diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 4668f320a..e1208fd24 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:release-1.28-2cff97d3b27d82d78c5d4e468a467f520cf2fbf3",
+  "image": "gcr.io/istio-testing/build-tools:release-1.28-f9981b472bc9d443db75cae7cf1f3c7ac37e8472",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",
diff --git a/Makefile.core.mk b/Makefile.core.mk
index 505e64b44..a269ee419 100644
--- a/Makefile.core.mk
+++ b/Makefile.core.mk
@@ -19,7 +19,7 @@ OLD_VARS := $(.VARIABLES)
 # Use `make print-variables` to inspect the values of the variables
 -include Makefile.vendor.mk
 
-VERSION ?= 1.28.2
+VERSION ?= 1.28.3
 MINOR_VERSION := $(shell echo "${VERSION}" | cut -f1,2 -d'.')
 
 # This version will be used to generate the OLM upgrade graph in the FBC as a version to be replaced by the new operator version defined in $VERSION.
@@ -30,7 +30,7 @@ MINOR_VERSION := $(shell echo "${VERSION}" | cut -f1,2 -d'.')
 # There are also GH workflows defined to release nightly and stable operators.
 # There is no need to define `replaces` and `skipRange` fields in the CSV as those fields are defined in the FBC and CSV values are ignored.
 # FBC is source of truth for OLM upgrade graph.
-PREVIOUS_VERSION ?= 1.28.1
+PREVIOUS_VERSION ?= 1.28.2
 
 OPERATOR_NAME ?= sailoperator
 VERSIONS_YAML_DIR ?= pkg/istioversion
diff --git a/api/v1/istio_types.go b/api/v1/istio_types.go
index 4003eb88a..f8fff3bc9 100644
--- a/api/v1/istio_types.go
+++ b/api/v1/istio_types.go
@@ -261,7 +261,7 @@ const (
 // +kubebuilder:resource:scope=Cluster,categories=istio-io
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="Namespace",type="string",JSONPath=".spec.namespace",description="The namespace for the control plane components."
-// +kubebuilder:printcolumn:name="Profile",type="string",JSONPath=".spec.values.profile",description="The selected profile (collection of value presets)."
+// +kubebuilder:printcolumn:name="Profile",type="string",JSONPath=".spec.profile",description="The selected profile (collection of value presets)."
 // +kubebuilder:printcolumn:name="Revisions",type="string",JSONPath=".status.revisions.total",description="Total number of IstioRevision objects currently associated with this object."
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.revisions.ready",description="Number of revisions that are ready."
 // +kubebuilder:printcolumn:name="In use",type="string",JSONPath=".status.revisions.inUse",description="Number of revisions that are currently being used by workloads."
diff --git a/api/v1/istiocni_types.go b/api/v1/istiocni_types.go
index c44ac83f2..c6eac04a2 100644
--- a/api/v1/istiocni_types.go
+++ b/api/v1/istiocni_types.go
@@ -168,7 +168,7 @@ const (
 // +kubebuilder:resource:scope=Cluster,categories=istio-io
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="Namespace",type="string",JSONPath=".spec.namespace",description="The namespace of the istio-cni-node DaemonSet."
-// +kubebuilder:printcolumn:name="Profile",type="string",JSONPath=".spec.values.profile",description="The selected profile (collection of value presets)."
+// +kubebuilder:printcolumn:name="Profile",type="string",JSONPath=".spec.profile",description="The selected profile (collection of value presets)."
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description="Whether the Istio CNI installation is ready to handle requests."
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.state",description="The current state of this object."
 // +kubebuilder:printcolumn:name="Version",type="string",JSONPath=".spec.version",description="The version of the Istio CNI installation."
diff --git a/bundle/manifests/sailoperator.io_istiocnis.yaml b/bundle/manifests/sailoperator.io_istiocnis.yaml
index 7eb41879d..96af0dac1 100644
--- a/bundle/manifests/sailoperator.io_istiocnis.yaml
+++ b/bundle/manifests/sailoperator.io_istiocnis.yaml
@@ -22,7 +22,7 @@ spec:
       name: Namespace
       type: string
     - description: The selected profile (collection of value presets).
-      jsonPath: .spec.values.profile
+      jsonPath: .spec.profile
       name: Profile
       type: string
     - description: Whether the Istio CNI installation is ready to handle requests.
diff --git a/bundle/manifests/sailoperator.io_istios.yaml b/bundle/manifests/sailoperator.io_istios.yaml
index 9d95ceff1..137f18d52 100644
--- a/bundle/manifests/sailoperator.io_istios.yaml
+++ b/bundle/manifests/sailoperator.io_istios.yaml
@@ -22,7 +22,7 @@ spec:
       name: Namespace
       type: string
     - description: The selected profile (collection of value presets).
-      jsonPath: .spec.values.profile
+      jsonPath: .spec.profile
       name: Profile
       type: string
     - description: Total number of IstioRevision objects currently associated with
diff --git a/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml b/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml
index b61c35601..c36e0bc63 100644
--- a/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml
+++ b/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml
@@ -45,7 +45,7 @@ metadata:
     capabilities: Seamless Upgrades
     categories: OpenShift Optional, Integration & Delivery, Networking, Security
     containerImage: ${OSSM_OPERATOR_3_3}
-    createdAt: "2026-02-02T16:07:52Z"
+    createdAt: "2026-02-10T09:56:53Z"
     description: The OpenShift Service Mesh Operator enables you to install, configure, and manage an instance of Red Hat OpenShift Service Mesh. OpenShift Service Mesh is based on the open source Istio project.
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "true"
@@ -691,6 +691,7 @@ spec:
           name: servicemesh-operator3
           spec:
             replicas: 1
+            revisionHistoryLimit: 10
             selector:
               matchLabels:
                 app.kubernetes.io/created-by: servicemeshoperator3
diff --git a/chart/crds/sailoperator.io_istiocnis.yaml b/chart/crds/sailoperator.io_istiocnis.yaml
index 3bd54cd41..2a3e21e87 100644
--- a/chart/crds/sailoperator.io_istiocnis.yaml
+++ b/chart/crds/sailoperator.io_istiocnis.yaml
@@ -22,7 +22,7 @@ spec:
       name: Namespace
       type: string
     - description: The selected profile (collection of value presets).
-      jsonPath: .spec.values.profile
+      jsonPath: .spec.profile
       name: Profile
       type: string
     - description: Whether the Istio CNI installation is ready to handle requests.
diff --git a/chart/crds/sailoperator.io_istios.yaml b/chart/crds/sailoperator.io_istios.yaml
index 7eb40450f..8f3adb56f 100644
--- a/chart/crds/sailoperator.io_istios.yaml
+++ b/chart/crds/sailoperator.io_istios.yaml
@@ -22,7 +22,7 @@ spec:
       name: Namespace
       type: string
     - description: The selected profile (collection of value presets).
-      jsonPath: .spec.values.profile
+      jsonPath: .spec.profile
       name: Profile
       type: string
     - description: Total number of IstioRevision objects currently associated with
diff --git a/chart/values.yaml b/chart/values.yaml
index bca142b2e..8d9cfcf39 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -2,6 +2,7 @@ name: sailoperator
 deployment:
   name: sail-operator
   annotations: {}
+revisionHistoryLimit: 10
 service:
   port: 8443
 serviceAccountName: sail-operator
@@ -17,6 +18,7 @@ csv:
     This version of the operator supports the following Istio versions:
 
