diff --git a/.kyverno/_apps.yaml b/.kyverno/_apps.yaml
index ec390763..ca52c764 100644
--- a/.kyverno/_apps.yaml
+++ b/.kyverno/_apps.yaml
@@ -62,6 +62,9 @@ pod:
   - resource: "minio"
     kind: "Deployment"
     app: "services"
+  - resource: "cryptpad"
+    kind: "Deployment"
+    app: "cryptpad"
   - resource: "memcached"
     kind: "Deployment"
     app: "services"
diff --git a/helmfile/apps/univention-management-stack/values-provisioning.yaml.gotmpl b/helmfile/apps/univention-management-stack/values-provisioning.yaml.gotmpl
index 7bf58146..a99eca42 100644
--- a/helmfile/apps/univention-management-stack/values-provisioning.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-provisioning.yaml.gotmpl
@@ -21,13 +21,24 @@ nats:
       registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningNats.registry | quote }}
   container:
     image:
+      registry: {{ .Values.global.imageRegistry }}
       repository: {{ .Values.images.umsProvisioningNats.repository | quote }}
       tag: {{ .Values.images.umsProvisioningNats.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   natsBox:
     container:
       image:
+        registry: {{ .Values.global.imageRegistry }}
         repository: {{ .Values.images.umsProvisioningNatsBox.repository | quote }}
         tag: {{ .Values.images.umsProvisioningNatsBox.tag | quote }}
+        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  reloader:
+    image:
+      repository: {{ .Values.images.umsProvisioningNatsReloader.repository | quote }}
+      tag: {{ .Values.images.umsProvisioningNatsReloader.tag | quote }}
+      registry: {{ .Values.global.imageRegistry }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
 
 provisioningApi:
   rootPath: "/univention/provisioning-api"
diff --git a/helmfile/environments/default/images.yaml b/helmfile/environments/default/images.yaml
index 422b53e1..f5303e73 100644
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -714,6 +714,14 @@ images:
     registry: "docker.io"
     repository: "natsio/nats-box"
     tag: "0.14.1@sha256:a67913df95f1d5b265117e49e4c83228091d13d6783d80215ddcf84aba695ef4"
+  umsProvisioningNatsReloader:
+    # renovate:
+    # upstreamRegistry=docker.io
+    # upstreamRepository=nats
+    # dependencyType=external
+    registry: "docker.io"
+    repository: "natsio/nats-server-config-reloader"
+    tag: "0.14.1@sha256:77dd4c60001ffbf442c6b25592e73b4fca06ea9406c677607192788d80453783"
   umsSelfserviceInvitation:
     # renovate:
     # upstreamRegistry=registry.souvap-univention.de