diff --git a/values.yaml b/values.yaml
index 57a7e64..b54d75d 100644
--- a/values.yaml
+++ b/values.yaml
@@ -387,6 +387,13 @@ keda-add-ons-http:
     kubeRbacProxy:
       name: registry.odoosky.cloud/odoosky/docker-mirror/kube-rbac-proxy
       tag: v0.18.0
+  # imagePullSecrets — required so the kube-rbac-proxy sidecar
+  # (mirrored at registry.odoosky.cloud) can pull. The operator
+  # container itself pulls from ghcr.io which needs no auth, but
+  # k8s applies imagePullSecrets per-pod (covers all containers).
+  operator:
+    imagePullSecrets:
+      - name: docker-mirror-pull
   interceptor:
     replicas:
       # Scale the interceptor itself with HPA on its own metrics —