaterequests-approver
 extraArgs: []
 
+# Extra containers to add to the pod spec in the deployment of the cert-manager controller.
+# For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+#
+# extraEnv:
+#   - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+#   - value: http://127.0.0.1:9911
+# extraContainers:
+#   - name: rolesanywhere-credential-helper
+#     image: public.ecr.aws/rolesanywhere/credential-helper:latest
+#     command: [aws_signing_helper]
+#     args:
+#       - serve
+#       - --private-key
+#       - /etc/cert/tls.key
+#       - --certificate
+#       - /etc/cert/tls.crt
+#       - --role-arn
+#       - $ROLE_ARN
+#       - --profile-arn
+#       - $PROFILE_ARN
+#       - --trust-anchor-arn
+#       - $TRUST_ANCHOR_ARN
+#     volumeMounts:
+#       - name: cert
+#         mountPath: /etc/cert/
+#         readOnly: true
+# volumes:
+#   - name: cert
+#     secret:
+#       secretName: cert
+extraContainers: []
+
 # Additional environment variables to pass to cert-manager controller binary.
 # For example:
 #  extraEnv:
@@ -429,6 +497,45 @@
 nodeSelector:
   kubernetes.io/os: linux
 
+# Enables default network policies for cert-manager.
+# This provides a way for you to restrict network traffic
+# between cert-manager components and other pods.
+# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+# NOTE: an incorrect networkPolicy will cause traffic to be dropped
+networkPolicy:
+  # Create network policies for cert-manager.
+  enabled: false
+
+  # Ingress rule for the cert-manager network policy.
+  # By default all pods are allowed access to:
+  #   http-metrics and http-healthz ports
+  # +docs:property
+  ingress:
+  - ports:
+    - port: http-metrics
+      protocol: TCP
+    - port: http-healthz
+      protocol: TCP
+
+
+  # Egress rule for the cert-manager network policy. By default, it allows all
+  # outbound traffic to ports 80 and 443, as well as DNS ports.
+  # +docs:property
+  egress:
+  - ports:
+    - port: 80
+      protocol: TCP
+    - port: 443
+      protocol: TCP
+    - port: 53
+      protocol: TCP
+    - port: 53
+      protocol: UDP
+    # On OpenShift and OKD, the Kubernetes API server listens on.
+    # port 6443.
+    - port: 6443
+      protocol: TCP
+
 # +docs:ignore
 ingressShim: {}
 
@@ -744,6 +851,13 @@
     # +docs:type=unknown
     # maxUnavailable: 1
 
+    # This configures how to act with unhealthy pods during eviction
+    # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+    # the cluster to work.
+    # +docs:property
+    # +docs:type=string
+    # unhealthyPodEvictionPolicy: AlwaysAllow
+
   # Optional additional annotations to add to the webhook Deployment.
   # +docs:property
   # deploymentAnnotations: {}
@@ -896,20 +1010,32 @@
   serviceIPFamilies: []
 
   image:
-    # The container registry to pull the webhook image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `webhook.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `webhook.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager webhook
+    # The image name for the cert-manager webhook.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-webhook
+    name: cert-manager-webhook
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion will be used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -973,19 +1099,26 @@
     # host:
 
   # Enables default network policies for webhooks.
+  # This provides a way for you to restrict network traffic
+  # between cert-manager components and other pods.
+  # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+  # NOTE: an incorrect networkPolicy will cause traffic to be dropped
   networkPolicy:
     # Create network policies for the webhooks.
     enabled: false
 
-    # Ingress rule for the webhook network policy. By default, it allows all
-    # inbound traffic.
+    # Ingress rule for the webhook network policy.
+    # By default all pods are allowed access to:
+    #   https, http-metrics, and http-healthz ports
     # +docs:property
     ingress:
-    - from:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-      - ipBlock:
-          cidr: "::/0"
+    - ports:
+      - port: https
+        protocol: TCP
+      - port: healthcheck
+        protocol: TCP
+      - port: http-metrics
+        protocol: TCP
 
     # Egress rule for the webhook network policy. By default, it allows all
     # outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1004,11 +1137,6 @@
       # port 6443.
       - port: 6443
         protocol: TCP
-      to:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-      - ipBlock:
-          cidr: "::/0"
 
   # Additional volumes to add to the cert-manager controller pod.
   volumes: []
@@ -1021,6 +1149,15 @@
   # links.
   enableServiceLinks: false
 
+  # enableClientVerification turns on client verification of requests
+  # made to the webhook server
+  enableClientVerification: false
+  # the client CA file to be used for verification
+  clientCAFile: ""
+  # Subject names to verify for the client certificate.
+  # Multiple values may be supplied as a comma-separated list.
+  apiserverClientCertSubjects: ""
+
 # +docs:section=CA Injector
 
 cainjector:
@@ -1092,6 +1229,42 @@
       - ALL
     readOnlyRootFilesystem: true
 
+  # Enables default network policies for cainjector.
+  # This provides a way for you to restrict network traffic
+  # between cert-manager components and other pods.
+  # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+  # NOTE: an incorrect networkPolicy will cause traffic to be dropped
+  networkPolicy:
+    # Create network policies for the cainjector.
+    enabled: false
+
+    # Ingress rule for the webhook cainjector policy.
+    # By default all pods are allowed access to:
+    #   http-metrics port
+    # +docs:property
+    ingress:
+    - ports:
+      - port: http-metrics
+        protocol: TCP
+
+    # Egress rule for the cainjector network policy. By default, it allows all
+    # outbound traffic to ports 80 and 443, as well as DNS ports.
+    # +docs:property
+    egress:
+    - ports:
+      - port: 80
+        protocol: TCP
+      - port: 443
+        protocol: TCP
+      - port: 53
+        protocol: TCP
+      - port: 53
+        protocol: UDP
+      # On OpenShift and OKD, the Kubernetes API server listens on.
+      # port 6443.
+      - port: 6443
+        protocol: TCP
+
   podDisruptionBudget:
     # Enable or disable the PodDisruptionBudget resource.
     #
@@ -1115,6 +1288,13 @@
     # +docs:type=unknown
     # maxUnavailable: 1
 
+    # This configures how to act with unhealthy pods during eviction
+    # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+    # the cluster to work.
+    # +docs:property
+    # +docs:type=string
+    # unhealthyPodEvictionPolicy: AlwaysAllow
+
   # Optional additional annotations to add to the cainjector Deployment.
   # +docs:property
   # deploymentAnnotations: {}
@@ -1209,20 +1389,32 @@
   serviceLabels: {}
 
   image:
-    # The container registry to pull the cainjector image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `cainjector.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `cainjector.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager cainjector
+    # The image name for the cert-manager cainjector.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-cainjector
+    name: cert-manager-cainjector
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion will be used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag.
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -1268,20 +1460,32 @@
 
 acmesolver:
   image:
-    # The container registry to pull the acmesolver image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `acmesolver.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `acmesolver.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager acmesolver.
+    # The image name for the cert-manager acmesolver.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-acmesolver
+    name: cert-manager-acmesolver
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion is used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag.
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -1401,20 +1605,32 @@
   podLabels: {}
 
   image:
-    # The container registry to pull the startupapicheck image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `startupapicheck.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager startupapicheck.
+    # The image name for the cert-manager startupapicheck.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-startupapicheck
+    name: cert-manager-startupapicheck
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion is used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag.
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20