diff --git a/values.yaml b/values.yaml
index 3270b2c..3f5aa3b 100644
--- a/values.yaml
+++ b/values.yaml
@@ -9,7 +9,7 @@ backend:
     # so every cluster that runs Tower needs the same imagePullSecret
     # provisioned out-of-band (until cluster-platform-v3 owns it).
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower
-    tag: "0.20.5"
+    tag: "0.21.0"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull
@@ -25,9 +25,11 @@ backend:
 frontend:
   enabled: true
   image:
-    repository: docker.io/odoosky/tower-ui
-    tag: "0.19.3"
+    repository: registry.odoosky.cloud/odoosky/docker-mirror/tower-ui
+    tag: "0.20.0"
     pullPolicy: IfNotPresent
+  imagePullSecrets:
+    - name: docker-mirror-pull
   replicas: 1
   resources:
     requests: