diff --git a/values.yaml b/values.yaml
index 098f2f1..3270b2c 100644
--- a/values.yaml
+++ b/values.yaml
@@ -3,12 +3,16 @@
 backend:
   enabled: true
   image:
-    repository: docker.io/odoosky/tower
-    tag: "0.20.4"
-    pullPolicy: IfNotPresent  # IfNotPresent because the image is in
-                              # containerd's k8s.io namespace already
-                              # (lab1 single-server). Replace with
-                              # Always when we move to a real registry.
+    # Tower images live alongside the Docker Hub mirror on
+    # gitlab.odoosky.cloud — separate path, same registry. Pulled with
+    # the docker-mirror-pull deploy token (read-only registry scope),
+    # so every cluster that runs Tower needs the same imagePullSecret
+    # provisioned out-of-band (until cluster-platform-v3 owns it).
+    repository: registry.odoosky.cloud/odoosky/docker-mirror/tower
+    tag: "0.20.5"
+    pullPolicy: IfNotPresent
+  imagePullSecrets:
+    - name: docker-mirror-pull
   replicas: 1
   resources:
     requests: