diff --git a/charts/cert-manager/Chart.yaml b/charts/cert-manager/Chart.yaml
index 013c394..b139024 100644
--- a/charts/cert-manager/Chart.yaml
+++ b/charts/cert-manager/Chart.yaml
@@ -6,7 +6,7 @@
     fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
     url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
 apiVersion: v2
-appVersion: v1.19.6
+appVersion: v1.20.3
 description: A Helm chart for cert-manager
 home: https://cert-manager.io
 icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
@@ -23,4 +23,4 @@
 name: cert-manager
 sources:
 - https://github.com/cert-manager/cert-manager
-version: v1.19.6
+version: v1.20.3
diff --git a/charts/cert-manager/README.md b/charts/cert-manager/README.md
index 872ba1d..bba0bc8 100644
--- a/charts/cert-manager/README.md
+++ b/charts/cert-manager/README.md
@@ -4,7 +4,7 @@
 
 cert-manager can obtain certificates from a [variety of certificate authorities](https://cert-manager.io/docs/configuration/issuers/), including:
 [Let's Encrypt](https://cert-manager.io/docs/configuration/acme/), [HashiCorp Vault](https://cert-manager.io/docs/configuration/vault/),
-[Venafi](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
+[CyberArk](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
 
 ## Prerequisites
 
@@ -26,7 +26,7 @@
   cert-manager jetstack/cert-manager \
   --namespace cert-manager \
   --create-namespace \
-  --version v1.19.6 \
+  --version v1.20.3 \
   --set crds.enabled=true
 ```
 
@@ -269,6 +269,11 @@
 This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%). it cannot be used if `minAvailable` is set.
 
 
+#### **podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
 #### **featureGates** ~ `string`
 > Default value:
 > ```yaml
@@ -283,17 +288,51 @@
 > ```
 
 The maximum number of challenges that can be scheduled as 'processing' at once.
+#### **imageRegistry** ~ `string`
+> Default value:
+> ```yaml
+> quay.io
+> ```
+
+The container registry used for all cert-manager images by default. This can include path prefixes (e.g. `artifactory.example.com/docker`).
+
+#### **imageNamespace** ~ `string`
+> Default value:
+> ```yaml
+> jetstack
+> ```
+
+The repository namespace used for all cert-manager images by default.  
+Examples:  
+- jetstack  
+- cert-manager
+
 #### **image.registry** ~ `string`
 
-The container registry to pull the manager image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-controller
+> ```
+
+The image name for the cert-manager controller.  
+This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
 
 #### **image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-controller
+> ""
 > ```
 
-The container image for the cert-manager controller.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).  
+Example: quay.io/jetstack/cert-manager-controller
 
 #### **image.tag** ~ `string`
 
@@ -301,7 +340,7 @@
 
 #### **image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **image.pullPolicy** ~ `string`
 > Default value:
@@ -401,25 +440,21 @@
   kubernetesAPIBurst: 9000
   numberOfConcurrentWorkers: 200
   enableGatewayAPI: true
-  # Feature gates as of v1.18.1. Listed with their default values.
+  # Feature gates as of v1.20.0. Listed with their default values.
   # See https://cert-manager.io/docs/cli/controller/
   featureGates:
-    AdditionalCertificateOutputFormats: true # GA - default=true
     AllAlpha: false # ALPHA - default=false
     AllBeta: false # BETA - default=false
+    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
     ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
     ExperimentalGatewayAPISupport: true # BETA - default=true
     LiteralCertificateSubject: true # BETA - default=true
     NameConstraints: true # BETA - default=true
-    OtherNames: false # ALPHA - default=false
+    OtherNames: true # BETA - default=true
     SecretsFilteredCaching: true # BETA - default=true
     ServerSideApply: false # ALPHA - default=false
     StableCertificateRequestName: true # BETA - default=true
     UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-    UseDomainQualifiedFinalizer: true # GA - default=true
-    ValidateCAA: false # ALPHA - default=false
-    DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
-    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
   # Configure the metrics server for TLS
   # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
   metricsTLSConfig:
@@ -428,6 +463,13 @@
       secretName: "cert-manager-metrics-ca"
       dnsNames:
       - cert-manager-metrics
+  # Configure PEM size limits for certificate validation
+  # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+  pemSizeLimitsConfig:
+    maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)
+    maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)
+    maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)
+    maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)
 ```
 #### **dns01RecursiveNameservers** ~ `string`
 > Default value:
@@ -476,6 +518,43 @@
 extraArgs:
   - --controllers=*,-certificaterequests-approver
 ```
+#### **extraContainers** ~ `array`
+> Default value:
+> ```yaml
+> []
+> ```
+
+Extra containers to add to the pod spec in the deployment of the cert-manager controller. For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+
+```yaml
+extraEnv:
+  - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+  - value: http://127.0.0.1:9911
+extraContainers:
+  - name: rolesanywhere-credential-helper
+    image: public.ecr.aws/rolesanywhere/credential-helper:latest
+    command: [aws_signing_helper]
+    args:
+      - serve
+      - --private-key
+      - /etc/cert/tls.key
+      - --certificate
+      - /etc/cert/tls.crt
+      - --role-arn
+      - $ROLE_ARN
+      - --profile-arn
+      - $PROFILE_ARN
+      - --trust-anchor-arn
+      - $TRUST_ANCHOR_ARN
+    volumeMounts:
+      - name: cert
+        mountPath: /etc/cert/
+        readOnly: true
+volumes:
+  - name: cert
+    secret:
+      secretName: cert
+```
 #### **extraEnv** ~ `array`
 > Default value:
 > ```yaml
@@ -601,6 +680,45 @@
   
 This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
 
+#### **networkPolicy.enabled** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+Create network policies for cert-manager.
+#### **networkPolicy.ingress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: http-metrics
+>       protocol: TCP
+>     - port: http-healthz
+>       protocol: TCP
+> ```
+
+Ingress rule for the cert-manager network policy.  
+By default all pods are allowed access to:  
+  http-metrics and http-healthz ports
+
+#### **networkPolicy.egress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: 80
+>       protocol: TCP
+>     - port: 443
+>       protocol: TCP
+>     - port: 53
+>       protocol: TCP
+>     - port: 53
+>       protocol: UDP
+>     - port: 6443
+>       protocol: TCP
+> ```
+
+Egress rule for the cert-manager network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
+
 #### **ingressShim.defaultIssuerName** ~ `string`
 
 Optional default issuer to use for ingress resources.
@@ -1012,6 +1130,11 @@
 It cannot be used if `minAvailable` is set.
 
 
+#### **webhook.podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
 #### **webhook.deploymentAnnotations** ~ `object`
 
 Optional additional annotations to add to the webhook Deployment.
@@ -1221,15 +1344,28 @@
 Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
 #### **webhook.image.registry** ~ `string`
 
-The container registry to pull the webhook image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `webhook.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `webhook.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **webhook.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-webhook
+> ```
+
+The image name for the cert-manager webhook.
 
 #### **webhook.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-webhook
+> ""
 > ```
 
-The container image for the cert-manager webhook
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
 
 #### **webhook.image.tag** ~ `string`
 
@@ -1237,7 +1373,7 @@
 
 #### **webhook.image.digest** ~ `string`
 
-Setting a digest will override any tag
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **webhook.image.pullPolicy** ~ `string`
 > Default value:
@@ -1323,14 +1459,18 @@
 #### **webhook.networkPolicy.ingress** ~ `array`
 > Default value:
 > ```yaml
-> - from:
->     - ipBlock:
->         cidr: 0.0.0.0/0
->     - ipBlock:
->         cidr: ::/0
+> - ports:
+>     - port: https
+>       protocol: TCP
+>     - port: healthcheck
+>       protocol: TCP
+>     - port: http-metrics
+>       protocol: TCP
 > ```
 
-Ingress rule for the webhook network policy. By default, it allows all inbound traffic.
+Ingress rule for the webhook network policy.  
+By default all pods are allowed access to:  
+  https, http-metrics, and http-healthz ports
 
 #### **webhook.networkPolicy.egress** ~ `array`
 > Default value:
@@ -1346,11 +1486,6 @@
 >       protocol: UDP
 >     - port: 6443
 >       protocol: TCP
->   to:
->     - ipBlock:
->         cidr: 0.0.0.0/0
->     - ipBlock:
->         cidr: ::/0
 > ```
 
 Egress rule for the webhook network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1376,6 +1511,27 @@
 > ```
 
 enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.
+#### **webhook.enableClientVerification** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+enableClientVerification turns on client verification of requests made to the webhook server
+#### **webhook.clientCAFile** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+the client CA file to be used for verification
+#### **webhook.apiserverClientCertSubjects** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+Subject names to verify for the client certificate. Multiple values may be supplied as a comma-separated list.
 ### CA Injector
 
 #### **cainjector.enabled** ~ `bool`
@@ -1466,6 +1622,43 @@
 
 Container Security Context to be set on the cainjector component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
 
+#### **cainjector.networkPolicy.enabled** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+Create network policies for the cainjector.
+#### **cainjector.networkPolicy.ingress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: http-metrics
+>       protocol: TCP
+> ```
+
+Ingress rule for the webhook cainjector policy.  
+By default all pods are allowed access to:  
+  http-metrics port
+
+#### **cainjector.networkPolicy.egress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+>     - port: 80
+>       protocol: TCP
+>     - port: 443
+>       protocol: TCP
+>     - port: 53
+>       protocol: TCP
+>     - port: 53
+>       protocol: UDP
+>     - port: 6443
+>       protocol: TCP
+> ```
+
+Egress rule for the cainjector network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
+
 #### **cainjector.podDisruptionBudget.enabled** ~ `bool`
 > Default value:
 > ```yaml
@@ -1490,6 +1683,11 @@
 Cannot be used if `minAvailable` is set.
 
 
+#### **cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
 #### **cainjector.deploymentAnnotations** ~ `object`
 
 Optional additional annotations to add to the cainjector Deployment.
@@ -1631,15 +1829,28 @@
 Optional additional labels to add to the CA Injector metrics Service.
 #### **cainjector.image.registry** ~ `string`
 
-The container registry to pull the cainjector image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `cainjector.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `cainjector.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **cainjector.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-cainjector
+> ```
+
+The image name for the cert-manager cainjector.
 
 #### **cainjector.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-cainjector
+> ""
 > ```
 
-The container image for the cert-manager cainjector
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
 
 #### **cainjector.image.tag** ~ `string`
 
@@ -1647,7 +1858,7 @@
 
 #### **cainjector.image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **cainjector.image.pullPolicy** ~ `string`
 > Default value:
@@ -1712,15 +1923,28 @@
 
 #### **acmesolver.image.registry** ~ `string`
 
-The container registry to pull the acmesolver image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `acmesolver.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `acmesolver.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **acmesolver.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-acmesolver
+> ```
+
+The image name for the cert-manager acmesolver.
 
 #### **acmesolver.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-acmesolver
+> ""
 > ```
 
-The container image for the cert-manager acmesolver.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
 
 #### **acmesolver.image.tag** ~ `string`
 
@@ -1728,7 +1952,7 @@
 
 #### **acmesolver.image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **acmesolver.image.pullPolicy** ~ `string`
 > Default value:
@@ -1895,15 +2119,28 @@
 Optional additional labels to add to the startupapicheck Pods.
 #### **startupapicheck.image.registry** ~ `string`
 
-The container registry to pull the startupapicheck image from.
+Deprecated: per-component registry prefix.  
+  
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `startupapicheck.image.repository` is set and when the repository is computed from  
+`imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.  
+  
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **startupapicheck.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-startupapicheck
+> ```
+
+The image name for the cert-manager startupapicheck.
 
 #### **startupapicheck.image.repository** ~ `string`
 > Default value:
 > ```yaml
-> quay.io/jetstack/cert-manager-startupapicheck
+> ""
 > ```
 
-The container image for the cert-manager startupapicheck.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
 
 #### **startupapicheck.image.tag** ~ `string`
 
@@ -1911,7 +2148,7 @@
 
 #### **startupapicheck.image.digest** ~ `string`
 
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
 
 #### **startupapicheck.image.pullPolicy** ~ `string`
 > Default value:
diff --git a/charts/cert-manager/templates/NOTES.txt b/charts/cert-manager/templates/NOTES.txt
index 4d0b4b6..d5d705c 100644
--- a/charts/cert-manager/templates/NOTES.txt
+++ b/charts/cert-manager/templates/NOTES.txt
@@ -2,11 +2,10 @@
 ⚠️  WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
 
 {{- end }}
-⚠️  WARNING: New default private key rotation policy for Certificate resources.
-The default private key rotation policy for Certificate resources was
-changed to `Always` in cert-manager >= v1.18.0.
-Learn more in the [1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18).
+{{- if or .Values.image.registry .Values.webhook.image.registry .Values.cainjector.image.registry .Values.startupapicheck.image.registry .Values.acmesolver.image.registry }}
+⚠️  WARNING: `*.image.registry` is deprecated. Prefer using the global `imageRegistry` value.
 
+{{- end }}
 cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
 
 In order to begin issuing certificates, you will need to set up a ClusterIssuer
@@ -22,3 +21,9 @@
 documentation:
 
 https://cert-manager.io/docs/usage/ingress/
+
+For information on how to configure cert-manager to automatically provision
+Certificates for Gateway API resources, take a look at the `gateway resource`
+documentation:
+
+https://cert-manager.io/docs/usage/gateway/
diff --git a/charts/cert-manager/templates/_helpers.tpl b/charts/cert-manager/templates/_helpers.tpl
index f85373f..c58adeb 100644
--- a/charts/cert-manager/templates/_helpers.tpl
+++ b/charts/cert-manager/templates/_helpers.tpl
@@ -180,11 +180,65 @@
 See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
 */}}
 {{- define "image" -}}
-{{- $defaultTag := index . 1 -}}
-{{- with index . 0 -}}
-{{- if .registry -}}{{ printf "%s/%s" .registry .repository }}{{- else -}}{{- .repository -}}{{- end -}}
-{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
-{{- end }}
+{{- /*
+Calling convention:
+
+- (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>)
+
+We intentionally pass imageRegistry/imageNamespace as explicit arguments rather than reading
+from `.Values` inside this helper, because `helm-tool lint` does not reliably track `.Values.*`
+usage through tuple/variable indirection.
+*/ -}}
+
+{{- if ne (len .) 4 -}}
+    {{- fail (printf "ERROR: template \"image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
+{{- end -}}
+
+{{- $image := index . 0 -}}
+{{- $imageRegistry := index . 1 | default "" -}}
+{{- $imageNamespace := index . 2 | default "" -}}
+{{- $defaultReference := index . 3 -}}
+
+{{- $repository := "" -}}
+{{- if $image.repository -}}
+    {{- $repository = $image.repository -}}
+
+    {{- /*
+        Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
+    */ -}}
+    {{- if $image.registry -}}
+        {{- $repository = printf "%s/%s" $image.registry $repository -}}
+    {{- end -}}
+{{- else -}}
+    {{- $name := required "ERROR: image.name must be set when image.repository is empty" $image.name -}}
+    {{- $repository = $name -}}
+
+    {{- if $imageNamespace -}}
+        {{- $repository = printf "%s/%s" $imageNamespace $repository -}}
+    {{- end -}}
+
+    {{- if $imageRegistry -}}
+        {{- $repository = printf "%s/%s" $imageRegistry $repository -}}
+    {{- end -}}
+
+    {{- /*
+        Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
+    */ -}}
+    {{- if $image.registry -}}
+        {{- $repository = printf "%s/%s" $image.registry $repository -}}
+    {{- end -}}
+{{- end -}}
+
+{{- $repository -}}
+{{- if and $image.tag $image.digest -}}
+    {{- printf ":%s@%s" $image.tag $image.digest -}}
+{{- else if $image.tag -}}
+    {{- printf ":%s" $image.tag -}}
+{{- else if $image.digest -}}
+    {{- printf "@%s" $image.digest -}}
+{{- else -}}
+    {{- printf "%s" $defaultReference -}}
+{{- end -}}
 {{- end }}
 
 {{/*
diff --git a/charts/cert-manager/templates/cainjector-deployment.yaml b/charts/cert-manager/templates/cainjector-deployment.yaml
index b5434ca..89f6afe 100644
--- a/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -76,7 +76,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-cainjector
-          image: "{{ template "image" (tuple .Values.cainjector.image $.Chart.AppVersion) }}"
+          image: "{{ template "image" (tuple .Values.cainjector.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
           args:
           {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
diff --git a/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml b/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
index 6a7d609..65c67bd 100644
--- a/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
+++ b/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
@@ -26,4 +26,7 @@
   {{- if hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable" }}
   maxUnavailable: {{ .Values.cainjector.podDisruptionBudget.maxUnavailable }}
   {{- end }}
+  {{- with .Values.cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ . }}
+  {{- end }}
 {{- end }}
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
index 39705f2..039062d 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -283,6 +283,22 @@
                                 The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
                                 If set, ClientID and ClientSecret must also be set.
                               type: string
+                            zoneType:
+                              description: |-
+                                ZoneType determines which type of Azure DNS zone to use.
+
+                                Valid values are:
+                                  - AzurePublicZone  (default): Use a public Azure DNS zone.
+                                  - AzurePrivateZone: Use an Azure Private DNS zone.
+
+                                If not specified, AzurePublicZone is used.
+
+                                Support for Azure Private DNS zones is currently
+                                experimental and may change in future releases.
+                              enum:
+                                - AzurePublicZone
+                                - AzurePrivateZone
+                              type: string
                           required:
                             - resourceGroupName
                             - subscriptionID
@@ -456,8 +472,8 @@
                               description: |-
                                 The AccessKeyID is used for authentication.
                                 Cannot be set when SecretAccessKeyID is set.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
+                                If neither the Access Key nor Key ID are set, we fall back to using env
+                                vars, shared credentials file, or AWS Instance metadata,
                                 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                               type: string
                             accessKeyIDSecretRef:
@@ -465,8 +481,8 @@
                                 The SecretAccessKey is used for authentication. If set, pull the AWS
                                 access key ID from a key within a Kubernetes Secret.
                                 Cannot be set when AccessKeyID is set.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
+                                If neither the Access Key nor Key ID are set, we fall back to using env
+                                vars, shared credentials file, or AWS Instance metadata,
                                 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                               properties:
                                 key:
@@ -555,8 +571,8 @@
                             secretAccessKeySecretRef:
                               description: |-
                                 The SecretAccessKey is used for authentication.
-                                If neither the Access Key nor Key ID are set, we fall-back to using env
-                                vars, shared credentials file or AWS Instance metadata,
+                                If neither the Access Key nor Key ID are set, we fall back to using env
+                                vars, shared credentials file, or AWS Instance metadata,
                                 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                               properties:
                                 key:
@@ -1913,9 +1929,10 @@
                                           operator:
                                             description: |-
                                               Operator represents a key's relationship to the value.
-                                              Valid operators are Exists and Equal. Defaults to Equal.
+                                              Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                               Exists is equivalent to wildcard for value, so that a pod can
                                               tolerate all taints of a particular category.
+                                              Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                             type: string
                                           tolerationSeconds:
                                             description: |-
@@ -3124,9 +3141,10 @@
                                           operator:
                                             description: |-
                                               Operator represents a key's relationship to the value.
-                                              Valid operators are Exists and Equal. Defaults to Equal.
+                                              Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                               Exists is equivalent to wildcard for value, so that a pod can
                                               tolerate all taints of a particular category.
+                                              Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                             type: string
                                           tolerationSeconds:
                                             description: |-
@@ -3274,6 +3292,10 @@
             - metadata
             - spec
           type: object
+      selectableFields:
+        - jsonPath: .spec.issuerRef.group
+        - jsonPath: .spec.issuerRef.kind
+        - jsonPath: .spec.issuerRef.name
       served: true
       storage: true
       subresources:
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
index 3242fc4..59596e7 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
@@ -267,6 +267,10 @@
             - metadata
             - spec
           type: object
+      selectableFields:
+        - jsonPath: .spec.issuerRef.group
+        - jsonPath: .spec.issuerRef.kind
+        - jsonPath: .spec.issuerRef.name
       served: true
       storage: true
       subresources:
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
index e25ad1d..2b54283 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
@@ -312,6 +312,10 @@
                   type: string
               type: object
           type: object
+      selectableFields:
+        - jsonPath: .spec.issuerRef.group
+        - jsonPath: .spec.issuerRef.kind
+        - jsonPath: .spec.issuerRef.name
       served: true
       storage: true
       subresources:
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
index 6689de6..7ebc08e 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
@@ -451,9 +451,6 @@
                         will be generated whenever a re-issuance occurs.
                         Default is `Always`.
                         The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
-                        The new default can be disabled by setting the
-                        `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
-                        the controller component.
                       enum:
                         - Never
                         - Always
@@ -809,6 +806,10 @@
                   type: integer
               type: object
           type: object
+      selectableFields:
+        - jsonPath: .spec.issuerRef.group
+        - jsonPath: .spec.issuerRef.kind
+        - jsonPath: .spec.issuerRef.name
       served: true
       storage: true
       subresources:
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
index a9ecd4f..f5de226 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -396,6 +396,22 @@
                                       The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
                                       If set, ClientID and ClientSecret must also be set.
                                     type: string
+                                  zoneType:
+                                    description: |-
+                                      ZoneType determines which type of Azure DNS zone to use.
+
+                                      Valid values are:
+                                        - AzurePublicZone  (default): Use a public Azure DNS zone.
+                                        - AzurePrivateZone: Use an Azure Private DNS zone.
+
+                                      If not specified, AzurePublicZone is used.
+
+                                      Support for Azure Private DNS zones is currently
+                                      experimental and may change in future releases.
+                                    enum:
+                                      - AzurePublicZone
+                                      - AzurePrivateZone
+                                    type: string
                                 required:
                                   - resourceGroupName
                                   - subscriptionID
@@ -569,8 +585,8 @@
                                     description: |-
                                       The AccessKeyID is used for authentication.
                                       Cannot be set when SecretAccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
+                                      If neither the Access Key nor Key ID are set, we fall back to using env
+                                      vars, shared credentials file, or AWS Instance metadata,
                                       see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                     type: string
                                   accessKeyIDSecretRef:
@@ -578,8 +594,8 @@
                                       The SecretAccessKey is used for authentication. If set, pull the AWS
                                       access key ID from a key within a Kubernetes Secret.
                                       Cannot be set when AccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
+                                      If neither the Access Key nor Key ID are set, we fall back to using env
+                                      vars, shared credentials file, or AWS Instance metadata,
                                       see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                     properties:
                                       key:
@@ -668,8 +684,8 @@
                                   secretAccessKeySecretRef:
                                     description: |-
                                       The SecretAccessKey is used for authentication.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
+                                      If neither the Access Key nor Key ID are set, we fall back to using env
+                                      vars, shared credentials file, or AWS Instance metadata,
                                       see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                     properties:
                                       key:
@@ -2026,9 +2042,10 @@
                                                 operator:
                                                   description: |-
                                                     Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                                     Exists is equivalent to wildcard for value, so that a pod can
                                                     tolerate all taints of a particular category.
+                                                    Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                                   type: string
                                                 tolerationSeconds:
                                                   description: |-
@@ -3237,9 +3254,10 @@
                                                 operator:
                                                   description: |-
                                                     Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                                     Exists is equivalent to wildcard for value, so that a pod can
                                                     tolerate all taints of a particular category.
+                                                    Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                                   type: string
                                                 tolerationSeconds:
                                                   description: |-
@@ -3496,8 +3514,8 @@
                               properties:
                                 audiences:
                                   description: |-
-                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
-                                    consisting of the issuer's namespace and name is always included.
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+                                    The default audiences are always included in the token.
                                   items:
                                     type: string
                                   type: array
@@ -3625,16 +3643,16 @@
                   type: object
                 venafi:
                   description: |-
-                    Venafi configures this issuer to sign certificates using a Venafi TPP
-                    or Venafi Cloud policy zone.
+                    Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted
+                    or SaaS policy zone.
                   properties:
                     cloud:
                       description: |-
-                        Cloud specifies the Venafi cloud configuration settings.
-                        Only one of TPP or Cloud may be specified.
+                        Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
+                        Only one of CyberArk Certificate Manager may be specified.
                       properties:
                         apiTokenSecretRef:
-                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+                          description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.
                           properties:
                             key:
                               description: |-
@@ -3652,7 +3670,7 @@
                           type: object
                         url:
                           description: |-
-                            URL is the base URL for Venafi Cloud.
+                            URL is the base URL for CyberArk Certificate Manager SaaS.
                             Defaults to "https://api.venafi.cloud/".
                           type: string
                       required:
@@ -3660,13 +3678,13 @@
                       type: object
                     tpp:
                       description: |-
-                        TPP specifies Trust Protection Platform configuration settings.
-                        Only one of TPP or Cloud may be specified.
+                        TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
+                        Only one of CyberArk Certificate Manager may be specified.
                       properties:
                         caBundle:
                           description: |-
                             Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+                            chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.
                             If undefined, the certificate bundle in the cert-manager controller container
                             is used to validate the chain.
                           format: byte
@@ -3674,7 +3692,7 @@
                         caBundleSecretRef:
                           description: |-
                             Reference to a Secret containing a base64-encoded bundle of PEM CAs
-                            which will be used to validate the certificate chain presented by the TPP server.
+                            which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.
                             Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
                             If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
                             the cert-manager controller container is used to validate the TLS connection.
@@ -3695,7 +3713,7 @@
                           type: object
                         credentialsRef:
                           description: |-
-                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+                            CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
                             The secret must contain the key 'access-token' for the Access Token Authentication,
                             or two keys, 'username' and 'password' for the API Keys Authentication.
                           properties:
@@ -3709,7 +3727,7 @@
                           type: object
                         url:
                           description: |-
-                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+                            URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,
                             for example: "https://tpp.example.com/vedsdk".
                           type: string
                       required:
@@ -3718,8 +3736,8 @@
                       type: object
                     zone:
                       description: |-
-                        Zone is the Venafi Policy Zone to use for this issuer.
-                        All requests made to the Venafi platform will be restricted by the named
+                        Zone is the Certificate Manager Policy Zone to use for this issuer.
+                        All requests made to the Certificate Manager platform will be restricted by the named
                         zone policy.
                         This field is required.
                       type: string
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
index c88b318..68a2dd0 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
@@ -395,6 +395,22 @@
                                       The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
                                       If set, ClientID and ClientSecret must also be set.
                                     type: string
+                                  zoneType:
+                                    description: |-
+                                      ZoneType determines which type of Azure DNS zone to use.
+
+                                      Valid values are:
+                                        - AzurePublicZone  (default): Use a public Azure DNS zone.
+                                        - AzurePrivateZone: Use an Azure Private DNS zone.
+
+                                      If not specified, AzurePublicZone is used.
+
+                                      Support for Azure Private DNS zones is currently
+                                      experimental and may change in future releases.
+                                    enum:
+                                      - AzurePublicZone
+                                      - AzurePrivateZone
+                                    type: string
                                 required:
                                   - resourceGroupName
                                   - subscriptionID
@@ -568,8 +584,8 @@
                                     description: |-
                                       The AccessKeyID is used for authentication.
                                       Cannot be set when SecretAccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
+                                      If neither the Access Key nor Key ID are set, we fall back to using env
+                                      vars, shared credentials file, or AWS Instance metadata,
                                       see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                     type: string
                                   accessKeyIDSecretRef:
@@ -577,8 +593,8 @@
                                       The SecretAccessKey is used for authentication. If set, pull the AWS
                                       access key ID from a key within a Kubernetes Secret.
                                       Cannot be set when AccessKeyID is set.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
+                                      If neither the Access Key nor Key ID are set, we fall back to using env
+                                      vars, shared credentials file, or AWS Instance metadata,
                                       see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                     properties:
                                       key:
@@ -667,8 +683,8 @@
                                   secretAccessKeySecretRef:
                                     description: |-
                                       The SecretAccessKey is used for authentication.
-                                      If neither the Access Key nor Key ID are set, we fall-back to using env
-                                      vars, shared credentials file or AWS Instance metadata,
+                                      If neither the Access Key nor Key ID are set, we fall back to using env
+                                      vars, shared credentials file, or AWS Instance metadata,
                                       see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                     properties:
                                       key:
@@ -2025,9 +2041,10 @@
                                                 operator:
                                                   description: |-
                                                     Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                                     Exists is equivalent to wildcard for value, so that a pod can
                                                     tolerate all taints of a particular category.
+                                                    Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                                   type: string
                                                 tolerationSeconds:
                                                   description: |-
@@ -3236,9 +3253,10 @@
                                                 operator:
                                                   description: |-
                                                     Operator represents a key's relationship to the value.
-                                                    Valid operators are Exists and Equal. Defaults to Equal.
+                                                    Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                                     Exists is equivalent to wildcard for value, so that a pod can
                                                     tolerate all taints of a particular category.
+                                                    Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                                   type: string
                                                 tolerationSeconds:
                                                   description: |-
@@ -3495,8 +3513,8 @@
                               properties:
                                 audiences:
                                   description: |-
-                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
-                                    consisting of the issuer's namespace and name is always included.
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+                                    The default audiences are always included in the token.
                                   items:
                                     type: string
                                   type: array
@@ -3624,16 +3642,16 @@
                   type: object
                 venafi:
                   description: |-
-                    Venafi configures this issuer to sign certificates using a Venafi TPP
-                    or Venafi Cloud policy zone.
+                    Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted
+                    or SaaS policy zone.
                   properties:
                     cloud:
                       description: |-
-                        Cloud specifies the Venafi cloud configuration settings.
-                        Only one of TPP or Cloud may be specified.
+                        Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
+                        Only one of CyberArk Certificate Manager may be specified.
                       properties:
                         apiTokenSecretRef:
-                          description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+                          description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.
                           properties:
                             key:
                               description: |-
@@ -3651,7 +3669,7 @@
                           type: object
                         url:
                           description: |-
-                            URL is the base URL for Venafi Cloud.
+                            URL is the base URL for CyberArk Certificate Manager SaaS.
                             Defaults to "https://api.venafi.cloud/".
                           type: string
                       required:
@@ -3659,13 +3677,13 @@
                       type: object
                     tpp:
                       description: |-
-                        TPP specifies Trust Protection Platform configuration settings.
-                        Only one of TPP or Cloud may be specified.
+                        TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
+                        Only one of CyberArk Certificate Manager may be specified.
                       properties:
                         caBundle:
                           description: |-
                             Base64-encoded bundle of PEM CAs which will be used to validate the certificate
-                            chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+                            chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.
                             If undefined, the certificate bundle in the cert-manager controller container
                             is used to validate the chain.
                           format: byte
@@ -3673,7 +3691,7 @@
                         caBundleSecretRef:
                           description: |-
                             Reference to a Secret containing a base64-encoded bundle of PEM CAs
-                            which will be used to validate the certificate chain presented by the TPP server.
+                            which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.
                             Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
                             If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
                             the cert-manager controller container is used to validate the TLS connection.
@@ -3694,7 +3712,7 @@
                           type: object
                         credentialsRef:
                           description: |-
-                            CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+                            CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
                             The secret must contain the key 'access-token' for the Access Token Authentication,
                             or two keys, 'username' and 'password' for the API Keys Authentication.
                           properties:
@@ -3708,7 +3726,7 @@
                           type: object
                         url:
                           description: |-
-                            URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+                            URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,
                             for example: "https://tpp.example.com/vedsdk".
                           type: string
                       required:
@@ -3717,8 +3735,8 @@
                       type: object
                     zone:
                       description: |-
-                        Zone is the Venafi Policy Zone to use for this issuer.
-                        All requests made to the Venafi platform will be restricted by the named
+                        Zone is the Certificate Manager Policy Zone to use for this issuer.
+                        All requests made to the Certificate Manager platform will be restricted by the named
                         zone policy.
                         This field is required.
                       type: string
diff --git a/charts/cert-manager/templates/deployment.yaml b/charts/cert-manager/templates/deployment.yaml
index 453e823..c4d267a 100644
--- a/charts/cert-manager/templates/deployment.yaml
+++ b/charts/cert-manager/templates/deployment.yaml
@@ -67,7 +67,7 @@
       priorityClassName: {{ . | quote }}
       {{- end }}
       {{- if (hasKey .Values.global "hostUsers") }}
-      hostUsers: {{ .Values.global.hostUsers }}       
+      hostUsers: {{ .Values.global.hostUsers }}
       {{- end }}
       {{- with .Values.securityContext }}
       securityContext:
@@ -76,8 +76,8 @@
       {{- if or .Values.volumes .Values.config}}
       volumes:
         {{- if .Values.config }}
-        - name: config 
-          configMap: 
+        - name: config
+          configMap:
             name: {{ include "cert-manager.fullname" . }}
         {{- end }}
         {{ with .Values.volumes }}
@@ -86,7 +86,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-controller
-          image: "{{ template "image" (tuple .Values.image $.Chart.AppVersion) }}"
+          image: "{{ template "image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
           {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -114,9 +114,7 @@
           - --leader-election-retry-period={{ .retryPeriod }}
           {{- end }}
           {{- end }}
-          {{- with .Values.acmesolver.image }}
-          - --acme-http01-solver-image={{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}
-          {{- end }}
+          - --acme-http01-solver-image={{ template "image" (tuple .Values.acmesolver.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}
           {{- with .Values.extraArgs }}
           {{- toYaml . | nindent 10 }}
           {{- end }}
@@ -163,7 +161,7 @@
           {{- if or .Values.config .Values.volumeMounts }}
           volumeMounts:
             {{- if .Values.config }}
-            - name: config 
+            - name: config
               mountPath: /var/cert-manager/config
             {{- end }}
             {{- with .Values.volumeMounts }}
@@ -212,6 +210,9 @@
             failureThreshold: {{ .failureThreshold }}
           {{- end }}
           {{- end }}
+      {{- if .Values.extraContainers }}
+        {{- toYaml .Values.extraContainers | nindent 8 }}
+      {{- end }}
       {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
       {{- $nodeSelector = merge $nodeSelector (.Values.nodeSelector | default dict) }}
       {{- with $nodeSelector }}
diff --git a/charts/cert-manager/templates/networkpolicy-cainjector.yaml b/charts/cert-manager/templates/networkpolicy-cainjector.yaml
new file mode 100644
index 0000000..f5a82e5
--- /dev/null
+++ b/charts/cert-manager/templates/networkpolicy-cainjector.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.cainjector.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "cainjector.fullname" . }}-allow-ingress
+  namespace: {{ include "cert-manager.namespace" . }}
+spec:
+  ingress:
+    {{- with .Values.cainjector.networkPolicy.ingress }}
+      {{- toYaml . | nindent 2 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "cainjector.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: "cainjector"
+  policyTypes:
+  - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "cainjector.fullname" . }}-allow-egress
+  namespace: {{ include "cert-manager.namespace" . }}
+spec:
+  egress:
+    {{- with .Values.cainjector.networkPolicy.egress }}
+      {{- toYaml . | nindent 2 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "cainjector.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: "cainjector"
+  policyTypes:
+  - Egress
+{{- end }}
diff --git a/charts/cert-manager/templates/networkpolicy-cert-manager.yaml b/charts/cert-manager/templates/networkpolicy-cert-manager.yaml
new file mode 100644
index 0000000..410c15d
--- /dev/null
+++ b/charts/cert-manager/templates/networkpolicy-cert-manager.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "cert-manager.fullname" . }}-allow-ingress
+  namespace: {{ include "cert-manager.namespace" . }}
+spec:
+  ingress:
+    {{- with .Values.networkPolicy.ingress }}
+      {{- toYaml . | nindent 2 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: "controller"
+  policyTypes:
+  - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "cert-manager.fullname" . }}-allow-egress
+  namespace: {{ include "cert-manager.namespace" . }}
+spec:
+  egress:
+    {{- with .Values.networkPolicy.egress }}
+      {{- toYaml . | nindent 2 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: "controller"
+  policyTypes:
+  - Egress
+{{- end }}
diff --git a/charts/cert-manager/templates/networkpolicy-egress.yaml b/charts/cert-manager/templates/networkpolicy-egress.yaml
deleted file mode 100644
index 37f90bd..0000000
--- a/charts/cert-manager/templates/networkpolicy-egress.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.webhook.networkPolicy.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: {{ template "webhook.fullname" . }}-allow-egress
-  namespace: {{ include "cert-manager.namespace" . }}
-spec:
-  egress:
-    {{- with .Values.webhook.networkPolicy.egress }}
-      {{- toYaml . | nindent 2 }}
-    {{- end }}
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: {{ include "webhook.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
-      app.kubernetes.io/component: "webhook"
-  policyTypes:
-  - Egress
-{{- end }}
diff --git a/charts/cert-manager/templates/networkpolicy-webhooks.yaml b/charts/cert-manager/templates/networkpolicy-webhooks.yaml
index 3a0ed7a..7377117 100644
--- a/charts/cert-manager/templates/networkpolicy-webhooks.yaml
+++ b/charts/cert-manager/templates/networkpolicy-webhooks.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.webhook.networkPolicy.enabled }}
-
+---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -17,5 +17,22 @@
       app.kubernetes.io/component: "webhook"
   policyTypes:
   - Ingress
-
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "webhook.fullname" . }}-allow-egress
+  namespace: {{ include "cert-manager.namespace" . }}
+spec:
+  egress:
+    {{- with .Values.webhook.networkPolicy.egress }}
+      {{- toYaml . | nindent 2 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "webhook.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: "webhook"
+  policyTypes:
+  - Egress
 {{- end }}
diff --git a/charts/cert-manager/templates/poddisruptionbudget.yaml b/charts/cert-manager/templates/poddisruptionbudget.yaml
index ae71eed..107dd72 100644
--- a/charts/cert-manager/templates/poddisruptionbudget.yaml
+++ b/charts/cert-manager/templates/poddisruptionbudget.yaml
@@ -26,4 +26,7 @@
   {{- if hasKey .Values.podDisruptionBudget "maxUnavailable" }}
   maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
   {{- end }}
+  {{- with .Values.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ . }}
+  {{- end }}
 {{- end }}
diff --git a/charts/cert-manager/templates/podmonitor.yaml b/charts/cert-manager/templates/podmonitor.yaml
index 83f7e1e..72d2dfe 100644
--- a/charts/cert-manager/templates/podmonitor.yaml
+++ b/charts/cert-manager/templates/podmonitor.yaml
@@ -27,7 +27,7 @@
     {{- end }}
 {{- end }}
 spec:
-  jobLabel: {{ template "cert-manager.fullname" . }}
+  jobLabel: app.kubernetes.io/name
   selector:
     matchExpressions:
       - key: app.kubernetes.io/name
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index 076fd05..e1a01b9 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -208,6 +208,9 @@
   - apiGroups: ["acme.cert-manager.io"]
     resources: ["orders/finalizers"]
     verbs: ["update"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["clusterissuers/finalizers", "issuers/finalizers"]
+    verbs: ["update"]
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get", "list", "watch"]
@@ -306,10 +309,10 @@
     resources: ["ingresses/finalizers"]
     verbs: ["update"]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gateways", "httproutes"]
+    resources: ["gateways", "httproutes", "listenersets"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gateways/finalizers", "httproutes/finalizers"]
+    resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"]
     verbs: ["update"]
   - apiGroups: [""]
     resources: ["events"]
diff --git a/charts/cert-manager/templates/servicemonitor.yaml b/charts/cert-manager/templates/servicemonitor.yaml
index a29f3c6..76f358f 100644
--- a/charts/cert-manager/templates/servicemonitor.yaml
+++ b/charts/cert-manager/templates/servicemonitor.yaml
@@ -29,7 +29,7 @@
     {{- end }}
 {{- end }}
 spec:
-  jobLabel: {{ template "cert-manager.fullname" . }}
+  jobLabel: app.kubernetes.io/name
   selector:
     matchExpressions:
       - key: app.kubernetes.io/name
diff --git a/charts/cert-manager/templates/startupapicheck-job.yaml b/charts/cert-manager/templates/startupapicheck-job.yaml
index f68d540..7f1b0ff 100644
--- a/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -48,9 +48,13 @@
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-startupapicheck
-          image: "{{ template "image" (tuple .Values.startupapicheck.image $.Chart.AppVersion) }}"
+          image: "{{ template "image" (tuple .Values.startupapicheck.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
           args:
           - check
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index d2b10ae..66d6ead 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -81,7 +81,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-webhook
-          image: "{{ template "image" (tuple .Values.webhook.image $.Chart.AppVersion) }}"
+          image: "{{ template "image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
           args:
           {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -98,6 +98,15 @@
           {{- if .Values.webhook.featureGates }}
           - --feature-gates={{ .Values.webhook.featureGates }}
           {{- end }}
+          {{- if .Values.webhook.enableClientVerification }}
+          - --enable-client-verification={{ .Values.webhook.enableClientVerification }}
+          {{- end }}
+          {{- if .Values.webhook.clientCAFile }}
+          - --client-ca-path={{ .Values.webhook.clientCAFile }}
+          {{- end }}
+          {{- if .Values.webhook.apiserverClientCertSubjects }}
+          - --client-subject-names={{ .Values.webhook.apiserverClientCertSubjects }}
+          {{- end }}
           {{- $tlsConfig := default $config.tlsConfig "" }}
           {{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}}
           - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
diff --git a/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml b/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
index ab2a481..2789136 100644
--- a/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
+++ b/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
@@ -26,4 +26,7 @@
   {{- if hasKey .Values.webhook.podDisruptionBudget "maxUnavailable" }}
   maxUnavailable: {{ .Values.webhook.podDisruptionBudget.maxUnavailable }}
   {{- end }}
+  {{- with .Values.webhook.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ . }}
+  {{- end }}
 {{- end }}
diff --git a/charts/cert-manager/values.schema.json b/charts/cert-manager/values.schema.json
index 7f90b6c..24e8b39 100644
--- a/charts/cert-manager/values.schema.json
+++ b/charts/cert-manager/values.schema.json
@@ -57,6 +57,9 @@
         "extraArgs": {
           "$ref": "#/$defs/helm-values.extraArgs"
         },
+        "extraContainers": {
+          "$ref": "#/$defs/helm-values.extraContainers"
+        },
         "extraEnv": {
           "$ref": "#/$defs/helm-values.extraEnv"
         },
@@ -84,6 +87,12 @@
         "image": {
           "$ref": "#/$defs/helm-values.image"
         },
+        "imageNamespace": {
+          "$ref": "#/$defs/helm-values.imageNamespace"
+        },
+        "imageRegistry": {
+          "$ref": "#/$defs/helm-values.imageRegistry"
+        },
         "ingressShim": {
           "$ref": "#/$defs/helm-values.ingressShim"
         },
@@ -102,6 +111,9 @@
         "namespace": {
           "$ref": "#/$defs/helm-values.namespace"
         },
+        "networkPolicy": {
+          "$ref": "#/$defs/helm-values.networkPolicy"
+        },
         "no_proxy": {
           "$ref": "#/$defs/helm-values.no_proxy"
         },
@@ -189,6 +201,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.acmesolver.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.acmesolver.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.acmesolver.image.pullPolicy"
         },
@@ -205,7 +220,12 @@
       "type": "object"
     },
     "helm-values.acmesolver.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.acmesolver.image.name": {
+      "default": "cert-manager-acmesolver",
+      "description": "The image name for the cert-manager acmesolver.",
       "type": "string"
     },
     "helm-values.acmesolver.image.pullPolicy": {
@@ -214,12 +234,12 @@
       "type": "string"
     },
     "helm-values.acmesolver.image.registry": {
-      "description": "The container registry to pull the acmesolver image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `acmesolver.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `acmesolver.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.acmesolver.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-acmesolver",
-      "description": "The container image for the cert-manager acmesolver.",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).",
       "type": "string"
     },
     "helm-values.acmesolver.image.tag": {
@@ -280,6 +300,9 @@
         "image": {
           "$ref": "#/$defs/helm-values.cainjector.image"
         },
+        "networkPolicy": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy"
+        },
         "nodeSelector": {
           "$ref": "#/$defs/helm-values.cainjector.nodeSelector"
         },
@@ -392,6 +415,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.cainjector.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.cainjector.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.cainjector.image.pullPolicy"
         },
@@ -408,7 +434,12 @@
       "type": "object"
     },
     "helm-values.cainjector.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.cainjector.image.name": {
+      "default": "cert-manager-cainjector",
+      "description": "The image name for the cert-manager cainjector.",
       "type": "string"
     },
     "helm-values.cainjector.image.pullPolicy": {
@@ -417,18 +448,84 @@
       "type": "string"
     },
     "helm-values.cainjector.image.registry": {
-      "description": "The container registry to pull the cainjector image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `cainjector.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `cainjector.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.cainjector.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-cainjector",
-      "description": "The container image for the cert-manager cainjector",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).",
       "type": "string"
     },
     "helm-values.cainjector.image.tag": {
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion will be used.",
       "type": "string"
     },
+    "helm-values.cainjector.networkPolicy": {
+      "additionalProperties": false,
+      "properties": {
+        "egress": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy.egress"
+        },
+        "enabled": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy.enabled"
+        },
+        "ingress": {
+          "$ref": "#/$defs/helm-values.cainjector.networkPolicy.ingress"
+        }
+      },
+      "type": "object"
+    },
+    "helm-values.cainjector.networkPolicy.egress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": 80,
+              "protocol": "TCP"
+            },
+            {
+              "port": 443,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "UDP"
+            },
+            {
+              "port": 6443,
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Egress rule for the cainjector network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.",
+      "items": {},
+      "type": "array"
+    },
+    "helm-values.cainjector.networkPolicy.enabled": {
+      "default": false,
+      "description": "Create network policies for the cainjector.",
+      "type": "boolean"
+    },
+    "helm-values.cainjector.networkPolicy.ingress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": "http-metrics",
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Ingress rule for the webhook cainjector policy.\nBy default all pods are allowed access to:\n  http-metrics port",
+      "items": {},
+      "type": "array"
+    },
     "helm-values.cainjector.nodeSelector": {
       "default": {
         "kubernetes.io/os": "linux"
@@ -451,6 +548,9 @@
         },
         "minAvailable": {
           "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.minAvailable"
+        },
+        "unhealthyPodEvictionPolicy": {
+          "$ref": "#/$defs/helm-values.cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy"
         }
       },
       "type": "object"
@@ -466,6 +566,10 @@
     "helm-values.cainjector.podDisruptionBudget.minAvailable": {
       "description": "`minAvailable` configures the minimum available pods for disruptions. It can either be set to\nan integer (e.g., 1) or a percentage value (e.g., 25%).\nCannot be used if `maxUnavailable` is set."
     },
+    "helm-values.cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy": {
+      "description": "This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.",
+      "type": "string"
+    },
     "helm-values.cainjector.podLabels": {
       "default": {},
       "description": "Optional additional labels to add to the CA Injector Pods.",
@@ -579,7 +683,7 @@
     },
     "helm-values.config": {
       "default": {},
-      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.18.1. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AdditionalCertificateOutputFormats: true # GA - default=true\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: false # ALPHA - default=false\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n    UseDomainQualifiedFinalizer: true # GA - default=true\n    ValidateCAA: false # ALPHA - default=false\n    DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics",
+      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.20.0. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: true # BETA - default=true\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics\n  # Configure PEM size limits for certificate validation\n  # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)\n  pemSizeLimitsConfig:\n    maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)\n    maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)\n    maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)\n    maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)",
       "type": "object"
     },
     "helm-values.containerSecurityContext": {
@@ -662,6 +766,12 @@
       "items": {},
       "type": "array"
     },
+    "helm-values.extraContainers": {
+      "default": [],
+      "description": "Extra containers to add to the pod spec in the deployment of the cert-manager controller. For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):\nextraEnv:\n  - name: AWS_EC2_METADATA_SERVICE_ENDPOINT\n  - value: http://127.0.0.1:9911\nextraContainers:\n  - name: rolesanywhere-credential-helper\n    image: public.ecr.aws/rolesanywhere/credential-helper:latest\n    command: [aws_signing_helper]\n    args:\n      - serve\n      - --private-key\n      - /etc/cert/tls.key\n      - --certificate\n      - /etc/cert/tls.crt\n      - --role-arn\n      - $ROLE_ARN\n      - --profile-arn\n      - $PROFILE_ARN\n      - --trust-anchor-arn\n      - $TRUST_ANCHOR_ARN\n    volumeMounts:\n      - name: cert\n        mountPath: /etc/cert/\n        readOnly: true\nvolumes:\n  - name: cert\n    secret:\n      secretName: cert",
+      "items": {},
+      "type": "array"
+    },
     "helm-values.extraEnv": {
       "default": [],
       "description": "Additional environment variables to pass to cert-manager controller binary.\nFor example:\nextraEnv:\n- name: SOME_VAR\n  value: 'some value'",
@@ -849,6 +959,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.image.pullPolicy"
         },
@@ -865,7 +978,12 @@
       "type": "object"
     },
     "helm-values.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.image.name": {
+      "default": "cert-manager-controller",
+      "description": "The image name for the cert-manager controller.\nThis is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.",
       "type": "string"
     },
     "helm-values.image.pullPolicy": {
@@ -874,18 +992,28 @@
       "type": "string"
     },
     "helm-values.image.registry": {
-      "description": "The container registry to pull the manager image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-controller",
-      "description": "The container image for the cert-manager controller.",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).\nExample: quay.io/jetstack/cert-manager-controller",
       "type": "string"
     },
     "helm-values.image.tag": {
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
       "type": "string"
     },
+    "helm-values.imageNamespace": {
+      "default": "jetstack",
+      "description": "The repository namespace used for all cert-manager images by default.\nExamples:\n- jetstack\n- cert-manager",
+      "type": "string"
+    },
+    "helm-values.imageRegistry": {
+      "default": "quay.io",
+      "description": "The container registry used for all cert-manager images by default. This can include path prefixes (e.g. `artifactory.example.com/docker`).",
+      "type": "string"
+    },
     "helm-values.ingressShim": {
       "additionalProperties": false,
       "properties": {
@@ -944,6 +1072,76 @@
       "description": "This namespace allows you to define where the services are installed into. If not set then they use the namespace of the release. This is helpful when installing cert manager as a chart dependency (sub chart).",
       "type": "string"
     },
+    "helm-values.networkPolicy": {
+      "additionalProperties": false,
+      "properties": {
+        "egress": {
+          "$ref": "#/$defs/helm-values.networkPolicy.egress"
+        },
+        "enabled": {
+          "$ref": "#/$defs/helm-values.networkPolicy.enabled"
+        },
+        "ingress": {
+          "$ref": "#/$defs/helm-values.networkPolicy.ingress"
+        }
+      },
+      "type": "object"
+    },
+    "helm-values.networkPolicy.egress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": 80,
+              "protocol": "TCP"
+            },
+            {
+              "port": 443,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "TCP"
+            },
+            {
+              "port": 53,
+              "protocol": "UDP"
+            },
+            {
+              "port": 6443,
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Egress rule for the cert-manager network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.",
+      "items": {},
+      "type": "array"
+    },
+    "helm-values.networkPolicy.enabled": {
+      "default": false,
+      "description": "Create network policies for cert-manager.",
+      "type": "boolean"
+    },
+    "helm-values.networkPolicy.ingress": {
+      "default": [
+        {
+          "ports": [
+            {
+              "port": "http-metrics",
+              "protocol": "TCP"
+            },
+            {
+              "port": "http-healthz",
+              "protocol": "TCP"
+            }
+          ]
+        }
+      ],
+      "description": "Ingress rule for the cert-manager network policy.\nBy default all pods are allowed access to:\n  http-metrics and http-healthz ports",
+      "items": {},
+      "type": "array"
+    },
     "helm-values.no_proxy": {
       "description": "Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.",
       "type": "string"
@@ -970,6 +1168,9 @@
         },
         "minAvailable": {
           "$ref": "#/$defs/helm-values.podDisruptionBudget.minAvailable"
+        },
+        "unhealthyPodEvictionPolicy": {
+          "$ref": "#/$defs/helm-values.podDisruptionBudget.unhealthyPodEvictionPolicy"
         }
       },
       "type": "object"
@@ -985,6 +1186,10 @@
     "helm-values.podDisruptionBudget.minAvailable": {
       "description": "This configures the minimum available pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `maxUnavailable` is set."
     },
+    "helm-values.podDisruptionBudget.unhealthyPodEvictionPolicy": {
+      "description": "This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.",
+      "type": "string"
+    },
     "helm-values.podDnsConfig": {
       "description": "Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy settings. However, when a Pod's dnsPolicy is set to \"None\", the dnsConfig field has to be specified. For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).",
       "type": "object"
@@ -1401,6 +1606,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.startupapicheck.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.startupapicheck.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.startupapicheck.image.pullPolicy"
         },
@@ -1417,7 +1625,12 @@
       "type": "object"
     },
     "helm-values.startupapicheck.image.digest": {
-      "description": "Setting a digest will override any tag.",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.startupapicheck.image.name": {
+      "default": "cert-manager-startupapicheck",
+      "description": "The image name for the cert-manager startupapicheck.",
       "type": "string"
     },
     "helm-values.startupapicheck.image.pullPolicy": {
@@ -1426,12 +1639,12 @@
       "type": "string"
     },
     "helm-values.startupapicheck.image.registry": {
-      "description": "The container registry to pull the startupapicheck image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `startupapicheck.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.startupapicheck.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-startupapicheck",
-      "description": "The container image for the cert-manager startupapicheck.",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).",
       "type": "string"
     },
     "helm-values.startupapicheck.image.tag": {
@@ -1602,9 +1815,15 @@
         "affinity": {
           "$ref": "#/$defs/helm-values.webhook.affinity"
         },
+        "apiserverClientCertSubjects": {
+          "$ref": "#/$defs/helm-values.webhook.apiserverClientCertSubjects"
+        },
         "automountServiceAccountToken": {
           "$ref": "#/$defs/helm-values.webhook.automountServiceAccountToken"
         },
+        "clientCAFile": {
+          "$ref": "#/$defs/helm-values.webhook.clientCAFile"
+        },
         "config": {
           "$ref": "#/$defs/helm-values.webhook.config"
         },
@@ -1614,6 +1833,9 @@
         "deploymentAnnotations": {
           "$ref": "#/$defs/helm-values.webhook.deploymentAnnotations"
         },
+        "enableClientVerification": {
+          "$ref": "#/$defs/helm-values.webhook.enableClientVerification"
+        },
         "enableServiceLinks": {
           "$ref": "#/$defs/helm-values.webhook.enableServiceLinks"
         },
@@ -1727,10 +1949,20 @@
       "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
       "type": "object"
     },
+    "helm-values.webhook.apiserverClientCertSubjects": {
+      "default": "",
+      "description": "Subject names to verify for the client certificate. Multiple values may be supplied as a comma-separated list.",
+      "type": "string"
+    },
     "helm-values.webhook.automountServiceAccountToken": {
       "description": "Automounting API credentials for a particular pod.",
       "type": "boolean"
     },
+    "helm-values.webhook.clientCAFile": {
+      "default": "",
+      "description": "the client CA file to be used for verification",
+      "type": "string"
+    },
     "helm-values.webhook.config": {
       "default": {},
       "description": "This is used to configure options for the webhook pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\napiVersion: webhook.config.cert-manager.io/v1alpha1\nkind: WebhookConfiguration\n# The port that the webhook listens on for requests.\n# In GKE private clusters, by default Kubernetes apiservers are allowed to\n# talk to the cluster nodes only on 443 and 10250. Configuring\n# securePort: 10250 therefore will work out-of-the-box without needing to add firewall\n# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.\n# This should be uncommented and set as a default by the chart once\n# the apiVersion of WebhookConfiguration graduates beyond v1alpha1.\nsecurePort: 10250\n# Configure the metrics server for TLS\n# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\nmetricsTLSConfig:\n  dynamic:\n    secretNamespace: \"cert-manager\"\n    secretName: \"cert-manager-metrics-ca\"\n    dnsNames:\n    - cert-manager-metrics",
@@ -1753,6 +1985,11 @@
       "description": "Optional additional annotations to add to the webhook Deployment.",
       "type": "object"
     },
+    "helm-values.webhook.enableClientVerification": {
+      "default": false,
+      "description": "enableClientVerification turns on client verification of requests made to the webhook server",
+      "type": "boolean"
+    },
     "helm-values.webhook.enableServiceLinks": {
       "default": false,
       "description": "enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.",
@@ -1786,6 +2023,9 @@
         "digest": {
           "$ref": "#/$defs/helm-values.webhook.image.digest"
         },
+        "name": {
+          "$ref": "#/$defs/helm-values.webhook.image.name"
+        },
         "pullPolicy": {
           "$ref": "#/$defs/helm-values.webhook.image.pullPolicy"
         },
@@ -1802,7 +2042,12 @@
       "type": "object"
     },
     "helm-values.webhook.image.digest": {
-      "description": "Setting a digest will override any tag",
+      "description": "Setting a digest pins the image. If a tag is also set, the rendered reference will include both (\"image:tag@digest\"), though only the digest will be used for pulling.",
+      "type": "string"
+    },
+    "helm-values.webhook.image.name": {
+      "default": "cert-manager-webhook",
+      "description": "The image name for the cert-manager webhook.",
       "type": "string"
     },
     "helm-values.webhook.image.pullPolicy": {
@@ -1811,12 +2056,12 @@
       "type": "string"
     },
     "helm-values.webhook.image.registry": {
-      "description": "The container registry to pull the webhook image from.",
+      "description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `webhook.image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `webhook.image.name`.\n\nThis can produce \"double registry\" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.",
       "type": "string"
     },
     "helm-values.webhook.image.repository": {
-      "default": "quay.io/jetstack/cert-manager-webhook",
-      "description": "The container image for the cert-manager webhook",
+      "default": "",
+      "description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).",
       "type": "string"
     },
     "helm-values.webhook.image.tag": {
@@ -1895,18 +2140,6 @@
               "port": 6443,
               "protocol": "TCP"
             }
-          ],
-          "to": [
-            {
-              "ipBlock": {
-                "cidr": "0.0.0.0/0"
-              }
-            },
-            {
-              "ipBlock": {
-                "cidr": "::/0"
-              }
-            }
           ]
         }
       ],
@@ -1922,21 +2155,23 @@
     "helm-values.webhook.networkPolicy.ingress": {
       "default": [
         {
-          "from": [
+          "ports": [
             {
-              "ipBlock": {
-                "cidr": "0.0.0.0/0"
-              }
+              "port": "https",
+              "protocol": "TCP"
             },
             {
-              "ipBlock": {
-                "cidr": "::/0"
-              }
+              "port": "healthcheck",
+              "protocol": "TCP"
+            },
+            {
+              "port": "http-metrics",
+              "protocol": "TCP"
             }
           ]
         }
       ],
-      "description": "Ingress rule for the webhook network policy. By default, it allows all inbound traffic.",
+      "description": "Ingress rule for the webhook network policy.\nBy default all pods are allowed access to:\n  https, http-metrics, and http-healthz ports",
       "items": {},
       "type": "array"
     },
@@ -1962,6 +2197,9 @@
         },
         "minAvailable": {
           "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.minAvailable"
+        },
+        "unhealthyPodEvictionPolicy": {
+          "$ref": "#/$defs/helm-values.webhook.podDisruptionBudget.unhealthyPodEvictionPolicy"
         }
       },
       "type": "object"
@@ -1977,6 +2215,10 @@
     "helm-values.webhook.podDisruptionBudget.minAvailable": {
       "description": "This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%).\nIt cannot be used if `maxUnavailable` is set."
     },
+    "helm-values.webhook.podDisruptionBudget.unhealthyPodEvictionPolicy": {
+      "description": "This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.",
+      "type": "string"
+    },
     "helm-values.webhook.podLabels": {
       "default": {},
       "description": "Optional additional labels to add to the Webhook Pods.",
diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml
index 54257c7..4bd3ebf 100644
--- a/charts/cert-manager/values.yaml
+++ b/charts/cert-manager/values.yaml
@@ -21,7 +21,7 @@
   # If a component-specific nodeSelector is also set, it will be merged and take precedence.
   # +docs:property
   nodeSelector: {}
-  
+
   # Labels to apply to all resources.
   # Please note that this does not add labels to the resources created dynamically by the controllers.
   # For these resources, you have to add the labels in the template in the cert-manager custom resource:
@@ -153,6 +153,13 @@
   # +docs:type=unknown
   # maxUnavailable: 1
 
+  # This configures how to act with unhealthy pods during eviction
+  # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+  # the cluster to work.
+  # +docs:property
+  # +docs:type=string
+  # unhealthyPodEvictionPolicy: AlwaysAllow
+
 # A comma-separated list of feature gates that should be enabled on the
 # controller pod.
 featureGates: ""
@@ -160,21 +167,47 @@
 # The maximum number of challenges that can be scheduled as 'processing' at once.
 maxConcurrentChallenges: 60
 
-image:
-  # The container registry to pull the manager image from.
-  # +docs:property
-  # registry: quay.io
+# The container registry used for all cert-manager images by default.
+# This can include path prefixes (e.g. `artifactory.example.com/docker`).
+# +docs:property
+imageRegistry: quay.io
 
-  # The container image for the cert-manager controller.
+# The repository namespace used for all cert-manager images by default.
+# Examples:
+# - jetstack
+# - cert-manager
+# +docs:property
+imageNamespace: jetstack
+
+image:
+  # Deprecated: per-component registry prefix.
+  #
+  # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+  # This applies both when `image.repository` is set and when the repository is computed from
+  # `imageRegistry` + `imageNamespace` + `image.name`.
+  #
+  # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+  # Prefer using the global `imageRegistry`/`imageNamespace` values.
   # +docs:property
-  repository: quay.io/jetstack/cert-manager-controller
+  # registry: ""
+
+  # The image name for the cert-manager controller.
+  # This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
+  # +docs:property
+  name: cert-manager-controller
+
+  # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
+  # Example: quay.io/jetstack/cert-manager-controller
+  # +docs:property
+  repository: ""
 
   # Override the image tag to deploy by setting this variable.
   # If no value is set, the chart's appVersion is used.
   # +docs:property
   # tag: vX.Y.Z
 
-  # Setting a digest will override any tag.
+  # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+  # both ("image:tag@digest"), though only the digest will be used for pulling.
   # +docs:property
   # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -254,25 +287,21 @@
 #    kubernetesAPIBurst: 9000
 #    numberOfConcurrentWorkers: 200
 #    enableGatewayAPI: true
-#    # Feature gates as of v1.18.1. Listed with their default values.
+#    # Feature gates as of v1.20.0. Listed with their default values.
 #    # See https://cert-manager.io/docs/cli/controller/
 #    featureGates:
-#      AdditionalCertificateOutputFormats: true # GA - default=true
 #      AllAlpha: false # ALPHA - default=false
 #      AllBeta: false # BETA - default=false
+#      ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
 #      ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
 #      ExperimentalGatewayAPISupport: true # BETA - default=true
 #      LiteralCertificateSubject: true # BETA - default=true
 #      NameConstraints: true # BETA - default=true
-#      OtherNames: false # ALPHA - default=false
+#      OtherNames: true # BETA - default=true
 #      SecretsFilteredCaching: true # BETA - default=true
 #      ServerSideApply: false # ALPHA - default=false
 #      StableCertificateRequestName: true # BETA - default=true
 #      UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-#      UseDomainQualifiedFinalizer: true # GA - default=true
-#      ValidateCAA: false # ALPHA - default=false
-#      DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
-#      ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
 #    # Configure the metrics server for TLS
 #    # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
 #    metricsTLSConfig:
@@ -281,6 +310,13 @@
 #        secretName: "cert-manager-metrics-ca"
 #        dnsNames:
 #        - cert-manager-metrics
+#    # Configure PEM size limits for certificate validation
+#    # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+#    pemSizeLimitsConfig:
+#      maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)
+#      maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)
+#      maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)
+#      maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)
 config: {}
 
 # Setting Nameservers for DNS01 Self Check.
@@ -320,6 +356,38 @@
 #    - --controllers=*,-certificaterequests-approver
 extraArgs: []
 
+# Extra containers to add to the pod spec in the deployment of the cert-manager controller.
+# For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+#
+# extraEnv:
+#   - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+#   - value: http://127.0.0.1:9911
+# extraContainers:
+#   - name: rolesanywhere-credential-helper
+#     image: public.ecr.aws/rolesanywhere/credential-helper:latest
+#     command: [aws_signing_helper]
+#     args:
+#       - serve
+#       - --private-key
+#       - /etc/cert/tls.key
+#       - --certificate
+#       - /etc/cert/tls.crt
+#       - --role-arn
+#       - $ROLE_ARN
+#       - --profile-arn
+#       - $PROFILE_ARN
+#       - --trust-anchor-arn
+#       - $TRUST_ANCHOR_ARN
+#     volumeMounts:
+#       - name: cert
+#         mountPath: /etc/cert/
+#         readOnly: true
+# volumes:
+#   - name: cert
+#     secret:
+#       secretName: cert
+extraContainers: []
+
 # Additional environment variables to pass to cert-manager controller binary.
 # For example:
 #  extraEnv:
@@ -429,6 +497,45 @@
 nodeSelector:
   kubernetes.io/os: linux
 
+# Enables default network policies for cert-manager.
+# This provides a way for you to restrict network traffic
+# between cert-manager components and other pods.
+# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+# NOTE: an incorrect networkPolicy will cause traffic to be dropped
+networkPolicy:
+  # Create network policies for cert-manager.
+  enabled: false
+
+  # Ingress rule for the cert-manager network policy.
+  # By default all pods are allowed access to:
+  #   http-metrics and http-healthz ports
+  # +docs:property
+  ingress:
+  - ports:
+    - port: http-metrics
+      protocol: TCP
+    - port: http-healthz
+      protocol: TCP
+
+
+  # Egress rule for the cert-manager network policy. By default, it allows all
+  # outbound traffic to ports 80 and 443, as well as DNS ports.
+  # +docs:property
+  egress:
+  - ports:
+    - port: 80
+      protocol: TCP
+    - port: 443
+      protocol: TCP
+    - port: 53
+      protocol: TCP
+    - port: 53
+      protocol: UDP
+    # On OpenShift and OKD, the Kubernetes API server listens on.
+    # port 6443.
+    - port: 6443
+      protocol: TCP
+
 # +docs:ignore
 ingressShim: {}
 
@@ -744,6 +851,13 @@
     # +docs:type=unknown
     # maxUnavailable: 1
 
+    # This configures how to act with unhealthy pods during eviction
+    # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+    # the cluster to work.
+    # +docs:property
+    # +docs:type=string
+    # unhealthyPodEvictionPolicy: AlwaysAllow
+
   # Optional additional annotations to add to the webhook Deployment.
   # +docs:property
   # deploymentAnnotations: {}
@@ -896,20 +1010,32 @@
   serviceIPFamilies: []
 
   image:
-    # The container registry to pull the webhook image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `webhook.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `webhook.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager webhook
+    # The image name for the cert-manager webhook.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-webhook
+    name: cert-manager-webhook
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion will be used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -973,19 +1099,26 @@
     # host:
 
   # Enables default network policies for webhooks.
+  # This provides a way for you to restrict network traffic
+  # between cert-manager components and other pods.
+  # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+  # NOTE: an incorrect networkPolicy will cause traffic to be dropped
   networkPolicy:
     # Create network policies for the webhooks.
     enabled: false
 
-    # Ingress rule for the webhook network policy. By default, it allows all
-    # inbound traffic.
+    # Ingress rule for the webhook network policy.
+    # By default all pods are allowed access to:
+    #   https, http-metrics, and http-healthz ports
     # +docs:property
     ingress:
-    - from:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-      - ipBlock:
-          cidr: "::/0"
+    - ports:
+      - port: https
+        protocol: TCP
+      - port: healthcheck
+        protocol: TCP
+      - port: http-metrics
+        protocol: TCP
 
     # Egress rule for the webhook network policy. By default, it allows all
     # outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1004,11 +1137,6 @@
       # port 6443.
       - port: 6443
         protocol: TCP
-      to:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-      - ipBlock:
-          cidr: "::/0"
 
   # Additional volumes to add to the cert-manager controller pod.
   volumes: []
@@ -1021,6 +1149,15 @@
   # links.
   enableServiceLinks: false
 
+  # enableClientVerification turns on client verification of requests
+  # made to the webhook server
+  enableClientVerification: false
+  # the client CA file to be used for verification
+  clientCAFile: ""
+  # Subject names to verify for the client certificate.
+  # Multiple values may be supplied as a comma-separated list.
+  apiserverClientCertSubjects: ""
+
 # +docs:section=CA Injector
 
 cainjector:
@@ -1092,6 +1229,42 @@
       - ALL
     readOnlyRootFilesystem: true
 
+  # Enables default network policies for cainjector.
+  # This provides a way for you to restrict network traffic
+  # between cert-manager components and other pods.
+  # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+  # NOTE: an incorrect networkPolicy will cause traffic to be dropped
+  networkPolicy:
+    # Create network policies for the cainjector.
+    enabled: false
+
+    # Ingress rule for the webhook cainjector policy.
+    # By default all pods are allowed access to:
+    #   http-metrics port
+    # +docs:property
+    ingress:
+    - ports:
+      - port: http-metrics
+        protocol: TCP
+
+    # Egress rule for the cainjector network policy. By default, it allows all
+    # outbound traffic to ports 80 and 443, as well as DNS ports.
+    # +docs:property
+    egress:
+    - ports:
+      - port: 80
+        protocol: TCP
+      - port: 443
+        protocol: TCP
+      - port: 53
+        protocol: TCP
+      - port: 53
+        protocol: UDP
+      # On OpenShift and OKD, the Kubernetes API server listens on.
+      # port 6443.
+      - port: 6443
+        protocol: TCP
+
   podDisruptionBudget:
     # Enable or disable the PodDisruptionBudget resource.
     #
@@ -1115,6 +1288,13 @@
     # +docs:type=unknown
     # maxUnavailable: 1
 
+    # This configures how to act with unhealthy pods during eviction
+    # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+    # the cluster to work.
+    # +docs:property
+    # +docs:type=string
+    # unhealthyPodEvictionPolicy: AlwaysAllow
+
   # Optional additional annotations to add to the cainjector Deployment.
   # +docs:property
   # deploymentAnnotations: {}
@@ -1209,20 +1389,32 @@
   serviceLabels: {}
 
   image:
-    # The container registry to pull the cainjector image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `cainjector.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `cainjector.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager cainjector
+    # The image name for the cert-manager cainjector.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-cainjector
+    name: cert-manager-cainjector
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion will be used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag.
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -1268,20 +1460,32 @@
 
 acmesolver:
   image:
-    # The container registry to pull the acmesolver image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `acmesolver.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `acmesolver.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager acmesolver.
+    # The image name for the cert-manager acmesolver.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-acmesolver
+    name: cert-manager-acmesolver
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion is used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag.
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
 
@@ -1401,20 +1605,32 @@
   podLabels: {}
 
   image:
-    # The container registry to pull the startupapicheck image from.
+    # Deprecated: per-component registry prefix.
+    #
+    # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+    # This applies both when `startupapicheck.image.repository` is set and when the repository is computed from
+    # `imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.
+    #
+    # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+    # Prefer using the global `imageRegistry`/`imageNamespace` values.
     # +docs:property
-    # registry: quay.io
+    # registry: ""
 
-    # The container image for the cert-manager startupapicheck.
+    # The image name for the cert-manager startupapicheck.
     # +docs:property
-    repository: quay.io/jetstack/cert-manager-startupapicheck
+    name: cert-manager-startupapicheck
+
+    # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
+    # +docs:property
+    repository: ""
 
     # Override the image tag to deploy by setting this variable.
     # If no value is set, the chart's appVersion is used.
     # +docs:property
     # tag: vX.Y.Z
 
-    # Setting a digest will override any tag.
+    # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+    # both ("image:tag@digest"), though only the digest will be used for pulling.
     # +docs:property
     # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20