diff --git a/values.yaml b/values.yaml
index e220adb..57a7e64 100644
--- a/values.yaml
+++ b/values.yaml
@@ -377,6 +377,16 @@ keda-add-ons-http:
   # contract uniform: 'CRDs are bootstrap, controllers are chart'.
   crds:
     install: false
+  # kube-rbac-proxy sidecar — upstream HTTP add-on 0.8.0 references
+  # gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0 which was retired from
+  # gcr.io. Override to a current image mirrored to our registry
+  # (multi-arch preserved via crane copy from quay.io/brancz upstream).
+  # Without this override the controller-manager pod ImagePullBackOffs
+  # forever and HTTPScaledObjects never reconcile.
+  images:
+    kubeRbacProxy:
+      name: registry.odoosky.cloud/odoosky/docker-mirror/kube-rbac-proxy
+      tag: v0.18.0
   interceptor:
     replicas:
       # Scale the interceptor itself with HPA on its own metrics —