diff --git a/.gitignore b/.gitignore
index 44f71f2d..32ce09ac 100755
--- a/.gitignore
+++ b/.gitignore
@@ -5,9 +5,6 @@
 .yamllint
 
 # Ignore changes to sample environments
-helmfile/environments/dev/values.yaml
-helmfile/environments/dev/values.gotmpl
-helmfile/environments/test/values.yaml
-helmfile/environments/test/values.gotmpl
-helmfile/environments/prod/values.yaml
-helmfile/environments/prod/values.gotmpl
+helmfile/environments/dev/values.yaml.gotmpl
+helmfile/environments/test/values.yaml.gotmpl
+helmfile/environments/prod/values.yaml.gotmpl
diff --git a/docs/getting-started.md b/docs/getting-started.md
index b644bc79..a29c8396 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -12,8 +12,7 @@ This documentation should enable you to create your own evaluation instance of o
 * [Customize environment](#customize-environment)
   * [Domain](#domain)
     * [Apps](#apps)
-  * [Private Image registry](#private-image-registry)
-  * [Private Helm registry](#private-helm-registry)
+  * [Private Helm chart and container image registry](#private-helm-chart-and-container-image-registry)
   * [Cluster capabilities](#cluster-capabilities)
     * [Service](#service)
     * [Networking](#networking)
@@ -127,58 +126,39 @@ jitsi:
   enabled: false
 ```
 
-## Private Image registry
+## Private Helm chart and container image registry
 
-By default, all OCI artifacts are proxied via the project's image registry, which should get replaced soon by the
-OCI registries provided by Open CoDE.
+By default Helm charts and container images are fetched from OCI registries. These registries can be found for most cases
+in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).
 
-You also can set your own registry by:
+For untouched upstream artefacts that do not belong to a functional component's core we use upstream registries
+like Docker Hub.
+
+Doing a test deployment will most likely be fine with this setup. In case you want to deploy multiple times a day
+and fetch from the same IP address you might run into rate limits at Docker Hub. In that case and in cases you
+prefer the use of a private image registry anyway you can configure such for
+[your target environment](./../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting `global.imageRegistry`
+like this:
 
 ```yaml
 global:
   imageRegistry: "external-registry.souvap-univention.de/sovereign-workplace"
 ```
 
-or via environments variable:
+alternatively you can use an environment variable:
 
 ```shell
 export PRIVATE_IMAGE_REGISTRY_URL=external-registry.souvap-univention.de/sovereign-workplace
 ```
 
 If authentication is required, you can reference imagePullSecrets as following:
+
 ```yaml
 global:
   imagePullSecrets:
     - "external-registry"
 ```
 
-## Private Helm registry
-
-Some apps use OCI style registry and some use Helm chart museum style registries.
-In `helmfile/environments/default/charts.yaml` you can find all helm charts used and modify their registry, repository
-or version.
-
-As an example, you can also use helmfile methods to use just a single environment variable to set registry and
-authentication for all OCI helm charts.
-
-```yaml
-charts:
-  certificates:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-```
-
-There is a full example including http and OCI style registries in `examples/private-helm-registry.yaml.gotmpl`.
-The following environment variables have to be exposed when using the example:
-
-| Environment variable                | Description                                                                                |
-|-------------------------------------|--------------------------------------------------------------------------------------------|
-| `OD_PRIVATE_HELM_OCI_REGISTRY`      | Registry for OCI hosted helm charts, example: `external-registry.souvap-univention.de`     |
-| `OD_PRIVATE_HELM_HTTP_REGISTRY`     | Registry URI for http hosted helm charts, `https://external-registry.souvap-univention.de` |
-| `OD_PRIVATE_HELM_REGISTRY_USERNAME` | Username                                                                                   |
-| `OD_PRIVATE_HELM_REGISTRY_PASSWORD` | Password                                                                                   |
-
 ## Cluster capabilities
 
 ### Service
diff --git a/examples/private-helm-registry.yaml.gotmpl b/examples/private-helm-registry.yaml.gotmpl
deleted file mode 100644
index 16bc02b4..00000000
--- a/examples/private-helm-registry.yaml.gotmpl
+++ /dev/null
@@ -1,261 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-charts:
-  certificates:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  clamav:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  clamavSimple:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  collabora:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  cryptpad:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  dovecot:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  element:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  elementWellKnown:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  intercomService:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  istioResources:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  jitsi:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsKeycloak:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsKeycloakBootstrap:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  opendeskKeycloakBootstrap:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsKeycloakExtensions:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  mariadb:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  matrixNeoboardWidget:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  matrixNeochoiseWidget:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  matrixNeodatefixBot:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  matrixNeodatefixWidget:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  matrixUserVerificationService:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  memcached:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  minio:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  nextcloud:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  nextcloudBootstrap:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  nginx:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  openproject:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  openprojectBootstrap:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  openXchangeAppSuite:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  openXchangeAppSuiteBootstrap:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  otterize:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  oxConnector:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  postfix:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  postgresql:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  redis:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  synapse:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  synapseCreateAccount:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  synapseWeb:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsLdapNotifier:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsLdapServer:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsNotificationsApi:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsPortalFrontend:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsPortalListener:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsPortalServer:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsStackDataSwp:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsStackDataUms:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsStoreDav:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsUdmRestApi:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsUmcGateway:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  umsUmcServer:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
-  xwiki:
-    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-...
diff --git a/helmfile.yaml b/helmfile.yaml
index ba51f262..eb20335d 100644
--- a/helmfile.yaml
+++ b/helmfile.yaml
@@ -37,18 +37,15 @@ environments:
     values:
       - "helmfile/environments/default/*.gotmpl"
       - "helmfile/environments/default/*.yaml"
-      - "helmfile/environments/dev/values.yaml"
-      - "helmfile/environments/dev/values.gotmpl"
+      - "helmfile/environments/dev/values.yaml.gotmpl"
   test:
     values:
       - "helmfile/environments/default/*.gotmpl"
       - "helmfile/environments/default/*.yaml"
-      - "helmfile/environments/test/values.yaml"
-      - "helmfile/environments/test/values.gotmpl"
+      - "helmfile/environments/test/values.yaml.gotmpl"
   prod:
     values:
       - "helmfile/environments/default/*.gotmpl"
       - "helmfile/environments/default/*.yaml"
-      - "helmfile/environments/prod/values.yaml"
-      - "helmfile/environments/prod/values.gotmpl"
+      - "helmfile/environments/prod/values.yaml.gotmpl"
 ...
diff --git a/helmfile/apps/collabora/helmfile.yaml b/helmfile/apps/collabora/helmfile.yaml
index a8d9aca4..0f12b292 100644
--- a/helmfile/apps/collabora/helmfile.yaml
+++ b/helmfile/apps/collabora/helmfile.yaml
@@ -11,7 +11,7 @@ repositories:
     username: {{ .Values.charts.collabora.username | quote }}
     password: {{ .Values.charts.collabora.password | quote }}
     oci: {{ .Values.charts.collabora.oci }}
-    url: "{{ .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
 
 releases:
   - name: "collabora-online"
diff --git a/helmfile/apps/collabora/values.gotmpl b/helmfile/apps/collabora/values.gotmpl
index f3301363..cc7c890d 100644
--- a/helmfile/apps/collabora/values.gotmpl
+++ b/helmfile/apps/collabora/values.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.collabora.repository }}"
+  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
   tag: {{ .Values.images.collabora.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
diff --git a/helmfile/apps/collabora/values.yaml b/helmfile/apps/collabora/values.yaml
index 46afbde8..37d174de 100644
--- a/helmfile/apps/collabora/values.yaml
+++ b/helmfile/apps/collabora/values.yaml
@@ -6,9 +6,6 @@
 
 fullnameOverride: "collabora"
 
-image:
-  pullPolicy: "IfNotPresent"
-
 collabora:
   extra_params: "--o:ssl.enable=false --o:ssl.termination=true"
 
diff --git a/helmfile/apps/cryptpad/helmfile.yaml b/helmfile/apps/cryptpad/helmfile.yaml
index f35e5a74..83ff9426 100644
--- a/helmfile/apps/cryptpad/helmfile.yaml
+++ b/helmfile/apps/cryptpad/helmfile.yaml
@@ -11,7 +11,7 @@ repositories:
     username: {{ .Values.charts.cryptpad.username | quote }}
     password: {{ .Values.charts.cryptpad.password | quote }}
     oci: {{ .Values.charts.cryptpad.oci }}
-    url: "{{ .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 
 releases:
   - name: "cryptpad"
diff --git a/helmfile/apps/cryptpad/values.gotmpl b/helmfile/apps/cryptpad/values.gotmpl
index a90dc168..5600da7a 100644
--- a/helmfile/apps/cryptpad/values.gotmpl
+++ b/helmfile/apps/cryptpad/values.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.cryptpad.repository }}"
+  repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
   tag: {{ .Values.images.cryptpad.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
diff --git a/helmfile/apps/element/helmfile.yaml b/helmfile/apps/element/helmfile.yaml
index f0455634..a14530f8 100644
--- a/helmfile/apps/element/helmfile.yaml
+++ b/helmfile/apps/element/helmfile.yaml
@@ -13,35 +13,35 @@ repositories:
     verify: {{ .Values.charts.element.verify }}
     username: {{ .Values.charts.element.username | quote }}
     password: {{ .Values.charts.element.password | quote }}
-    url: "{{ .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
   - name: "element-well-known-repo"
     oci: {{ .Values.charts.elementWellKnown.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.elementWellKnown.verify }}
     username: {{ .Values.charts.elementWellKnown.username | quote }}
     password: {{ .Values.charts.elementWellKnown.password | quote }}
-    url: "{{ .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
   - name: "synapse-web-repo"
     oci: {{ .Values.charts.synapseWeb.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseWeb.verify }}
     username: {{ .Values.charts.synapseWeb.username | quote }}
     password: {{ .Values.charts.synapseWeb.password | quote }}
-    url: "{{ .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
   - name: "synapse-repo"
     oci: {{ .Values.charts.synapse.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapse.verify }}
     username: {{ .Values.charts.synapse.username | quote }}
     password: {{ .Values.charts.synapse.password | quote }}
-    url: "{{ .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
   - name: "synapse-create-account-repo"
     oci: {{ .Values.charts.synapseCreateAccount.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseCreateAccount.verify }}
     username: {{ .Values.charts.synapseCreateAccount.username | quote }}
     password: {{ .Values.charts.synapseCreateAccount.password | quote }}
-    url: "{{ .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
 
   # openDesk Matrix Widgets
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -51,7 +51,7 @@ repositories:
     verify: {{ .Values.charts.matrixUserVerificationService.verify }}
     username: {{ .Values.charts.matrixUserVerificationService.username | quote }}
     password: {{ .Values.charts.matrixUserVerificationService.password | quote }}
-    url: "{{ .Values.charts.matrixUserVerificationService.registry }}/\
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
       {{ .Values.charts.matrixUserVerificationService.repository }}"
   - name: "matrix-neoboard-widget-repo"
     oci: {{ .Values.charts.matrixNeoboardWidget.oci }}
@@ -59,28 +59,28 @@ repositories:
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
     username: {{ .Values.charts.matrixNeoboardWidget.username | quote }}
     password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
-    url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neochoice-widget-repo"
     oci: {{ .Values.charts.matrixNeoboardWidget.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
     username: {{ .Values.charts.matrixNeoboardWidget.username | quote }}
     password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
-    url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neodatefix-widget-repo"
     oci: {{ .Values.charts.matrixNeodatefixWidget.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
     username: {{ .Values.charts.matrixNeodatefixWidget.username | quote }}
     password: {{ .Values.charts.matrixNeodatefixWidget.password | quote }}
-    url: "{{ .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
   - name: "matrix-neodatefix-bot-repo"
     oci: {{ .Values.charts.matrixNeodatefixBot.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
     username: {{ .Values.charts.matrixNeodatefixBot.username | quote }}
     password: {{ .Values.charts.matrixNeodatefixBot.password | quote }}
-    url: "{{ .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
 
 
 releases:
diff --git a/helmfile/apps/element/values-element.gotmpl b/helmfile/apps/element/values-element.gotmpl
index c1a9f72a..38e8e760 100644
--- a/helmfile/apps/element/values-element.gotmpl
+++ b/helmfile/apps/element/values-element.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -108,7 +107,7 @@ configuration:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
   repository: {{ .Values.images.element.repository | quote }}
   tag: {{ .Values.images.element.tag | quote }}
 
diff --git a/helmfile/apps/element/values-matrix-neoboard-widget.gotmpl b/helmfile/apps/element/values-matrix-neoboard-widget.gotmpl
index 0de7efb0..369656f9 100644
--- a/helmfile/apps/element/values-matrix-neoboard-widget.gotmpl
+++ b/helmfile/apps/element/values-matrix-neoboard-widget.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,6 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}
 
diff --git a/helmfile/apps/element/values-matrix-neochoice-widget.gotmpl b/helmfile/apps/element/values-matrix-neochoice-widget.gotmpl
index c4c2baea..0c3f57cc 100644
--- a/helmfile/apps/element/values-matrix-neochoice-widget.gotmpl
+++ b/helmfile/apps/element/values-matrix-neochoice-widget.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,6 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}
 
diff --git a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.gotmpl b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.gotmpl
index 823f270b..22557ef6 100644
--- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.gotmpl
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
@@ -16,7 +15,7 @@ configuration:
   password: {{ .Values.secrets.matrixNeoDateFixBot.password | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
   url: {{ .Values.images.synapseCreateUser.repository | quote }}
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/element/values-matrix-neodatefix-bot.gotmpl b/helmfile/apps/element/values-matrix-neodatefix-bot.gotmpl
index 190e0778..25eb6f64 100644
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -16,6 +15,7 @@ configuration:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
   repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
   tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}
 
diff --git a/helmfile/apps/element/values-matrix-neodatefix-widget.gotmpl b/helmfile/apps/element/values-matrix-neodatefix-widget.gotmpl
index 24a64fdb..77d08046 100644
--- a/helmfile/apps/element/values-matrix-neodatefix-widget.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-widget.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,6 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}
 
diff --git a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.gotmpl b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.gotmpl
index 77882a14..c689e82f 100644
--- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.gotmpl
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
@@ -16,7 +15,7 @@ configuration:
   password: {{ .Values.secrets.matrixUserVerificationService.password | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
   url: {{ .Values.images.synapseCreateUser.repository | quote }}
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/element/values-matrix-user-verification-service.gotmpl b/helmfile/apps/element/values-matrix-user-verification-service.gotmpl
index 45cd9605..8fffae14 100644
--- a/helmfile/apps/element/values-matrix-user-verification-service.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,6 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
   repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
   tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
 
diff --git a/helmfile/apps/element/values-synapse-web.gotmpl b/helmfile/apps/element/values-synapse-web.gotmpl
index a4950bbe..7bb96f85 100644
--- a/helmfile/apps/element/values-synapse-web.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,7 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
   repository: {{ .Values.images.synapseWeb.repository | quote }}
   tag: {{ .Values.images.synapseWeb.tag | quote }}
 
diff --git a/helmfile/apps/element/values-synapse.gotmpl b/helmfile/apps/element/values-synapse.gotmpl
index 79f7f3d8..f01af2e8 100644
--- a/helmfile/apps/element/values-synapse.gotmpl
+++ b/helmfile/apps/element/values-synapse.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,7 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
   repository: {{ .Values.images.synapse.repository | quote }}
   tag: {{ .Values.images.synapse.tag | quote }}
 
@@ -56,7 +55,7 @@ configuration:
     guestModule:
       image:
         imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-        registry: {{ .Values.global.imageRegistry | quote }}
+        registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
         repository: {{ .Values.images.synapseGuestModule.repository | quote }}
         tag: {{ .Values.images.synapseGuestModule.tag | quote }}
 
diff --git a/helmfile/apps/element/values-well-known.gotmpl b/helmfile/apps/element/values-well-known.gotmpl
index 0d08e730..780e9b56 100644
--- a/helmfile/apps/element/values-well-known.gotmpl
+++ b/helmfile/apps/element/values-well-known.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -13,7 +12,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
   repository: {{ .Values.images.wellKnown.repository | quote }}
   tag: {{ .Values.images.wellKnown.tag | quote }}
 
diff --git a/helmfile/apps/intercom-service/helmfile.yaml b/helmfile/apps/intercom-service/helmfile.yaml
index c9cdb0b6..cd0c69bf 100644
--- a/helmfile/apps/intercom-service/helmfile.yaml
+++ b/helmfile/apps/intercom-service/helmfile.yaml
@@ -13,7 +13,7 @@ repositories:
     verify: {{ .Values.charts.intercomService.verify }}
     username: {{ .Values.charts.intercomService.username | quote }}
     password: {{ .Values.charts.intercomService.password | quote }}
-    url: "{{ .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
 
 releases:
   - name: "intercom-service"
diff --git a/helmfile/apps/intercom-service/values.gotmpl b/helmfile/apps/intercom-service/values.gotmpl
index 9fe1d10b..974fc572 100644
--- a/helmfile/apps/intercom-service/values.gotmpl
+++ b/helmfile/apps/intercom-service/values.gotmpl
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   domain: {{ .Values.global.domain | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
@@ -40,6 +39,7 @@ ics:
     audience: "opendesk-nextcloud"
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
   repository: {{ .Values.images.intercom.repository | quote }}
   tag: {{ .Values.images.intercom.tag | quote }}
 
diff --git a/helmfile/apps/jitsi/helmfile.yaml b/helmfile/apps/jitsi/helmfile.yaml
index e46c79da..f57dc652 100644
--- a/helmfile/apps/jitsi/helmfile.yaml
+++ b/helmfile/apps/jitsi/helmfile.yaml
@@ -13,7 +13,7 @@ repositories:
     verify: {{ .Values.charts.jitsi.verify }}
     username: {{ .Values.charts.jitsi.username | quote }}
     password: {{ .Values.charts.jitsi.password | quote }}
-    url: "{{ .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 
 releases:
   - name: "jitsi"
diff --git a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
index 16214536..bfdea1f8 100644
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -16,7 +15,7 @@ cleanup:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
   repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
   tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}
 
@@ -33,7 +32,7 @@ jitsi:
   web:
     replicaCount: {{ .Values.replicas.jitsi }}
     image:
-      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jitsi.repository }}"
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
       tag: {{ .Values.images.jitsi.tag | quote }}
     ingress:
       enabled: {{ .Values.ingress.enabled }}
@@ -52,7 +51,7 @@ jitsi:
       {{ .Values.resources.jitsi | toYaml | nindent 6 }}
   prosody:
     image:
-      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.prosody.repository }}"
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
       tag: {{ .Values.images.prosody.tag | quote }}
     imagePullSecrets:
     {{- range .Values.global.imagePullSecrets }}
@@ -89,7 +88,7 @@ jitsi:
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
-      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jicofo.repository }}"
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
       tag: {{ .Values.images.jicofo.tag | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
@@ -99,7 +98,7 @@ jitsi:
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
     image:
-      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jvb.repository }}"
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
       tag: {{ .Values.images.jvb.tag | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
@@ -110,7 +109,7 @@ jitsi:
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
-      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jibri.repository }}"
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
       tag: {{ .Values.images.jibri.tag | quote }}
     recorder:
       password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
@@ -129,7 +128,7 @@ patchJVB:
     loadbalancerStatusField: {{ .Values.cluster.networking.loadBalancerStatusField | quote }}
   image:
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
     repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
     tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
diff --git a/helmfile/apps/nextcloud/helmfile.yaml b/helmfile/apps/nextcloud/helmfile.yaml
index 8c7c2afa..8fc00b56 100644
--- a/helmfile/apps/nextcloud/helmfile.yaml
+++ b/helmfile/apps/nextcloud/helmfile.yaml
@@ -13,14 +13,14 @@ repositories:
     verify: {{ .Values.charts.nextcloudManagement.verify }}
     username: {{ .Values.charts.nextcloudManagement.username | quote }}
     password: {{ .Values.charts.nextcloudManagement.password | quote }}
-    url: "{{ .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
   - name: "nextcloud-repo"
     oci: {{ .Values.charts.nextcloud.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.nextcloud.verify }}
     username: {{ .Values.charts.nextcloud.username | quote }}
     password: {{ .Values.charts.nextcloud.password | quote }}
-    url: "{{ .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 
 releases:
   - name: "opendesk-nextcloud-management"
diff --git a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
index 5032144e..5e1dc042 100644
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -7,7 +7,6 @@ global:
   domain: {{ .Values.global.domain | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   istioDomain: {{ .Values.istio.domain }}
@@ -86,6 +85,7 @@ containerSecurityContext:
   runAsNonRoot: true
 
 image:
+  registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
   repository: "{{ .Values.images.nextcloudManagement.repository }}"
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.nextcloudManagement.tag | quote }}
diff --git a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
index 523a4738..cabeb9d2 100644
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
@@ -26,6 +25,7 @@ exporter:
     readOnlyRootFilesystem: true
     runAsNonRoot: true
   image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
     repository: "{{ .Values.images.nextcloudExporter.repository }}"
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudExporter.tag | quote }}
@@ -76,6 +76,7 @@ php:
     readOnlyRootFilesystem: true
     runAsNonRoot: true
   image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
     repository: "{{ .Values.images.nextcloudPHP.repository }}"
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudPHP.tag | quote }}
@@ -115,6 +116,7 @@ apache2:
     tls:
       secretName: {{ .Values.ingress.tls.secretName | quote }}
   image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudApache2.registry | quote }}
     repository: {{ .Values.images.nextcloudApache2.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudApache2.tag | quote }}
diff --git a/helmfile/apps/open-xchange/helmfile.yaml b/helmfile/apps/open-xchange/helmfile.yaml
index 2dcb2f39..dddde584 100644
--- a/helmfile/apps/open-xchange/helmfile.yaml
+++ b/helmfile/apps/open-xchange/helmfile.yaml
@@ -13,14 +13,14 @@ repositories:
     verify: {{ .Values.charts.dovecot.verify }}
     username: {{ .Values.charts.dovecot.username | quote }}
     password: {{ .Values.charts.dovecot.password | quote }}
-    url: "{{ .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
 
   # Open-Xchange
   - name: "open-xchange-repo"
     oci: {{ .Values.charts.openXchangeAppSuite.oci }}
     username: {{ .Values.charts.openXchangeAppSuite.username | quote }}
     password: {{ .Values.charts.openXchangeAppSuite.password | quote }}
-    url: "{{ .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
 
   # openDesk Open-Xchange Bootstrap
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap
@@ -30,7 +30,7 @@ repositories:
     verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
     username: {{ .Values.charts.openXchangeAppSuiteBootstrap.username | quote }}
     password: {{ .Values.charts.openXchangeAppSuiteBootstrap.password | quote }}
-    url: "{{ .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
       {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
 
 releases:
diff --git a/helmfile/apps/open-xchange/values-dovecot.gotmpl b/helmfile/apps/open-xchange/values-dovecot.gotmpl
index dbe31efe..878e1e70 100644
--- a/helmfile/apps/open-xchange/values-dovecot.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.gotmpl
@@ -4,8 +4,8 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
-  url: {{ .Values.images.dovecot.repository | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.dovecot.registry | quote }}
+  repository: {{ .Values.images.dovecot.repository | quote }}
   tag: {{ .Values.images.dovecot.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
diff --git a/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl b/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
index 3ac1f996..e80c9ae4 100644
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
@@ -8,7 +8,7 @@ cleanup:
   deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeBootstrap.registry | quote }}
   url: {{ .Values.images.openxchangeBootstrap.repository | quote }}
   tag: {{ .Values.images.openxchangeBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/open-xchange/values-openxchange.gotmpl b/helmfile/apps/open-xchange/values-openxchange.gotmpl
index b2a8f311..99e336a9 100644
--- a/helmfile/apps/open-xchange/values-openxchange.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.gotmpl
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
   mysql:
     host: {{ .Values.databases.oxAppsuite.host | quote }}
@@ -19,6 +18,7 @@ istio:
 
 nextcloud-integration-ui:
   image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
     repository: {{ .Values.images.openxchangeNextcloudIntegrationUI.repository | quote }}
     tag: {{ .Values.images.openxchangeNextcloudIntegrationUI.tag | quote }}
   imagePullSecrets:
@@ -30,6 +30,7 @@ nextcloud-integration-ui:
 
 public-sector-ui:
   image:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangePublicSectorUI.registry | quote }}
     repository: {{ .Values.images.openxchangePublicSectorUI.repository | quote }}
     tag: {{ .Values.images.openxchangePublicSectorUI.tag | quote }}
   imagePullSecrets:
@@ -63,7 +64,7 @@ appsuite:
         - name: {{ . | quote }}
       {{- end }}
       image:
-        repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
+        repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
         tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
         pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
       resources:
@@ -114,6 +115,7 @@ appsuite:
       auth:
         password: {{ .Values.secrets.redis.password | quote }}
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -134,6 +136,7 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUI.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreUI.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -150,6 +153,7 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -164,6 +168,7 @@ appsuite:
 
   core-documentconverter:
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
     resources:
@@ -175,6 +180,7 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreGuidedtours.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -183,6 +189,7 @@ appsuite:
 
   core-imageconverter:
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeImageConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeImageConverter.tag | quote }}
     resources:
@@ -194,7 +201,7 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
-      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
       tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     resources:
@@ -202,6 +209,7 @@ appsuite:
 
   core-user-guide:
     image:
+      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUserGuide.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreUserGuide.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreUserGuide.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/openproject-bootstrap/helmfile.yaml b/helmfile/apps/openproject-bootstrap/helmfile.yaml
index 0e8d2815..1ffaa314 100644
--- a/helmfile/apps/openproject-bootstrap/helmfile.yaml
+++ b/helmfile/apps/openproject-bootstrap/helmfile.yaml
@@ -13,7 +13,7 @@ repositories:
     verify: {{ .Values.charts.openprojectBootstrap.verify }}
     username: {{ .Values.charts.openprojectBootstrap.username | quote }}
     password: {{ .Values.charts.openprojectBootstrap.password | quote }}
-    url: "{{ .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
 
 releases:
   - name: "opendesk-openproject-bootstrap"
diff --git a/helmfile/apps/openproject-bootstrap/values.gotmpl b/helmfile/apps/openproject-bootstrap/values.gotmpl
index de9c3343..ae3c39dd 100644
--- a/helmfile/apps/openproject-bootstrap/values.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/values.gotmpl
@@ -7,12 +7,11 @@ global:
   domain: {{ .Values.global.domain | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
-  registry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}
   repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
   tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
diff --git a/helmfile/apps/openproject/helmfile.yaml b/helmfile/apps/openproject/helmfile.yaml
index af7230b3..fb361b49 100644
--- a/helmfile/apps/openproject/helmfile.yaml
+++ b/helmfile/apps/openproject/helmfile.yaml
@@ -13,7 +13,7 @@ repositories:
     verify: {{ .Values.charts.openproject.verify }}
     username: {{ .Values.charts.openproject.username | quote }}
     password: {{ .Values.charts.openproject.password | quote }}
-    url: "{{ .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
 
 releases:
   - name: "openproject"
diff --git a/helmfile/apps/openproject/values.gotmpl b/helmfile/apps/openproject/values.gotmpl
index 09dc8ed1..5ff1e967 100644
--- a/helmfile/apps/openproject/values.gotmpl
+++ b/helmfile/apps/openproject/values.gotmpl
@@ -8,26 +8,22 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.openproject.registry | quote }}
   repository: {{ .Values.images.openproject.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.openproject.tag | quote }}
 
 initdb:
   image:
-    registry: "{{ .Values.global.imageRegistry }}"
-    repository: "{{ .Values.images.openprojectInitDb.repository }}"
-    tag: "{{ .Values.images.openprojectInitDb.tag }}"
-    pullPolicy: "{{ .Values.global.imagePullPolicy }}"
+    registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectInitDb.registry | quote }}
+    repository: {{ .Values.images.openprojectInitDb.repository | quote }}
+    tag: {{ .Values.images.openprojectInitDb.tag | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 memcached:
   connection:
     host: {{ .Values.cache.openproject.host | quote }}
     port: {{ .Values.cache.openproject.port }}
-  image:
-    registry: {{ .Values.global.imageRegistry | quote }}
-    repository: {{ .Values.images.memcached.repository | quote }}
-    tag: {{ .Values.images.memcached.tag | quote }}
 
 postgresql:
   auth:
diff --git a/helmfile/apps/provisioning/helmfile.yaml b/helmfile/apps/provisioning/helmfile.yaml
index 1f58d3aa..7a28f5fb 100644
--- a/helmfile/apps/provisioning/helmfile.yaml
+++ b/helmfile/apps/provisioning/helmfile.yaml
@@ -10,7 +10,7 @@ repositories:
     oci: {{ .Values.charts.oxConnector.oci }}
     username: {{ .Values.charts.oxConnector.username | quote }}
     password: {{ .Values.charts.oxConnector.password | quote }}
-    url: "{{ .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
 
 releases:
   - name: "ox-connector"
diff --git a/helmfile/apps/provisioning/values-oxconnector.gotmpl b/helmfile/apps/provisioning/values-oxconnector.gotmpl
index add41ae1..c26973e9 100644
--- a/helmfile/apps/provisioning/values-oxconnector.gotmpl
+++ b/helmfile/apps/provisioning/values-oxconnector.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.oxConnector.registry | quote }}
   repository: {{ .Values.images.oxConnector.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.oxConnector.tag | quote }}
diff --git a/helmfile/apps/services/helmfile.yaml b/helmfile/apps/services/helmfile.yaml
index 037255dd..869a5706 100644
--- a/helmfile/apps/services/helmfile.yaml
+++ b/helmfile/apps/services/helmfile.yaml
@@ -13,7 +13,7 @@ repositories:
     verify: {{ .Values.charts.otterize.verify }}
     username: {{ .Values.charts.otterize.username | quote }}
     password: {{ .Values.charts.otterize.password | quote }}
-    url: "{{ .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
 
   # openDesk Certificates
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -23,7 +23,7 @@ repositories:
     verify: {{ .Values.charts.certificates.verify }}
     username: {{ .Values.charts.certificates.username | quote }}
     password: {{ .Values.charts.certificates.password | quote }}
-    url: "{{ .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
 
   # openDesk PostgreSQL
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
@@ -33,7 +33,7 @@ repositories:
     verify: {{ .Values.charts.postgresql.verify }}
     username: {{ .Values.charts.postgresql.username | quote }}
     password: {{ .Values.charts.postgresql.password | quote }}
-    url: "{{ .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
 
   # openDesk MariaDB
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -43,7 +43,7 @@ repositories:
     verify: {{ .Values.charts.mariadb.verify }}
     username: {{ .Values.charts.mariadb.username | quote }}
     password: {{ .Values.charts.mariadb.password | quote }}
-    url: "{{ .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
 
   # openDesk Postfix
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -53,7 +53,7 @@ repositories:
     verify: {{ .Values.charts.postfix.verify }}
     username: {{ .Values.charts.postfix.username | quote }}
     password: {{ .Values.charts.postfix.password | quote }}
-    url: "{{ .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
 
   # openDesk Istio Resources
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-istio-resources
@@ -63,7 +63,7 @@ repositories:
     verify: {{ .Values.charts.istioResources.verify }}
     username: {{ .Values.charts.istioResources.username | quote }}
     password: {{ .Values.charts.istioResources.password | quote }}
-    url: "{{ .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
 
   # openDesk ClamAV
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -73,14 +73,14 @@ repositories:
     verify: {{ .Values.charts.clamav.verify }}
     username: {{ .Values.charts.clamav.username | quote }}
     password: {{ .Values.charts.clamav.password | quote }}
-    url: "{{ .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
   - name: "clamav-simple-repo"
     oci: {{ .Values.charts.clamavSimple.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.clamavSimple.verify }}
     username: {{ .Values.charts.clamavSimple.username | quote }}
     password: {{ .Values.charts.clamavSimple.password | quote }}
-    url: "{{ .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
 
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
@@ -90,21 +90,21 @@ repositories:
     verify: {{ .Values.charts.memcached.verify }}
     username: {{ .Values.charts.memcached.username | quote }}
     password: {{ .Values.charts.memcached.password | quote }}
-    url: "{{ .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
   - name: "redis-repo"
     oci: {{ .Values.charts.redis.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.redis.verify }}
     username: {{ .Values.charts.redis.username | quote }}
     password: {{ .Values.charts.redis.password | quote }}
-    url: "{{ .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
   - name: "minio-repo"
     oci: {{ .Values.charts.minio.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.minio.verify }}
     username: {{ .Values.charts.minio.username | quote }}
     password: {{ .Values.charts.minio.password | quote }}
-    url: "{{ .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
 
 releases:
   - name: "opendesk-otterize"
diff --git a/helmfile/apps/services/values-clamav-distributed.gotmpl b/helmfile/apps/services/values-clamav-distributed.gotmpl
index f7010404..944177cf 100644
--- a/helmfile/apps/services/values-clamav-distributed.gotmpl
+++ b/helmfile/apps/services/values-clamav-distributed.gotmpl
@@ -7,7 +7,7 @@ clamd:
   podSecurityContext:
   replicaCount: {{ .Values.replicas.clamd }}
   image:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
     repository: {{ .Values.images.clamd.repository | quote }}
     tag: {{ .Values.images.clamd.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -18,7 +18,7 @@ freshclam:
   podSecurityContext:
   replicaCount: {{ .Values.replicas.freshclam }}
   image:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
     repository: {{ .Values.images.freshclam.repository | quote }}
     tag: {{ .Values.images.freshclam.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -32,7 +32,7 @@ global:
 icap:
   replicaCount: {{ .Values.replicas.icap }}
   image:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
     repository: {{ .Values.images.icap.repository | quote }}
     tag: {{ .Values.images.icap.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -43,7 +43,7 @@ milter:
   podSecurityContext:
   replicaCount: {{ .Values.replicas.milter }}
   image:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
     repository: {{ .Values.images.milter.repository | quote }}
     tag: {{ .Values.images.milter.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/services/values-clamav-simple.gotmpl b/helmfile/apps/services/values-clamav-simple.gotmpl
index 4c2bbaeb..08b7392d 100644
--- a/helmfile/apps/services/values-clamav-simple.gotmpl
+++ b/helmfile/apps/services/values-clamav-simple.gotmpl
@@ -7,12 +7,12 @@ replicaCount: {{ .Values.replicas.clamav }}
 
 image:
   clamav:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
     repository: {{ .Values.images.clamd.repository | quote }}
     tag: {{ .Values.images.clamd.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   icap:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
     repository: {{ .Values.images.icap.repository | quote }}
     tag: {{ .Values.images.icap.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/services/values-mariadb.gotmpl b/helmfile/apps/services/values-mariadb.gotmpl
index 977cbc01..efca6146 100644
--- a/helmfile/apps/services/values-mariadb.gotmpl
+++ b/helmfile/apps/services/values-mariadb.gotmpl
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  registry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
@@ -12,6 +11,7 @@ cleanup:
   deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
 
 image:
+  registry: {{ .Values.global.imageRegistry | default .Values.images.mariadb.registry | quote }}
   repository: {{ .Values.images.mariadb.repository | quote }}
   tag: {{ .Values.images.mariadb.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/services/values-memcached.gotmpl b/helmfile/apps/services/values-memcached.gotmpl
index 8ea26af3..05fd02b7 100644
--- a/helmfile/apps/services/values-memcached.gotmpl
+++ b/helmfile/apps/services/values-memcached.gotmpl
@@ -4,12 +4,11 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.memcached.registry | quote }}
   repository: {{ .Values.images.memcached.repository | quote }}
   tag: {{ .Values.images.memcached.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/services/values-minio.gotmpl b/helmfile/apps/services/values-minio.gotmpl
index 56b952e2..74557b12 100644
--- a/helmfile/apps/services/values-minio.gotmpl
+++ b/helmfile/apps/services/values-minio.gotmpl
@@ -4,12 +4,11 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  registry: "{{ .Values.global.imageRegistry }}"
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: "{{ .Values.global.imageRegistry }}"
+  registry: {{ .Values.global.imageRegistry | default .Values.images.minio.registry | quote }}
   repository: "{{ .Values.images.minio.repository }}"
   tag: "{{ .Values.images.minio.tag }}"
   pullPolicy: "{{ .Values.global.imagePullPolicy }}"
diff --git a/helmfile/apps/services/values-postfix.gotmpl b/helmfile/apps/services/values-postfix.gotmpl
index e859cf93..aacfbda1 100644
--- a/helmfile/apps/services/values-postfix.gotmpl
+++ b/helmfile/apps/services/values-postfix.gotmpl
@@ -4,12 +4,11 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  registry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.postfix.registry | quote }}
   repository: {{ .Values.images.postfix.repository | quote }}
   tag: {{ .Values.images.postfix.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/services/values-postgresql.gotmpl b/helmfile/apps/services/values-postgresql.gotmpl
index f6c966d2..e8d5230d 100644
--- a/helmfile/apps/services/values-postgresql.gotmpl
+++ b/helmfile/apps/services/values-postgresql.gotmpl
@@ -4,11 +4,11 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  registry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
+  registry: {{ .Values.global.imageRegistry | default .Values.images.postgresql.registry | quote }}
   repository: {{ .Values.images.postgresql.repository | quote }}
   tag: {{ .Values.images.postgresql.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/services/values-redis.gotmpl b/helmfile/apps/services/values-redis.gotmpl
index d7104197..77bd2686 100644
--- a/helmfile/apps/services/values-redis.gotmpl
+++ b/helmfile/apps/services/values-redis.gotmpl
@@ -7,13 +7,12 @@ auth:
   password: {{ .Values.secrets.redis.password | quote }}
 
 global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.redis.registry | quote }}
   repository: {{ .Values.images.redis.repository | quote }}
   tag: {{ .Values.images.redis.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/univention-management-stack/helmfile.yaml b/helmfile/apps/univention-management-stack/helmfile.yaml
index f3b8b905..877d1029 100644
--- a/helmfile/apps/univention-management-stack/helmfile.yaml
+++ b/helmfile/apps/univention-management-stack/helmfile.yaml
@@ -12,133 +12,133 @@ repositories:
     verify: {{ .Values.charts.umsGuardianManagementApi.verify }}
     username: {{ .Values.charts.umsGuardianManagementApi.username | quote }}
     password: {{ .Values.charts.umsGuardianManagementApi.password | quote }}
-    url: "{{ .Values.charts.umsGuardianManagementApi.registry }}/{{ .Values.charts.umsGuardianManagementApi.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsGuardianManagementApi.registry }}/{{ .Values.charts.umsGuardianManagementApi.repository }}"
   - name: "ums-guardian-management-ui-repo"
     oci: {{ .Values.charts.umsGuardianManagementUi.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsGuardianManagementUi.verify }}
     username: {{ .Values.charts.umsGuardianManagementUi.username | quote }}
     password: {{ .Values.charts.umsGuardianManagementUi.password | quote }}
-    url: "{{ .Values.charts.umsGuardianManagementUi.registry }}/{{ .Values.charts.umsGuardianManagementUi.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsGuardianManagementUi.registry }}/{{ .Values.charts.umsGuardianManagementUi.repository }}"
   - name: "ums-guardian-authorization-api-repo"
     oci: {{ .Values.charts.umsGuardianAuthorizationApi.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsGuardianAuthorizationApi.verify }}
     username: {{ .Values.charts.umsGuardianAuthorizationApi.username | quote }}
     password: {{ .Values.charts.umsGuardianAuthorizationApi.password | quote }}
-    url: "{{ .Values.charts.umsGuardianAuthorizationApi.registry }}/{{ .Values.charts.umsGuardianAuthorizationApi.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsGuardianAuthorizationApi.registry }}/{{ .Values.charts.umsGuardianAuthorizationApi.repository }}"
   - name: "ums-open-policy-agent-repo"
     oci: {{ .Values.charts.umsOpenPolicyAgent.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsOpenPolicyAgent.verify }}
     username: {{ .Values.charts.umsOpenPolicyAgent.username | quote }}
     password: {{ .Values.charts.umsOpenPolicyAgent.password | quote }}
-    url: "{{ .Values.charts.umsOpenPolicyAgent.registry }}/{{ .Values.charts.umsOpenPolicyAgent.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsOpenPolicyAgent.registry }}/{{ .Values.charts.umsOpenPolicyAgent.repository }}"
   - name: "ums-store-dav-repo"
     oci: {{ .Values.charts.umsStoreDav.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsStoreDav.verify }}
     username: {{ .Values.charts.umsStoreDav.username | quote }}
     password: {{ .Values.charts.umsStoreDav.password | quote }}
-    url: "{{ .Values.charts.umsStoreDav.registry }}/{{ .Values.charts.umsStoreDav.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsStoreDav.registry }}/{{ .Values.charts.umsStoreDav.repository }}"
   - name: "ums-ldap-server-repo"
     oci: {{ .Values.charts.umsLdapServer.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsLdapServer.verify }}
     username: {{ .Values.charts.umsLdapServer.username | quote }}
     password: {{ .Values.charts.umsLdapServer.password | quote }}
-    url: "{{ .Values.charts.umsLdapServer.registry }}/{{ .Values.charts.umsLdapServer.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsLdapServer.registry }}/{{ .Values.charts.umsLdapServer.repository }}"
   - name: "ums-ldap-notifier-repo"
     oci: {{ .Values.charts.umsLdapNotifier.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsLdapNotifier.verify }}
     username: {{ .Values.charts.umsLdapNotifier.username | quote }}
     password: {{ .Values.charts.umsLdapNotifier.password | quote }}
-    url: "{{ .Values.charts.umsLdapNotifier.registry }}/{{ .Values.charts.umsLdapNotifier.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsLdapNotifier.registry }}/{{ .Values.charts.umsLdapNotifier.repository }}"
   - name: "ums-udm-rest-api-repo"
     oci: {{ .Values.charts.umsUdmRestApi.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsUdmRestApi.verify }}
     username: {{ .Values.charts.umsUdmRestApi.username | quote }}
     password: {{ .Values.charts.umsUdmRestApi.password | quote }}
-    url: "{{ .Values.charts.umsUdmRestApi.registry }}/{{ .Values.charts.umsUdmRestApi.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsUdmRestApi.registry }}/{{ .Values.charts.umsUdmRestApi.repository }}"
   - name: "ums-stack-data-ums-repo"
     oci: {{ .Values.charts.umsStackDataUms.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsStackDataUms.verify }}
     username: {{ .Values.charts.umsStackDataUms.username | quote }}
     password: {{ .Values.charts.umsStackDataUms.password | quote }}
-    url: "{{ .Values.charts.umsStackDataUms.registry }}/{{ .Values.charts.umsStackDataUms.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsStackDataUms.registry }}/{{ .Values.charts.umsStackDataUms.repository }}"
   - name: "ums-stack-data-swp-repo"
     oci: {{ .Values.charts.umsStackDataSwp.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsStackDataSwp.verify }}
     username: {{ .Values.charts.umsStackDataSwp.username | quote }}
     password: {{ .Values.charts.umsStackDataSwp.password | quote }}
-    url: "{{ .Values.charts.umsStackDataSwp.registry }}/{{ .Values.charts.umsStackDataSwp.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsStackDataSwp.registry }}/{{ .Values.charts.umsStackDataSwp.repository }}"
   - name: "ums-portal-server-repo"
     oci: {{ .Values.charts.umsPortalServer.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsPortalServer.verify }}
     username: {{ .Values.charts.umsPortalServer.username | quote }}
     password: {{ .Values.charts.umsPortalServer.password | quote }}
-    url: "{{ .Values.charts.umsPortalServer.registry }}/{{ .Values.charts.umsPortalServer.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsPortalServer.registry }}/{{ .Values.charts.umsPortalServer.repository }}"
   - name: "ums-notifications-api-repo"
     oci: {{ .Values.charts.umsNotificationsApi.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsNotificationsApi.verify }}
     username: {{ .Values.charts.umsNotificationsApi.username | quote }}
     password: {{ .Values.charts.umsNotificationsApi.password | quote }}
-    url: "{{ .Values.charts.umsNotificationsApi.registry }}/{{ .Values.charts.umsNotificationsApi.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsNotificationsApi.registry }}/{{ .Values.charts.umsNotificationsApi.repository }}"
   - name: "ums-portal-listener-repo"
     oci: {{ .Values.charts.umsPortalListener.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsPortalListener.verify }}
     username: {{ .Values.charts.umsPortalListener.username | quote }}
     password: {{ .Values.charts.umsPortalListener.password | quote }}
-    url: "{{ .Values.charts.umsPortalListener.registry }}/{{ .Values.charts.umsPortalListener.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsPortalListener.registry }}/{{ .Values.charts.umsPortalListener.repository }}"
   - name: "ums-portal-frontend-repo"
     oci: {{ .Values.charts.umsPortalFrontend.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsPortalFrontend.verify }}
     username: {{ .Values.charts.umsPortalFrontend.username | quote }}
     password: {{ .Values.charts.umsPortalFrontend.password | quote }}
-    url: "{{ .Values.charts.umsPortalFrontend.registry }}/{{ .Values.charts.umsPortalFrontend.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsPortalFrontend.registry }}/{{ .Values.charts.umsPortalFrontend.repository }}"
   - name: "ums-umc-gateway-repo"
     oci: {{ .Values.charts.umsUmcGateway.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsUmcGateway.verify }}
     username: {{ .Values.charts.umsUmcGateway.username | quote }}
     password: {{ .Values.charts.umsUmcGateway.password | quote }}
-    url: "{{ .Values.charts.umsUmcGateway.registry }}/{{ .Values.charts.umsUmcGateway.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsUmcGateway.registry }}/{{ .Values.charts.umsUmcGateway.repository }}"
   - name: "ums-umc-server-repo"
     oci: {{ .Values.charts.umsUmcServer.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsUmcServer.verify }}
     username: {{ .Values.charts.umsUmcServer.username | quote }}
     password: {{ .Values.charts.umsUmcServer.password | quote }}
-    url: "{{ .Values.charts.umsUmcServer.registry }}/{{ .Values.charts.umsUmcServer.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsUmcServer.registry }}/{{ .Values.charts.umsUmcServer.repository }}"
   - name: "ums-selfservice-listener-repo"
     oci: {{ .Values.charts.umsSelfserviceListener.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsSelfserviceListener.verify }}
     username: {{ .Values.charts.umsSelfserviceListener.username | quote }}
     password: {{ .Values.charts.umsSelfserviceListener.password | quote }}
-    url: "{{ .Values.charts.umsSelfserviceListener.registry }}/{{ .Values.charts.umsSelfserviceListener.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsSelfserviceListener.registry }}/{{ .Values.charts.umsSelfserviceListener.repository }}"
   - name: "ums-provisioning-repo"
     oci: {{ .Values.charts.umsProvisioning.oci }}
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
     verify: {{ .Values.charts.umsProvisioning.verify }}
     username: {{ .Values.charts.umsProvisioning.username | quote }}
     password: {{ .Values.charts.umsProvisioning.password | quote }}
-    url: "{{ .Values.charts.umsProvisioning.registry }}/{{ .Values.charts.umsProvisioning.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsProvisioning.registry }}/{{ .Values.charts.umsProvisioning.repository }}"
 
   # Univention Keycloak Extensions
   - name: "ums-keycloak-extensions-repo"
     oci: {{ .Values.charts.umsKeycloakExtensions.oci }}
     username: {{ .Values.charts.umsKeycloakExtensions.username | quote }}
     password: {{ .Values.charts.umsKeycloakExtensions.password | quote }}
-    url: "{{ .Values.charts.umsKeycloakExtensions.registry }}/{{ .Values.charts.umsKeycloakExtensions.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsKeycloakExtensions.registry }}/{{ .Values.charts.umsKeycloakExtensions.repository }}"
   # Univention Keycloak
   - name: "ums-keycloak-repo"
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
@@ -146,21 +146,21 @@ repositories:
     oci: {{ .Values.charts.umsKeycloak.oci }}
     username: {{ .Values.charts.umsKeycloak.username | quote }}
     password: {{ .Values.charts.umsKeycloak.password | quote }}
-    url: "{{ .Values.charts.umsKeycloak.registry }}/{{ .Values.charts.umsKeycloak.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsKeycloak.registry }}/{{ .Values.charts.umsKeycloak.repository }}"
   - name: "ums-keycloak-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.umsKeycloakBootstrap.verify }}
     oci: {{ .Values.charts.umsKeycloakBootstrap.oci }}
     username: {{ .Values.charts.umsKeycloakBootstrap.username | quote }}
     password: {{ .Values.charts.umsKeycloakBootstrap.password | quote }}
-    url: "{{ .Values.charts.umsKeycloakBootstrap.registry }}/{{ .Values.charts.umsKeycloakBootstrap.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.umsKeycloakBootstrap.registry }}/{{ .Values.charts.umsKeycloakBootstrap.repository }}"
   - name: "opendesk-keycloak-bootstrap-repo"
     oci: {{ .Values.charts.opendeskKeycloakBootstrap.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
     username: {{ .Values.charts.opendeskKeycloakBootstrap.username | quote }}
     password: {{ .Values.charts.opendeskKeycloakBootstrap.password | quote }}
-    url: "{{ .Values.charts.opendeskKeycloakBootstrap.registry }}/\
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/\
       {{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
@@ -170,7 +170,7 @@ repositories:
     verify: {{ .Values.charts.nginx.verify }}
     username: {{ .Values.charts.nginx.username | quote }}
     password: {{ .Values.charts.nginx.password | quote }}
-    url: "{{ .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
 
 releases:
   - name: "ums-keycloak"
diff --git a/helmfile/apps/univention-management-stack/values-guardian-authorization-api.gotmpl b/helmfile/apps/univention-management-stack/values-guardian-authorization-api.gotmpl
index 27809ad4..9d8354ac 100644
--- a/helmfile/apps/univention-management-stack/values-guardian-authorization-api.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-guardian-authorization-api.gotmpl
@@ -7,10 +7,10 @@ guardianAuthorizationApi:
   udmDataAdapterPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
   oauthAdapterWellKnownUrl: "http://ums-keycloak:8080/realms/{{ .Values.platform.realm }}/.well-known/openid-configuration"
 image:
-  registry: {{ .Values.global.imageRegistry }}
-  repository: {{ .Values.images.umsGuardianAuthorizationApi.repository }}
-  pullPolicy: {{ .Values.global.imagePullPolicy }}
-  tag: {{ .Values.images.umsGuardianAuthorizationApi.tag }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsGuardianAuthorizationApi.registry | quote }}
+  repository: {{ .Values.images.umsGuardianAuthorizationApi.repository | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.umsGuardianAuthorizationApi.tag | quote }}
   pullSecrets:
     {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-guardian-management-api.gotmpl b/helmfile/apps/univention-management-stack/values-guardian-management-api.gotmpl
index 7737cacb..5538898a 100644
--- a/helmfile/apps/univention-management-stack/values-guardian-management-api.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-guardian-management-api.gotmpl
@@ -18,10 +18,10 @@ postgresql:
     password: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry }}
-  repository: {{ .Values.images.umsGuardianManagementApi.repository }}
-  pullPolicy: {{ .Values.global.imagePullPolicy }}
-  tag: {{ .Values.images.umsGuardianManagementApi.tag }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsGuardianManagementApi.registry | quote }}
+  repository: {{ .Values.images.umsGuardianManagementApi.repository | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.umsGuardianManagementApi.tag | quote }}
   pullSecrets:
     {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-guardian-management-ui.gotmpl b/helmfile/apps/univention-management-stack/values-guardian-management-ui.gotmpl
index 35b2792c..25879bdd 100644
--- a/helmfile/apps/univention-management-stack/values-guardian-management-ui.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-guardian-management-ui.gotmpl
@@ -9,10 +9,10 @@ guardianManagementUi:
   viteKeycloakAuthenticationAdapterRealm: {{ .Values.platform.realm | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry }}
-  repository: {{ .Values.images.umsGuardianManagementUi.repository }}
-  pullPolicy: {{ .Values.global.imagePullPolicy }}
-  tag: {{ .Values.images.umsGuardianManagementUi.tag }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsGuardianManagementUi.registry | quote }}
+  repository: {{ .Values.images.umsGuardianManagementUi.repository | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.umsGuardianManagementUi.tag | quote }}
   pullSecrets:
     {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-ldap-notifier.gotmpl b/helmfile/apps/univention-management-stack/values-ldap-notifier.gotmpl
index 63c75f26..989edb89 100644
--- a/helmfile/apps/univention-management-stack/values-ldap-notifier.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-ldap-notifier.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsLdapNotifier.registry | quote }}
   repository: {{ .Values.images.umsLdapNotifier.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsLdapNotifier.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-ldap-server.gotmpl b/helmfile/apps/univention-management-stack/values-ldap-server.gotmpl
index 36bdf8f2..fe44476a 100644
--- a/helmfile/apps/univention-management-stack/values-ldap-server.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-ldap-server.gotmpl
@@ -8,7 +8,7 @@ ldapServer:
   ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsLdapServer.registry | quote }}
   repository: {{ .Values.images.umsLdapServer.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsLdapServer.tag | quote }}
@@ -18,7 +18,7 @@ image:
     {{- end }}
 
   waitForDependency:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
     repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-notifications-api.gotmpl b/helmfile/apps/univention-management-stack/values-notifications-api.gotmpl
index 91fc45ce..110b06a6 100644
--- a/helmfile/apps/univention-management-stack/values-notifications-api.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-notifications-api.gotmpl
@@ -14,7 +14,7 @@ postgresql:
     password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsNotificationsApi.registry | quote }}
   repository: {{ .Values.images.umsNotificationsApi.repository }}
   pullPolicy: {{ .Values.global.imagePullPolicy }}
   tag: {{ .Values.images.umsNotificationsApi.tag }}
diff --git a/helmfile/apps/univention-management-stack/values-open-policy-agent.gotmpl b/helmfile/apps/univention-management-stack/values-open-policy-agent.gotmpl
index fa9633c9..10d3bcdb 100644
--- a/helmfile/apps/univention-management-stack/values-open-policy-agent.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-open-policy-agent.gotmpl
@@ -4,10 +4,10 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry }}
-  repository: {{ .Values.images.umsOpenPolicyAgent.repository }}
-  pullPolicy: {{ .Values.global.imagePullPolicy }}
-  tag: {{ .Values.images.umsOpenPolicyAgent.tag }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsOpenPolicyAgent.registry | quote }}
+  repository: {{ .Values.images.umsOpenPolicyAgent.repository | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.umsOpenPolicyAgent.tag | quote }}
   pullSecrets:
     {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl b/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
index 989646d9..eafe3c5d 100644
--- a/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -7,15 +7,14 @@ global:
   domain: "{{ .Values.global.domain }}"
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
-  registry: "{{ .Values.global.imageRegistry }}"
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: "{{ .Values.global.imageRegistry }}"
-  repository: "{{ .Values.images.opendeskKeycloakBootstrap.repository }}"
-  tag: "{{ .Values.images.opendeskKeycloakBootstrap.tag }}"
-  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
+  registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
+  repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
+  tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
diff --git a/helmfile/apps/univention-management-stack/values-portal-frontend.gotmpl b/helmfile/apps/univention-management-stack/values-portal-frontend.gotmpl
index eaaaf47e..f58c3aa4 100644
--- a/helmfile/apps/univention-management-stack/values-portal-frontend.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-portal-frontend.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsPortalFrontend.registry | quote }}
   repository: {{ .Values.images.umsPortalFrontend.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsPortalFrontend.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-portal-listener.gotmpl b/helmfile/apps/univention-management-stack/values-portal-listener.gotmpl
index 177aa4fe..f4f58620 100644
--- a/helmfile/apps/univention-management-stack/values-portal-listener.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-portal-listener.gotmpl
@@ -20,7 +20,7 @@ portalListener:
 
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsPortalListener.registry | quote }}
   repository: {{ .Values.images.umsPortalListener.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsPortalListener.tag | quote }}
@@ -30,7 +30,7 @@ image:
     {{- end }}
 
   waitForDependency:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
     repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-portal-server.gotmpl b/helmfile/apps/univention-management-stack/values-portal-server.gotmpl
index 6f5f305f..7359224f 100644
--- a/helmfile/apps/univention-management-stack/values-portal-server.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-portal-server.gotmpl
@@ -10,7 +10,7 @@ portalServer:
     authenticatorSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsPortalServer.registry | quote }}
   repository: {{ .Values.images.umsPortalServer.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsPortalServer.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-provisioning.gotmpl b/helmfile/apps/univention-management-stack/values-provisioning.gotmpl
index e52c8ca0..fcb3be6a 100644
--- a/helmfile/apps/univention-management-stack/values-provisioning.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-provisioning.gotmpl
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
 ---
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioning.registry | quote }}
   repository: {{ .Values.images.umsProvisioning.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsProvisioning.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-selfservice-listener.gotmpl b/helmfile/apps/univention-management-stack/values-selfservice-listener.gotmpl
index ba0ba53c..d3e97ca5 100644
--- a/helmfile/apps/univention-management-stack/values-selfservice-listener.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-selfservice-listener.gotmpl
@@ -21,17 +21,17 @@ image:
     {{- end }}
 
   selfserviceListener:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsSelfserviceListener.registry | quote }}
     repository: {{ .Values.images.umsSelfserviceListener.repository | quote }}
     tag: {{ .Values.images.umsSelfserviceListener.tag | quote }}
 
   selfserviceInvitation:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsSelfserviceInvitation.registry | quote }}
     repository: {{ .Values.images.umsSelfserviceInvitation.repository | quote }}
     tag: {{ .Values.images.umsSelfserviceInvitation.tag | quote }}
 
   waitForDependency:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
     repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl b/helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl
index f3ee48e7..3d9d646a 100644
--- a/helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl
@@ -34,7 +34,7 @@ stackDataContext:
   adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsDataLoader.registry | quote }}
   repository: {{ .Values.images.umsDataLoader.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsDataLoader.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-stack-data-ums.gotmpl b/helmfile/apps/univention-management-stack/values-stack-data-ums.gotmpl
index 5482c066..3fb5aaaa 100644
--- a/helmfile/apps/univention-management-stack/values-stack-data-ums.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-stack-data-ums.gotmpl
@@ -22,7 +22,7 @@ stackDataContext:
   initialPasswordAdministrator: {{ .Values.secrets.univentionManagementStack.defaultAccounts.administratorPassword | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsDataLoader.registry | quote }}
   repository: {{ .Values.images.umsDataLoader.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsDataLoader.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-store-dav.gotmpl b/helmfile/apps/univention-management-stack/values-store-dav.gotmpl
index 387905d2..644675ac 100644
--- a/helmfile/apps/univention-management-stack/values-store-dav.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-store-dav.gotmpl
@@ -9,7 +9,7 @@ storeDav:
       portal-listener: {{ .Values.secrets.univentionManagementStack.storeDavUsers.portalListener | quote }}
       portal-server: {{ .Values.secrets.univentionManagementStack.storeDavUsers.portalServer | quote }}
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsStoreDav.registry | quote }}
   repository: {{ .Values.images.umsStoreDav.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsStoreDav.tag | quote }}
@@ -19,7 +19,7 @@ image:
     {{- end }}
 
   configHtpasswd:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsConfigHtpasswd.registry | quote }}
     repository: {{ .Values.images.umsConfigHtpasswd.repository | quote }}
     pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.umsConfigHtpasswd.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-udm-rest-api.gotmpl b/helmfile/apps/univention-management-stack/values-udm-rest-api.gotmpl
index 76da8cfa..8e58aba1 100644
--- a/helmfile/apps/univention-management-stack/values-udm-rest-api.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-udm-rest-api.gotmpl
@@ -10,7 +10,7 @@ udmRestApi:
   machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsUdmRestApi.registry | quote }}
   repository: {{ .Values.images.umsUdmRestApi.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsUdmRestApi.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-umc-gateway.gotmpl b/helmfile/apps/univention-management-stack/values-umc-gateway.gotmpl
index 1dd7a667..df9399ba 100644
--- a/helmfile/apps/univention-management-stack/values-umc-gateway.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-umc-gateway.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsUmcGateway.registry | quote }}
   repository: {{ .Values.images.umsUmcGateway.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsUmcGateway.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-umc-server.gotmpl b/helmfile/apps/univention-management-stack/values-umc-server.gotmpl
index 822b1bc1..ed81826d 100644
--- a/helmfile/apps/univention-management-stack/values-umc-server.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-umc-server.gotmpl
@@ -25,7 +25,7 @@ memcached:
   server: {{ .Values.cache.umsSelfservice.host | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsUmcServer.registry | quote }}
   repository: {{ .Values.images.umsUmcServer.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.umsUmcServer.tag | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-ums-keycloak-bootstrap.yaml.gotmpl b/helmfile/apps/univention-management-stack/values-ums-keycloak-bootstrap.yaml.gotmpl
index 53c84b95..9f3e61f6 100644
--- a/helmfile/apps/univention-management-stack/values-ums-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-ums-keycloak-bootstrap.yaml.gotmpl
@@ -12,7 +12,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloakBootstrap.registry | quote }}
   repository: {{ .Values.images.umsKeycloakBootstrap.repository | quote }}
   tag: {{ .Values.images.umsKeycloakBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy }}
diff --git a/helmfile/apps/univention-management-stack/values-ums-keycloak-extensions.yaml.gotmpl b/helmfile/apps/univention-management-stack/values-ums-keycloak-extensions.yaml.gotmpl
index ceb91bd1..80c34bcf 100644
--- a/helmfile/apps/univention-management-stack/values-ums-keycloak-extensions.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-ums-keycloak-extensions.yaml.gotmpl
@@ -20,7 +20,7 @@ global:
       password: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
 handler:
   image:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloakExtensionHandler.registry | quote }}
     repository: {{ .Values.images.umsKeycloakExtensionHandler.repository | quote }}
     tag: {{ .Values.images.umsKeycloakExtensionHandler.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -48,7 +48,7 @@ postgresql:
   enabled: false
 proxy:
   image:
-    registry: {{ .Values.global.imageRegistry | quote }}
+    registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloakExtensionProxy.registry | quote }}
     repository: {{ .Values.images.umsKeycloakExtensionProxy.repository | quote }}
     tag: {{ .Values.images.umsKeycloakExtensionProxy.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/univention-management-stack/values-ums-keycloak.yaml.gotmpl b/helmfile/apps/univention-management-stack/values-ums-keycloak.yaml.gotmpl
index 46eff32f..0c868692 100644
--- a/helmfile/apps/univention-management-stack/values-ums-keycloak.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-ums-keycloak.yaml.gotmpl
@@ -7,12 +7,11 @@ global:
   domain: {{ .Values.global.domain | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | quote }}
+  registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloak.registry | quote }}
   repository: {{ .Values.images.umsKeycloak.repository | quote }}
   tag: {{ .Values.images.umsKeycloak.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
diff --git a/helmfile/apps/xwiki/helmfile.yaml b/helmfile/apps/xwiki/helmfile.yaml
index 7cc397c1..0598c5f2 100644
--- a/helmfile/apps/xwiki/helmfile.yaml
+++ b/helmfile/apps/xwiki/helmfile.yaml
@@ -11,7 +11,7 @@ repositories:
     oci: {{ .Values.charts.xwiki.oci }}
     username: {{ .Values.charts.xwiki.username | quote }}
     password: {{ .Values.charts.xwiki.password | quote }}
-    url: "{{ .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
+    url: "{{ .Values.global.imageRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
 
 releases:
   - name: "xwiki"
diff --git a/helmfile/apps/xwiki/values.yaml.gotmpl b/helmfile/apps/xwiki/values.yaml.gotmpl
index 310ee2a1..1011563c 100644
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  name: "{{ .Values.global.imageRegistry }}/{{ .Values.images.xwiki.repository }}"
+  name: "{{ .Values.global.imageRegistry | default .Values.images.xwiki.registry }}/{{ .Values.images.xwiki.repository }}"
   tag: {{ .Values.images.xwiki.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
diff --git a/helmfile/bases/environments.yaml b/helmfile/bases/environments.yaml
index 2aedf1fa..5b212664 100644
--- a/helmfile/bases/environments.yaml
+++ b/helmfile/bases/environments.yaml
@@ -10,18 +10,15 @@ environments:
     values:
       - "../../environments/default/*.gotmpl"
       - "../../environments/default/*.yaml"
-      - "../../environments/dev/values.yaml"
-      - "../../environments/dev/values.gotmpl"
+      - "../../environments/dev/values.yaml.gotmpl"
   test:
     values:
       - "../../environments/default/*.gotmpl"
       - "../../environments/default/*.yaml"
-      - "../../environments/test/values.yaml"
-      - "../../environments/test/values.gotmpl"
+      - "../../environments/test/values.yaml.gotmpl"
   prod:
     values:
       - "../../environments/default/*.gotmpl"
       - "../../environments/default/*.yaml"
-      - "../../environments/prod/values.yaml"
-      - "../../environments/prod/values.gotmpl"
+      - "../../environments/prod/values.yaml.gotmpl"
 ...
diff --git a/helmfile/environments/default/charts.yaml b/helmfile/environments/default/charts.yaml
index 0d04335d..d8cad95b 100644
--- a/helmfile/environments/default/charts.yaml
+++ b/helmfile/environments/default/charts.yaml
@@ -4,9 +4,8 @@
 charts:
   certificates:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-certificates/opendesk-certificates
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-certificates/opendesk-certificates
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-certificates"
@@ -16,12 +15,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   clamav:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-clamav/opendesk-clamav
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-clamav/opendesk-clamav
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
@@ -31,12 +30,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   clamavSimple:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-clamav/clamav-simple
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-clamav/clamav-simple
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
@@ -46,40 +45,44 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   collabora:
     # renovate:
-    # registryUrl=https://collaboraonline.github.io/online
-    # packageName=collabora-online
-    # dataSource=helm
+    # upstreamRegistry=ghcr.io/collaboraonline/charts
+    # upstreamRepository=collabora-online
     # dependencyType=supplier
-    registry: "https://collaboraonline.github.io"
-    repository: "online"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
     name: "collabora-online"
-    oci: false
-    version: "1.0.2"
+    oci: true
+    version: "1.1.8"
     username: ~
     password: ~
+    # @supplier: "Collabora"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '1', '8']
 
   cryptpad:
     # renovate:
-    # registryUrl=https://cryptpad.github.io/helm
-    # packageName=cryptpad
-    # dataSource=helm
+    # upstreamRegistry=ghcr.io/cryptpad/helm
+    # upstreamRepository=cryptpad
     # dependencyType=supplier
-    registry: "https://cryptpad.github.io"
-    repository: "helm"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
     name: "cryptpad"
-    oci: false
-    version: "0.0.14"
+    oci: true
+    version: "0.0.17"
     username: ~
     password: ~
+    # @supplier: "XWiki"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '0', '17']
 
   dovecot:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-dovecot/dovecot
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-dovecot/dovecot
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
@@ -89,12 +92,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "Open-Xchange"
 
   element:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
@@ -104,12 +107,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   elementWellKnown:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-well-known
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-well-known
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
@@ -119,27 +122,29 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   intercomService:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # packageName=souvap/tooling/charts/intercom-service/intercom-service
-    # dataSource=docker
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/intercom-service/intercom-service
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/intercom-service"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "intercom-service"
     oci: true
     version: "2.0.1"
     verify: true
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['2', '0', '1']
 
   istioResources:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-istio-resources/istio-gateway
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-istio-resources/istio-gateway
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-istio-resources"
@@ -149,12 +154,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   jitsi:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-jitsi/opendesk-jitsi
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-jitsi/opendesk-jitsi
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
@@ -164,42 +169,46 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   umsKeycloak:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # packageName=souvap/tooling/charts/univention-keycloak/ums-keycloak
-    # dataSource=docker
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention-keycloak/ums-keycloak
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention-keycloak"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ums-keycloak"
     oci: true
     version: "1.0.3"
     verify: true
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '0', '3']
 
   umsKeycloakBootstrap:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # packageName=souvap/tooling/charts/univention-keycloak-bootstrap/ums-keycloak-bootstrap
-    # dataSource=docker
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention-keycloak-bootstrap/ums-keycloak-bootstrap
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention-keycloak-bootstrap"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ums-keycloak-bootstrap"
     oci: true
     version: "1.0.1"
     verify: true
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '0', '1']
 
   opendeskKeycloakBootstrap:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap/opendesk-keycloak-bootstrap
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap/opendesk-keycloak-bootstrap
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
@@ -209,26 +218,29 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   umsKeycloakExtensions:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/77/packages/helm/stable
-    # packageName=keycloak-extensions
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/keycloak-extensions
     # dependencyType=supplier
-    registry: "https://gitlab.souvap-univention.de"
-    repository: "api/v4/projects/77/packages/helm/stable"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "keycloak-extensions"
-    oci: false
-    version: "0.1.0"
+    oci: true
+    version: "0.0.5"
+    verify: true
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '0', '3']
 
   mariadb:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-mariadb/mariadb
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-mariadb/mariadb
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-mariadb"
@@ -238,12 +250,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   matrixNeoboardWidget:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neoboard-widget
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neoboard-widget
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
@@ -253,12 +265,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   matrixNeochoiseWidget:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neochoice-widget
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neochoice-widget
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
@@ -268,12 +280,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   matrixNeodatefixBot:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-bot
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-bot
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
@@ -283,12 +295,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   matrixNeodatefixWidget:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-widget
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-widget
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
@@ -298,12 +310,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   matrixUserVerificationService:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-matrix-user-verification-service
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-matrix-user-verification-service
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
@@ -313,12 +325,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   memcached:
     # renovate:
-    # registryUrl=https://registry-1.docker.io
-    # packageName=bitnamicharts/memcached
-    # dataSource=docker
+    # upstreamRegistry=registry-1.docker.io
+    # upstreamRepository=bitnamicharts/memcached
     # dependencyType=external
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
@@ -328,12 +340,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   minio:
     # renovate:
-    # registryUrl=https://registry-1.docker.io
-    # packageName=bitnamicharts/minio
-    # dataSource=docker
+    # upstreamRegistry=registry-1.docker.io
+    # upstreamRepository=bitnamicharts/minio
     # dependencyType=external
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
@@ -343,12 +355,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   nextcloud:
     # renovate:
-    # registryUrl=https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-nextcloud
-    # packageName=opendesk-nextcloud
-    # dataSource=helm
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
@@ -358,12 +370,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   nextcloudManagement:
     # renovate:
-    # registryUrl=https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-nextcloud
-    # packageName=opendesk-nextcloud-management
-    # dataSource=helm
+    # upstreamRegistry=registry.opencode.de
+    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud-management
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
@@ -373,12 +385,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   nginx:
     # renovate:
-    # registryUrl=https://registry-1.docker.io
-    # packageName=bitnamicharts/nginx
-    # dataSource=docker
+    # upstreamRegistry=registry-1.docker.io
+    # upstreamRepository=bitnamicharts/nginx
     # dependencyType=external
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
@@ -388,27 +400,29 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   openproject:
     # renovate:
-    # registryUrl=https://ghcr.io
-    # packageName=opf/helm-charts/openproject
-    # dataSource=docker
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=opf/helm-charts/openproject
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/opf/helm-charts"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
     oci: true
     version: "3.0.2"
     verify: true
     username: ~
     password: ~
+    # @supplier: "openProject"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['3', '0', '2']
 
   openprojectBootstrap:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap/opendesk-openproject-bootstrap
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap/opendesk-openproject-bootstrap
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap"
@@ -418,26 +432,28 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   openXchangeAppSuite:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
-    # packageName=appsuite-public-sector/charts/appsuite-public-sector
-    # dataSource=docker
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/charts/appsuite-public-sector
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/appsuite-public-sector/charts"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector"
     oci: true
     version: "2.2.37"
     username: ~
     password: ~
+    # @supplier: "Open-Xchange"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['2', '2', '37']
 
   openXchangeAppSuiteBootstrap:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap/opendesk-open-xchange-bootstrap
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap/opendesk-open-xchange-bootstrap
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap"
@@ -447,12 +463,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   otterize:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
@@ -462,27 +478,29 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   oxConnector:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/128/packages/helm/stable
-    # packageName=ox-connector
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/ox-connector
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ox-connector"
     oci: true
     version: "0.4.2"
     verify: true
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '4', '2']
 
   postfix:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-postfix/postfix
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-postfix/postfix
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
@@ -492,12 +510,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   postgresql:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-postgresql/postgresql
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-postgresql/postgresql
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql"
@@ -507,12 +525,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   redis:
     # renovate:
-    # registryUrl=https://registry-1.docker.io
-    # packageName=bitnamicharts/redis
-    # dataSource=docker
+    # upstreamRegistry=registry-1.docker.io
+    # upstreamRepository=bitnamicharts/redis
     # dependencyType=external
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
@@ -522,12 +540,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   synapse:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
@@ -537,12 +555,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   synapseCreateAccount:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-create-account
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-create-account
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
@@ -552,12 +570,12 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   synapseWeb:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-web
-    # dataSource=docker
+    # upstreamRegistry=registry.opencode.de
+    # upstreamRepository=bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-web
     # dependencyType=platform
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
@@ -567,288 +585,327 @@ charts:
     verify: true
     username: ~
     password: ~
+    # @supplier: "openDesk"
 
   umsGuardianManagementApi:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/guardian-management-api
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "guardian-management-api"
     oci: true
     verify: true
     version: "0.0.1"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '0', '1']
 
   umsGuardianManagementUi:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/guardian-management-ui
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "guardian-management-ui"
     oci: true
     verify: true
     version: "0.0.1"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '0', '1']
 
   umsGuardianAuthorizationApi:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/guardian-authorization-api
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "guardian-authorization-api"
     oci: true
     verify: true
     version: "0.0.1"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '0', '1']
 
   umsOpenPolicyAgent:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/open-policy-agent
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "open-policy-agent"
     oci: true
     verify: true
     version: "0.0.1"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '0', '1']
 
   umsLdapNotifier:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=ldap-notifier
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/ldap-notifier
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ldap-notifier"
     oci: true
     verify: true
     version: "0.8.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '7', '2']
 
   umsLdapServer:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=ldap-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/ldap-server
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ldap-server"
     oci: true
     verify: true
     version: "0.8.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '7', '2']
 
   umsNotificationsApi:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=notifications-api
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/notifications-api
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "notifications-api"
     oci: true
     verify: true
     version: "0.9.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '9', '2']
 
   umsPortalFrontend:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=portal-frontend
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/portal-frontend
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "portal-frontend"
     oci: true
     verify: true
     version: "0.9.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '9', '2']
 
   umsPortalListener:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=portal-listener
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/portal-listener
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "portal-listener"
     oci: true
     verify: true
     version: "0.9.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '9', '2']
 
   umsPortalServer:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=portal-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/portal-server
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "portal-server"
     oci: true
     verify: true
     version: "0.9.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '9', '2']
 
   umsProvisioning:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=provisioning-api
-    # dataSource=helm
-    # dependencyType=vendor
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/provisioning-api
+    # dependencyType=supplier
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "provisioning-api"
     oci: true
     verify: true
     version: "0.2.1"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '2', '1']
 
   umsSelfserviceListener:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/selfservice-listener
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "selfservice-listener"
     oci: true
     verify: true
     version: "0.3.1"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '3', '1']
 
   umsStackDataSwp:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=stack-data-swp
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/stack-data-swp
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "stack-data-swp"
     oci: true
     verify: true
     version: "0.41.4"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '39', '5']
 
   umsStackDataUms:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=stack-data-ums
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/stack-data-ums
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "stack-data-ums"
     oci: true
     verify: true
     version: "0.41.4"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '39', '5']
 
   umsStoreDav:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=store-dav
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/store-dav
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "store-dav"
     oci: true
     verify: true
     version: "0.9.3"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '9', '3']
 
   umsUdmRestApi:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=udm-rest-api
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/udm-rest-api
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "udm-rest-api"
     oci: true
     verify: true
     version: "0.5.2"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '4', '3']
 
   umsUmcGateway:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-gateway
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/umc-gateway
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "umc-gateway"
     oci: true
     verify: true
     version: "0.6.4"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '6', '4']
 
   umsUmcServer:
     # renovate:
-    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-    # packageName=umc-server
-    # dataSource=helm
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/charts/univention/umc-server
     # dependencyType=supplier
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "umc-server"
     oci: true
     verify: true
     version: "0.6.4"
     username: ~
     password: ~
+    # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['0', '6', '4']
 
   xwiki:
     # renovate:
-    # registryUrl=https://xwiki-contrib.github.io/xwiki-helm
-    # packageName=xwiki
-    # dataSource=helm
+    # upstreamRegistry=git.xwikisas.com:5050/xwikisas/swp/xwiki/contrib-xwiki-helm
+    # upstreamRepository=xwiki
     # dependencyType=supplier
-    registry: "https://xwiki-contrib.github.io"
-    repository: "xwiki-helm"
-    oci: false
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
+    oci: true
     name: "xwiki"
-    version: "1.2.3"
+    version: "1.2.4"
     username: ~
     password: ~
+    # @supplier: "XWiki"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '2', '4']
 ...
diff --git a/helmfile/environments/default/global.gotmpl b/helmfile/environments/default/global.gotmpl
index 369665e1..5055a458 100644
--- a/helmfile/environments/default/global.gotmpl
+++ b/helmfile/environments/default/global.gotmpl
@@ -13,5 +13,5 @@ global:
 
   ## Define docker registry address.
   #
-  imageRegistry: {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default "external-registry.souvap-univention.de/sovereign-workplace" | quote }}
+  imageRegistry: {{ env "PRIVATE_IMAGE_REGISTRY_URL" | quote }}
 ...
diff --git a/helmfile/environments/default/global.yaml b/helmfile/environments/default/global.yaml
index fe51adf3..69500a9a 100644
--- a/helmfile/environments/default/global.yaml
+++ b/helmfile/environments/default/global.yaml
@@ -30,10 +30,6 @@ global:
     whiteboard: "whiteboard"
     xwiki: "wiki"
 
-  ## Define docker registry address.
-  #
-  imageRegistry: "external-registry.souvap-univention.de/sovereign-workplace"
-
   ## Credentials to fetch images from private registry
   ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
   #
diff --git a/helmfile/environments/default/images.yaml b/helmfile/environments/default/images.yaml
index 45529efd..a368e403 100644
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -4,656 +4,792 @@
 images:
   clamd:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "clamav/clamav"
     tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
     # @supplier: "openDesk"
   collabora:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/collabora
     # dependencyType=supplier
-    repository: "souvap/tooling/images/collabora"
-    tag: "23.05.6.3.1@sha256:cebcb5287df58f6f12bb95882f18e99f970552ce161be8fc51a541d96de53d0e"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/collabora/images-mirror/collabora"
+    tag: "23.05.6.4.1@sha256:98e2107ba9dc7d69b146d9319473fb42249c5291ef5b570c8bd6eff941564697"
     # @supplier: "Collabora"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)\.\d+\.\d+$'
     # @mirrorFrom: ['23', '5', '6']
   cryptpad:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=cryptpad/cryptpad
     # dependencyType=supplier
-    repository: "cryptpad/cryptpad"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/cryptpad"
     tag: "opendesk-20231222@sha256:f4d20d5c38c87b11ed1a1b46ef6a3633d32c6758ebdff8556458f040318fa5e2"
     # @supplier: "XWiki"
     # @mirrorFilter: '^opendesk-(\d+)$'
   dovecot:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/dovecot-public-sector
     # dependencyType=supplier
-    repository: "souvap/tooling/images/dovecot-public-sector"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/dovecot-public-sector"
     tag: "2.3.21@sha256:c76965a84d1ca527f523404eb027119f6736b199c094e4671037cb345ecad3dc"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['2', '3', '21']
   element:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.opencode.de
     # dependencyType=supplier
-    repository: "souvap/tooling/images/element-web"
-    tag: "1.8.0@sha256:63e7ebd933c4bf86504f42c9b6bb6555ce5f2289c376ffa5c1609ca57e4f3a3b"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
+    tag: "1.8.2@sha256:0595292e824c039e9c088a845b3d49c6be93d46f9f99090783eb20cb1fc27227"
     # @supplier: "Element"
-    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
-    # @mirrorFrom: ['1', '8', '0']
   freshclam:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "clamav/clamav"
     tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
     # @supplier: "openDesk"
   icap:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.opencode.de
     # dependencyType=platform
-    repository: "souvap/tooling/images/c-icap"
-    tag: "0.5.10@sha256:cd665e77a42460bb1e6df4282bc1d8737be241fc9f4143d43509e31de3a7993d"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/clamav-icap"
+    tag: "0.5.10@sha256:891f267a6b2a304616854ad2f013dc5d23f6f6c84d535c8b46e76d124fe39b6a"
     # @supplier: "openDesk"
   intercom:
     # renovate:
-    # registryUrl=https://quay.io
+    # upstreamRegistry=quay.io
+    # upstreamRepository=univention/intercom-service
     # dependencyType=supplier
-    repository: "univention/intercom-service"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/intercom-service"
     tag: "1.6@sha256:f32c1e52fa132e9dc6973e9f8ed36a98c5c3e0bcd51c60f9a683e7e528dd2306"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '6']
   jibri:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=jitsi/jibri
     # dependencyType=supplier
-    repository: "jitsi/jibri"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
     tag: "stable-8922@sha256:87aa176b44b745b13769f13b8e2d22ddd6f6ba624244d5354c8dd3664787e936"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^stable-(\d+)$'
     # @mirrorFrom: ['8922']
   jicofo:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=jitsi/jicofo
     # dependencyType=supplier
-    repository: "jitsi/jicofo"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
     tag: "stable-8922@sha256:820fcd4b072b29f42c1c37389fbefda1065f1e9654694941485dc08123c8a93b"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^stable-(\d+)$'
     # @mirrorFrom: ['8922']
   jitsi:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=jitsi/web
     # dependencyType=supplier
-    repository: "jitsi/web"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
     tag: "stable-8922@sha256:24bd4179998fe01ace1be74e53fea5308f4d91722953bb4334611e6886753f46"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^stable-(\d+)$'
     # @mirrorFrom: ['8922']
   jitsiKeycloakAdapter:
     # renovate:
-    # registryUrl=https://ghcr.io
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=nordeck/jitsi-keycloak-adapter
     # dependencyType=supplier
-    repository: "nordeck/jitsi-keycloak-adapter"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
     tag: "v20231214@sha256:2fa11007b387512aae1ce30c7b86c2d10a47889a717f13ab43d33b768df877d1"
     # @supplier: "Nordeck"
-    # @mirrorFilter: '^stable-(\d+)$'
-    # @mirrorFrom: ['8922']
+    # @mirrorFilter: '^v(\d\d\d\d)(\d\d)(\d\d)$'
+    # @mirrorFrom: ['2023', '12', '14']
   jitsiPatchJVB:
     # renovate:
-    # registryUrl=https://docker.io
-    # dependencyType=supplier
+    # upstreamRegistry=docker.io
+    # upstreamRepository=bitnami/kubectl
+    # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "bitnami/kubectl"
     tag: "1.26.8@sha256:c6902a1fdce0a24c9f93ac8d1f317039b206a4b307d8fc76cab4a92911345757"
     # @supplier: "Nordeck"
-    # @mirrorFilter: '^(\d+)\.(\d+)$'
-    # @mirrorFrom: ['1', '28', '8']
   jvb:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=jitsi/jvb
     # dependencyType=supplier
-    repository: "jitsi/jvb"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
     tag: "stable-8922@sha256:75dd613807e19cbbd440d071b60609fa9e4ee50a1396b14deb0ed779d882a554"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^stable-(\d+)$'
     # @mirrorFrom: ['8922']
   umsKeycloak:
     # renovate:
-    # registryUrl=https://docker.software-univention.de
+    # upstreamRegistry=docker.software-univention.de
+    # upstreamRepository=keycloak-keycloak
     # dependencyType=supplier
-    repository: "keycloak-keycloak"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-keycloak"
     tag: "22.0.3-ucs2@sha256:1e8e45a2e01050c1473595c3b143446363016ea292b0c599ccd9f1bd37112206"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+).+$'
     # @mirrorFrom: ['22', '0', '3']
   umsKeycloakBootstrap:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention-keycloak-bootstrap
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention-keycloak-bootstrap"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/univention-keycloak-bootstrap"
     tag: "1.0.5@sha256:81ccf77e5af77385e4d0c4ff6a7df2cec11691ea76c6c23c36eb1ef0d51ad687"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '0', '5']
   opendeskKeycloakBootstrap:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.opencode.de
     # dependencyType=platform
-    repository: "souvap/tooling/images/opendesk-keycloak-bootstrap"
-    tag: "1.0.3@sha256:b9c18294bdf5b3b79caa789e899403bbf1b485f05a0be3e09895e5161506d4a8"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
+    tag: "1.0.4@sha256:28eebb647180aef95d816a7d788891fa780f552f699c38cedddecbcef7a0bd1d"
     # @supplier: "openDesk"
   umsKeycloakExtensionHandler:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/keycloak-handler
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/keycloak-handler"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-handler"
     tag: "0.0.3@sha256:b27d76b1a397bc776b0b7e652e318fd707da4bbfba81908ed3a7ca866b2ee8cc"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '0', '3']
   umsKeycloakExtensionProxy:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/keycloak-proxy
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/keycloak-proxy"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-proxy"
     tag: "0.0.3@sha256:368c57fc4e730d2ad8e24b29f4c876f7e6dbd835a9913f5d0909159409cd5042"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '0', '3']
   mariadb:
     # renovate:
-    # registryUrl=https://docker.io
-    # dependencyType=platform
-    repository: "mariadb"
+    # upstreamRegistry=docker.io
+    # dependencyType=external
+    registry: "registry-1.docker.io"
+    repository: "library/mariadb"
     # For upgrades at least confirm compatibility of target version with OX (regarding AS Guard)
     tag: "10.5@sha256:aa1ccc18000c32d1f39ac0b055117b27bffd93e622ec961d682de40fe2a1a95f"
     # @supplier: "openDesk"
   matrixNeoBoardWidget:
     # renovate:
-    # registryUrl=https://ghcr.io
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=nordeck/matrix-neoboard-widget
     # dependencyType=supplier
-    repository: "nordeck/matrix-neoboard-widget"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-neoboard-widget"
     tag: "1.4.0@sha256:da04d6c3c3e07ec1fcb6ecec245adc48897f107a2ab84c39d8924de951744d9f"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '4', '0']
   matrixNeoChoiceWidget:
     # renovate:
-    # registryUrl=https://ghcr.io
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=nordeck/matrix-poll-widget
     # dependencyType=supplier
-    repository: "nordeck/matrix-poll-widget"
-    tag: "1.4.0@sha256:e45259b8639a9b80a4a8de1ab1f1f85500d3f855365e15e304a4df73681d56de"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-poll-widget"
+    tag: "1.4.0@sha256:216cb88aaa47449a15af9a531d60eee593cb1923c4e8fcc67c119982972911e5"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '4', '0']
   matrixNeoDateFixBot:
     # renovate:
-    # registryUrl=https://ghcr.io
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=nordeck/matrix-meetings-bot
     # dependencyType=supplier
-    repository: "nordeck/matrix-meetings-bot"
-    tag: "2.7.0@sha256:516271dc9167fe4d3b3aa5f6f2197d6266cb5d1a7571627edf50efa2cc741716"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-meetings-bot"
+    tag: "2.7.0@sha256:31e7b1fae0bdd3d712f8be1472f5b90dd567994c09a14aa5522a4ce94a1a7507"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['2', '7', '0']
   matrixNeoDateFixWidget:
     # renovate:
-    # registryUrl=https://ghcr.io
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=nordeck/matrix-meetings-widget
     # dependencyType=supplier
-    repository: "nordeck/matrix-meetings-widget"
-    tag: "1.6.0@sha256:3c957b91772b7ed882fd5d751082c7f93ae3e103b489dce1e3fcc62a7901f0eb"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-meetings-widget"
+    tag: "1.6.0@sha256:d213a410d6fb92f63aafa26517a55ffded5cf47b5314dfadc6e28ce8ede4965f"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '6', '0']
   matrixUserVerificationService:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=matrixdotorg/matrix-user-verification-service
     # dependencyType=supplier
-    repository: "matrixdotorg/matrix-user-verification-service"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/element/images-mirror/matrix-user-verification-service"
     tag: "v3.0.0@sha256:25e685d595785e2a72e75a525dac78cf8c782445454f8ac090d3702431c38008"
     # @supplier: "Element"
-    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFilter: '^v(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['3', '0', '0']
   memcached:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "bitnami/memcached"
     tag: "1.6.21-debian-11-r107@sha256:247ec29efd6030960047a623aef025021154662edf6b6d6e88c97936f164d99d"
     # @supplier: "openDesk"
   milter:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "clamav/clamav"
     tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
     # @supplier: "openDesk"
   minio:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "bitnami/minio"
     tag: "2023@sha256:bced4f2f9fc48b755ebb3e1b35e76195a978d4331bf2d0c6699dab412d3c0be7"
-    # @supplier: "openDesk DevSecOps"
+    # @supplier: "openDesk"
   nextcloudApache2:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # dependencyType=vendor
+    # registryUrl=registry.opencode.de
+    # dependencyType=platform
+    registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-apache2"
     tag: "1.1.7@sha256:f80bb93f0fda83143ebb35dab23dc02127609bed5dfa14bb659fc9ce6ebc6673"
-    # @supplier: "openDesk DevSecOps"
+    # @supplier: "openDesk"
   nextcloudExporter:
     # renovate:
-    # registryUrl=https://docker.io
-    # dependencyType=external
+    # upstreamRegistry=registry.opencode.de
+    # dependencyType=platform
+    registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-exporter"
     tag: "1.0.0@sha256:a05b0f7d7e919320285d2808ebcc20a7b7163204a1001d7d9fb5a97d97194081"
-    # @supplier: "openDesk DevSecOps"
+    # @supplier: "openDesk"
   nextcloudPHP:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # dependencyType=vendor
+    # registryUrl=registry.opencode.de
+    # dependencyType=platform
+    registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-php"
     tag: "1.6.1@sha256:21e8584f10f19b263be76a93df2658e2e845e00548d1b176ee336eb1f0e15a50"
-    # @supplier: "openDesk DevSecOps"
+    # @supplier: "openDesk"
   nextcloudManagement:
     # renovate:
-    # registryUrl=https://registry.opencode.de
-    # dependencyType=vendor
+    # registryUrl=registry.opencode.de
+    # dependencyType=platform
+    registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-management"
     tag: "1.0.11@sha256:969bdaaa24ef6091ecb8b63b4fb2f7925fa10eaf46d3997ec74f6414ac373a8d"
-    # @supplier: "openDesk DevSecOps"
+    # @supplier: "openDesk"
   openproject:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=openproject/open_desk
     # dependencyType=supplier
-    repository: "openproject/open_desk"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
     tag: "13.1.1@sha256:780ea7781f19a76f44519750db2a4ffa840a4f4f4247ceacb7731075138fe6ae"
     # @supplier: "OpenProject"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['13', '1', '1']
   openprojectInitDb:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=postgres
     # dependencyType=external
-    repository: "postgres"
+    registry: "registry-1.docker.io"
+    repository: "library/postgres"
     tag: "13@sha256:ced3ba927f4cf06e03eac7760f426a95367076fb31fe4e31b679f82d119a3519"
     # @supplier: "OpenProject"
   openprojectBootstrap:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.opencode.de
     # dependencyType=platform
-    repository: "souvap/tooling/images/opendesk-openproject-bootstrap"
-    tag: "1.1.1@sha256:09da76a9b645b3dbe5c181061f7829f82f239e7d17f7e115218a32870f7a955e"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
+    tag: "1.1.3@sha256:401afe66c418fd130088edbed5cc3b4464dc667eb609f194ea68fd30dcbd1e90"
     # @supplier: "openDesk"
   openxchangeBootstrap:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "alpine/k8s"
     tag: "1.26.8@sha256:acde24d2a8ebaafda76f464591a5ddc7d0acd08bb38b12560961c1b1c4fc85ec"
     # @supplier: "openDesk"
   openxchangeCoreGuidedtours:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/core-guidedtours
     # dependencyType=supplier
-    repository: "appsuite-public-sector/core-guidedtours"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
     tag: "8.6.0@sha256:6c20780f8c609636f2182c41709e2ee26586b4a23679fd13b15875a5f443445b"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['8', '6', '0']
   openxchangeCoreMW:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/middleware-public-sector
     # dependencyType=supplier
-    repository: "appsuite-public-sector/middleware-public-sector"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
     tag: "8.20.51@sha256:4a9cc9d6745b09a9ace2475fbbacfeff2ca66db02b6314eb8e035f28e28574a8"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['8', '20', '51']
   openxchangeCoreUI:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/core-ui
     # dependencyType=supplier
-    repository: "appsuite-public-sector/core-ui"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
     tag: "8.20.1@sha256:a8bdf83b1179ca9126bcd4e5301b818aafec5e8ac6ff25914603d74a137b65dc"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['8', '20', '1']
   openxchangeCoreUIMiddleware:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/core-ui-middleware
     # dependencyType=supplier
-    repository: "appsuite-public-sector/core-ui-middleware"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui-middleware"
     tag: "2.0.0@sha256:8082edf30498a3ac1715f2d9b3e406f240ea586e2616b97f40c207ef55dff11f"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['2', '0', '0']
   openxchangeCoreUserGuide:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/core-user-guide
     # dependencyType=supplier
-    repository: "appsuite-public-sector/core-user-guide"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
     tag: "8.20.799279@sha256:075c917a7e5ebfe57c07c3c21485ee672554616252d5c57f829f443ca987e75b"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['8', '20', '799279']
   openxchangeDocumentConverter:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/documentconverter
     # dependencyType=supplier
-    repository: "appsuite-public-sector/documentconverter"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
     tag: "8.20.50@sha256:bd11b4e5a62377aab79ebc0ebbe8da0bf54d42ce9a8ae64db0c84608570edf9f"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['8', '20', '50']
   openxchangeGotenberg:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/3rdparty/gotenberg
     # dependencyType=supplier
-    repository: "appsuite-public-sector/3rdparty/gotenberg"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/gotenberg"
     tag: "7.9.2@sha256:c97c1adb971d149222062ec46c5d749d710b38ad153c5c6ed954023e2401c9d0"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['7', '9', '2']
   openxchangeGuardUI:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/guard-ui
     # dependencyType=supplier
-    repository: "appsuite-public-sector/guard-ui"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/guard-ui"
     tag: "4.2.2@sha256:c2ff375fa3dc359c555570f5216a5451966d9b7165934980acb1bf60363b59c8"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['4', '2', '2']
   openxchangeImageConverter:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/imageconverter
     # dependencyType=supplier
-    repository: "appsuite-public-sector/imageconverter"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
     tag: "8.20.50@sha256:590a8a4c583057f6bb071247c2f8b8566c79d5d219482dcaa452b30c944c876b"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['8', '20', '50']
   openxchangeNextcloudIntegrationUI:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/nextcloud-integration-ui
     # dependencyType=supplier
-    repository: "appsuite-public-sector/nextcloud-integration-ui"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/nextcloud-integration-ui"
     tag: "1.2.0@sha256:3d0ef11196f7544a01539e6790e4402ad69e2a501312eb7c7bb128c6563d0a8d"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '2', '0']
   openxchangePublicSectorUI:
     # renovate:
-    # registryUrl=https://registry.open-xchange.com
+    # upstreamRegistry=registry.open-xchange.com
+    # upstreamRepository=appsuite-public-sector/public-sector-ui
     # dependencyType=supplier
-    repository: "appsuite-public-sector/public-sector-ui"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/public-sector-ui"
     tag: "2.2.1@sha256:cf5dc3754dfdf41844f619b0c3178d0406de3ce8dd51317ed706cb329d338fc8"
     # @supplier: "Open-Xchange"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['2', '2', '1']
   oxConnector:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/ox-connector-standalone
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/ox-connector-standalone"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ox-connector-standalone"
     tag: "0.4.2@sha256:308489c0c0e0436bbbedbd757f78875d44468992c46c8d371c584dc778b30770"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '4', '2']
   postfix:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.opencode.de
     # dependencyType=platform
-    repository: "souvap/tooling/images/postfix"
-    tag: "1.0.0@sha256:69e0c53ade77ffb89673672f5c8183ec2edfc81d4e990aca3ec594f33c55a7ac"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/postfix"
+    tag: "1.0.0@sha256:61e4661a7323101dfb51c85c5a48c345c75436f3f533176f049d2660d711a8a5"
     # @supplier: "openDesk"
   postgresql:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
-    repository: "postgres"
+    registry: "registry-1.docker.io"
+    repository: "library/postgres"
     tag: "15.4-alpine3.18@sha256:f36c528a2dc8747ea40b4cb8578da69fa75c5063fd6a71dcea3e3b2a6404ff7b"
     # @supplier: "openDesk"
   prosody:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=jitsi/prosody
     # dependencyType=supplier
-    repository: "jitsi/prosody"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
     tag: "stable-8922@sha256:243547f24ae7d686d1f0c18ee230cf93119a66f095dda282bacbf45d4bb69f77"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^stable-(\d+)$'
     # @mirrorFrom: ['8922']
   redis:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=bitnami/redis
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "bitnami/redis"
-    tag: "7.2.1-debian-11-r5@sha256:e664fa63dfe88cd099180c32f2c9a109a958f053b75d195beb48b06ffd8a0b5b"
+    tag: "7.2.3-debian-11-r2@sha256:9ac3bbf7740969d32689e360ddcfa5f672538c47f6f6cf296173c3078de0edf2"
     # @supplier: "openDesk"
   synapse:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
+    # upstreamRepository=matrixdotorg/synapse
     # dependencyType=supplier
-    repository: "matrixdotorg/synapse"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
     tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
     # @supplier: "Element"
     # @mirrorFilter: '^v(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '91', '2']
   synapseCreateUser:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "alpine/k8s"
     tag: "1.26.8@sha256:acde24d2a8ebaafda76f464591a5ddc7d0acd08bb38b12560961c1b1c4fc85ec"
     # @supplier: "Nordeck"
   synapseGuestModule:
     # renovate:
-    # registryUrl=https://ghcr.io
+    # upstreamRegistry=ghcr.io
+    # upstreamRepository=nordeck/synapse-guest-module
     # dependencyType=supplier
-    repository: "nordeck/synapse-guest-module"
-    tag: "1.0.0@sha256:e9c736d84a77df93b2dbe3e3afa7b0ca3efcbc4457677adaac5df3cc79a85923"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/synapse-guest-module"
+    tag: "1.0.0@sha256:6b3b17183a7d163148cc1bc5342604682ec67d898394fc743db2f339e61c722e"
     # @supplier: "Nordeck"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['1', '0', '0']
   synapseWeb:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "rapidfort/haproxy-official"
     tag: "2.6.6-bullseye@sha256:bf22cfb1301aae433213f5f8c687bc5d9ecc6b86daf1084be5f7a339bd27cadd"
     # @supplier: "Element"
   umsConfigHtpasswd:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/config-htpasswd
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/config-htpasswd"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/config-htpasswd"
     tag: "0.9.3@sha256:a6ae17dab54fdf75ed59078c25b4f4a6eca9ef755a78fd9a092c5a1c27473da6"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '3']
   umsDataLoader:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/data-loader
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/data-loader"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
     tag: "0.39.5@sha256:01370139fd682a20f42e7b9b7f269c5bb8e0f9a392e0119135c88abbf2c5616c"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '39', '5']
   umsGuardianManagementApi:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=docker.software-univention.de
+    # upstreamRepository=guardian-management-api-management-api
     # dependencyType=supplier
-    # This is a preview and not part of the standard deployment.
-    repository: "souvap/tooling/images/univention/guardian-management-api"
-    tag: "0.0.1-pre-jlohmer-container-ci-2@sha256:db0a109866feb79aa2cd97db957b5c68bf58d9e2b41ddb05b8859f9445361a3f"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-management-api-management-api"
+    tag: "1.0.0@sha256:16e8004a12a6a9fba47e89e1289c8a433e5f56bbd0ee26620b0ddade0bd33313"
     # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '0', '0']
   umsGuardianManagementUi:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=docker.software-univention.de
+    # upstreamRepository=guardian-management-ui-management-ui
     # dependencyType=supplier
-    # This is a preview and not part of the standard deployment.
-    repository: "souvap/tooling/images/univention/guardian-management-ui"
-    tag: "0.0.1-pre-jlohmer-container-ci-2@sha256:e47091da3a6bcabd20cedbda490324a968cd1fd683bb8feed19a6f2b0377fd8b"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-management-ui-management-ui"
+    tag: "1.0.0@sha256:e1e4e1e7fa0c7ffff09e63474b5b054cb492fbb743cad0b2ee5910bb1de6967b"
     # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '0', '0']
   umsGuardianAuthorizationApi:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=docker.software-univention.de
+    # upstreamRepository=guardian-authorization-api-authorization-api
     # dependencyType=supplier
-    # This is a preview and not part of the standard deployment.
-    repository: "souvap/tooling/images/univention/guardian-authorization-api"
-    tag: "0.0.1-pre-jlohmer-container-ci-2@sha256:54b4a2ac043443627b9ff7c5f9b88ce76e8af0b193ba9187ceebc47acc9a204f"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-authorization-api"
+    tag: "1.0.0@sha256:dee5d42131037bde99ab9d827e751bb6a16496f9c2c0380c48f1e2919d905814"
     # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '0', '0']
   umsOpenPolicyAgent:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=docker.software-univention.de
+    # upstreamRepository=guardian-authorization-api-opa
     # dependencyType=supplier
-    # This is a preview and not part of the standard deployment.
-    repository: "souvap/tooling/images/univention/guardian-opa"
-    tag: "0.0.1-pre-jlohmer-container-ci-2@sha256:bc515dfd18af8edecd0289b44bb8cbefa195d1a9c162357b8b13db8dcf63ba16"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-opa"
+    tag: "1.0.0@sha256:a5caa128eef2de1a12514727ceff0f54f647b7b1814a304728da2e1bc9e7b621"
     # @supplier: "Univention"
+    # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
+    # @mirrorFrom: ['1', '0', '0']
   umsLdapNotifier:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/ldap-notifier
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/ldap-notifier"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
     tag: "0.8.2@sha256:bb7d76fb5299e9d019aa61b5397af15063a5b341fcf2b74c65db679ca5fa873f"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '7', '2']
   umsLdapServer:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/ldap-server
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/ldap-server"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
     tag: "0.8.2@sha256:abcaec050875a8605befe13cce78f9f8eb28aa3c1764e281a8540b2a3db4a5da"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '7', '2']
   umsNotificationsApi:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/notifications-api
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/notifications-api"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
     tag: "0.9.2@sha256:4df0fd062a84afffb9b21e62d7fef594dac1920c8485fb178ee65738060db19e"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '2']
   umsPortalListener:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/portal-listener
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/portal-listener"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-listener"
     tag: "0.9.2@sha256:4d52acbabc2b2fce3c9830a154c394aae5beec53d38f399ce8865ade2d97eb55"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '2']
   umsPortalFrontend:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/portal-frontend
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/portal-frontend"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-frontend"
     tag: "0.9.2@sha256:29abefe80cea54753a85e3d020a68c6025f5b11b8fafcc84b9e71bccac86316b"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '2']
   umsPortalServer:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/portal-server
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/portal-server"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
     tag: "0.9.2@sha256:7a6468bcda5b5ee2fd24d0029435d86dca96096f28cbe32d6497bcafa683610a"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '2']
   umsWaitForDependency:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/wait-for-dependency
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/wait-for-dependency"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/wait-for-dependency"
     tag: "0.9.2@sha256:524e9bad6875bf12370dfbd5cd85df13a04e34c49d074eca34b3ca4b4efc7d8e"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '2']
   umsStoreDav:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/store-dav
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/store-dav"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/store-dav"
     tag: "0.9.3@sha256:e7b1be11933112fe22f5336ec7cd526faeac77a28120abf806d7758dc48d0596"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '9', '3']
   umsUdmRestApi:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/udm-rest-api
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/udm-rest-api"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
     tag: "0.5.2@sha256:94c8294130f6a187bb850bcaeb314a09c5aa48ab97e3f419fbeb6ddbd39a3246"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '4', '3']
   umsUmcGateway:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/umc-gateway
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/umc-gateway"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
     tag: "0.6.4@sha256:733d2eac6d358b6d78925d346db8ab6d1adff1ef3179ce8c300e25284ff2c400"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '6', '4']
   umsUmcServer:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/umc-server
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/umc-server"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
     tag: "0.6.4@sha256:ed3c11df4e51939f771a3035055b1bebc360f0971a8b1a11b7eb39cf065875eb"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '6', '4']
   umsSelfserviceListener:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/selfservice-listener
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/selfservice-listener"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-listener"
     tag: "0.3.1@sha256:eb1866c364b476258cfa535aa0c94e0da6706cf74e0f774fd80ebce22c3ce6d8"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '3', '1']
   umsSelfserviceInvitation:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/selfservice-invitation
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/selfservice-invitation"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
     tag: "0.3.1@sha256:c985e679fa2af21dce4ce5a41750aec76674858f016b6f8d962f44f90551895d"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '3', '1']
   umsProvisioning:
     # renovate:
-    # registryUrl=https://registry.souvap-univention.de
+    # upstreamRegistry=registry.souvap-univention.de
+    # upstreamRepository=souvap/tooling/images/univention/provisioning-dispatch
     # dependencyType=supplier
-    repository: "souvap/tooling/images/univention/provisioning-dispatch"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatch"
     tag: "0.2.1@sha256:5c048d0d715ac701c67a98950d87524b54e62d60c4ae39ebb4e8d0a55d0d3438"
     # @supplier: "Univention"
     # @mirrorFilter: '^(\d+)\.(\d+)\.(\d+)$'
     # @mirrorFrom: ['0', '2', '1']
   wellKnown:
     # renovate:
-    # registryUrl=https://docker.io
+    # upstreamRegistry=docker.io
     # dependencyType=external
+    registry: "registry-1.docker.io"
     repository: "library/nginx"
     tag: "1.25.2-bookworm@sha256:9504f3f64a3f16f0eaf9adca3542ff8b2a6880e6abfb13e478cca23f6380080a"
     # @supplier: "Element"
   xwiki:
     # renovate:
-    # registryUrl=https://git.xwikisas.com:5050
+    # upstreamRegistry=git.xwikisas.com:5050
+    # upstreamRepository=xwikisas/swp/xwiki
     # dependencyType=supplier
-    repository: "xwikisas/swp/xwiki"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
     tag: "0.13-mariadb-jetty-alpine@sha256:3bbf76d1e70168006213643b4079921a6904b7d97feab70ef7a2697953d50133"
     # @supplier: "XWiki"
     # @mirrorFilter: '^(\d+)\.(\d+)-.+$'
diff --git a/helmfile/environments/dev/values.gotmpl.sample b/helmfile/environments/dev/values.gotmpl.sample
deleted file mode 100644
index a00a8059..00000000
--- a/helmfile/environments/dev/values.gotmpl.sample
+++ /dev/null
@@ -1,8 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
-
-...
diff --git a/helmfile/environments/prod/values.yaml.sample b/helmfile/environments/dev/values.yaml.gotmpl.sample
similarity index 53%
rename from helmfile/environments/prod/values.yaml.sample
rename to helmfile/environments/dev/values.yaml.gotmpl.sample
index c1a20286..0ea2b7c2 100644
--- a/helmfile/environments/prod/values.yaml.sample
+++ b/helmfile/environments/dev/values.yaml.gotmpl.sample
@@ -1,6 +1,7 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-# This a sample file and could be filled with proper variable overload.
-sample: true
+sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
+global:
+  imageRegistry: "your.private.ociregistry/with_optional_path"
 ...
diff --git a/helmfile/environments/prod/values.gotmpl.sample b/helmfile/environments/prod/values.gotmpl.sample
deleted file mode 100644
index a00a8059..00000000
--- a/helmfile/environments/prod/values.gotmpl.sample
+++ /dev/null
@@ -1,8 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
-
-...
diff --git a/helmfile/environments/test/values.yaml.sample b/helmfile/environments/prod/values.yaml.gotmpl.sample
similarity index 53%
rename from helmfile/environments/test/values.yaml.sample
rename to helmfile/environments/prod/values.yaml.gotmpl.sample
index c1a20286..0ea2b7c2 100644
--- a/helmfile/environments/test/values.yaml.sample
+++ b/helmfile/environments/prod/values.yaml.gotmpl.sample
@@ -1,6 +1,7 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-# This a sample file and could be filled with proper variable overload.
-sample: true
+sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
+global:
+  imageRegistry: "your.private.ociregistry/with_optional_path"
 ...
diff --git a/helmfile/environments/test/values.gotmpl.sample b/helmfile/environments/test/values.gotmpl.sample
deleted file mode 100644
index a00a8059..00000000
--- a/helmfile/environments/test/values.gotmpl.sample
+++ /dev/null
@@ -1,8 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
-
-...
diff --git a/helmfile/environments/dev/values.yaml.sample b/helmfile/environments/test/values.yaml.gotmpl.sample
similarity index 53%
rename from helmfile/environments/dev/values.yaml.sample
rename to helmfile/environments/test/values.yaml.gotmpl.sample
index c1a20286..0ea2b7c2 100644
--- a/helmfile/environments/dev/values.yaml.sample
+++ b/helmfile/environments/test/values.yaml.gotmpl.sample
@@ -1,6 +1,7 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-# This a sample file and could be filled with proper variable overload.
-sample: true
+sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
+global:
+  imageRegistry: "your.private.ociregistry/with_optional_path"
 ...