     - v1.28-latest
+    - v1.28.3
     - v1.28.2
     - v1.28.1
     - v1.28.0
@@ -40,7 +42,7 @@ csv:
 
     [See this page](https://github.com/istio-ecosystem/sail-operator/blob/main/bundle/README.md) for instructions on how to use it.
   support: Community based
-  version: 1.28.2
+  version: 1.28.3
   icon:
     base64data: iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAACXBIWXMAAAFiAAABYgFfJ9BTAAAHL0lEQVR4nO2du24bRxSGz5LL+01kaMuX2HShnmlSi2VUBM4bKG/gdGFnl+rsBwggvUHUsTT9AIGdnoWCIIWNIJZNWKLM5Uww1K4sC6JEQrP7z8yeDyDYCHuG3F/nNmeWnpSSTMXvD3tE9Ey9gp3e0NiFWkzGgqVvEtFLvz/c8/vDNQPW4xQ2CCBim4gO/P7wFzOW4wY2CUDRIKLnfn/4xu8PvzNgPdZjmwAiukT02u8Pn5mxHHuxVQART9kb3AzbBUDsDW6GFgEMRuNHwM8QobzBkCuF1dDlAfYGo/GeAULYDCuFHngd1qAzBKgy7c1gNEa74kbYN+CQsAS6cwD15T8djMZKCOj/QhUS9jkkXE1cSaBKzF4ORuMXg9EYeQMeE9GQq4TFxF0FPAnDAtIbdEMRcF5wCUmUgZ3QGyBjcpQX/Axcg5Ek2QeIcgNkpbDLyeHXJN0I6oYh4aeE7Z5HJYd7QPtGgegEKnf8OzgkbLMITkG2glVI2AdWCXMRpL1MRO8FzMs0pAjCCiG1IjBhM0jlBQeD0RhVq3fTLAJTdgMboSeAigBkG4pJ28FKBK8HozGqVu+mMTE0cR5gFyiC1FUHpg6EsAgSwuSJoN3t7+//ALK9nZbpY6NHwh7drf8qG+VjkPnnadg7MFoA+bxPYn2tBBTBrutbyVYMhc5FUMihzDs9T2DNVLB42D4GiUCVp862jO0ZC/e8knjYnlAGsmTVKHKyMrDrXIDnFWedW/+BRPDYxVkC+w6G5LItca/5L8i6miVAzjJox8qTQbJcaIt2/QPIvMoHTDgIowVrj4bJVrUhq8UjgGmVFO4D7MaC1WcDxd2mR7kswrTaOHqBMKwbuw+Hel5p9m0blRQ+cWHU3P7TwSopvFVHJYXWnzxy4Xg4yUa5DcwHrO4POCEAOs0HMsD+gLWloTMCUE0i8eAbVCiwtlXsjgBUKCjk2rJZnQBMWxsKnBKAQrRrAlQaWhkKnBMAeV5Z3GtxKFgS9wQQhQLMEIkKBVY1iJwUgELcbnigqmDbpgaRswKYVwV31t6CrFvjBdwVgAoF1eK6LBcQpru2TBU7LQCFuLOGSgif2ZAQOi8A8rOcEF6B+wLAJ4RGTxSnQgDzhLBVRU0QGe0F0iEAlRA2KzlQh3DT5LIwNQKYdwhvNbgsvEB6BBCWhcARMiPPGaZKAAqgFzDyTEHqBAD0Ah0TvUDqBEDsBb4ilQJgL/CFVAqA2AuckVoBsBc4JbUCUIhGBdUdNMYLpFoAslnJg/YIOqbMD6ZaAOpomawVUc8fMmJeIN0CmE8R1z+DTBuxR5B6AVA2o46Zo6zDk0EWwOmzBv4Gmd5GP2yCBaAEUMw/AJWEhPYCLIAQYEkITQZZACFyrSxAphvIxhALICKTaaYxGWQBnEM2yqhkcBM1PMoCOIesFB+AOoOEygVYABcAdgYhrWEWwAVEq4YSACQZZAFcJJdtAXsCiXsBFsAlyFrpPcj046Q7gyyASxBrlRnQfKJegAVwGX62nZbWMAtgAcAw0E2yJ8ACWIColxFPHo1IzAuwABaR9+8Dm0KJ5QEsgCsANoU6SYUBFsAVyGoR9XgZSioMsACuQP00DdB8ImGABXAVamoY94OViYQBFsA1yHoJdYRMEfvUMAvgGmSlGADNx54HsACuA1sOduPeG2ABLIEs55HmYw0DLIAlkNXiP0DzsVYDLIAlkKU8Mg9gDwAn53eAS2jEeYaQBbAkoKeOR7AA0MhKAdkPiC0PYAEsSymPOkZOYTkYy6PnWQBLon6HCLyEWMIAC2BZPK8EHBMjFoABADeGiAVgALJc+Au4iljyABbAKhRz6O9LuxdgAayAzPtV8BK0zwewAFYhk2mCV8AeAA24I7ip+4IsgFXJZVGTwnN0j4mxAFZEFnLvwEtgAUBxrBJgAayIzGZQTxOLYA8Axc/eAa+gq/Nivs6LOUMwe0tCBt7RSUBSFr1PJ+vqo3lHJ+oNWgZQmAgGO703Wq6l4yLWoW6wlBPv+LMf3ugOCUneZEok5h5+3fCPpMIAC2AhQrynmfjofQ4yNJ0J72R6m6azkjcNiKbzh3+YfoOvQ9uouJ0CkPKYgtk7byYyNJkKL5jVaTJt0kyQdzJVf9EMX66irRIwWQCv3n+ctLzDT/WzOPzlBpfU2Tn8EmE44QH+JKLDMJadvW9t1IbRH/z42x+9DNFL4BpNRZv44xSA2js/OPc6u9FbG7XDGO2mAjUqHuz0hjf9rLoEsBe+5jd8a6N2oOm6zGK0DIdoEcDWRm1Px3WYlVCl4P5NvzLuBNqLFg/AArAXLXsC3Ao2m0srJfUe7PS0JNIsACwXK6WzV7DTSySRZgHEy4fL/nuTvMHXwQK4Oa/CKwzP32hdu3VxwwK4notxeN580dGEMQEWwJc4HFuiZTJpEEAUh2GJlsm4IIBFiZY1cRiJLQI4n2iRa3EYBhH9D18eNW58bi76AAAAAElFTkSuQmCC
     mediatype: image/png
@@ -64,7 +66,7 @@ csv:
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "true"
     features.operators.openshift.io/csi: "false"
-image: quay.io/sail-dev/sail-operator:1.28.2
+image: quay.io/sail-dev/sail-operator:1.28.3
 # We're commenting out the imagePullPolicy to use k8s defaults
 # imagePullPolicy: Always
 operator:
diff --git a/common/.commonfiles.sha b/common/.commonfiles.sha
index b484d979f..327a2c96a 100644
--- a/common/.commonfiles.sha
+++ b/common/.commonfiles.sha
@@ -1 +1 @@
-b8b8db82eed504be6b80afb40907f1cbb3320583
+92d453c8df96a751019e0181041a21f089eb44c2
diff --git a/common/scripts/setup_env.sh b/common/scripts/setup_env.sh
index 44230cae9..423d16744 100755
--- a/common/scripts/setup_env.sh
+++ b/common/scripts/setup_env.sh
@@ -77,7 +77,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=release-1.28-2cff97d3b27d82d78c5d4e468a467f520cf2fbf3
+  IMAGE_VERSION=release-1.28-f9981b472bc9d443db75cae7cf1f3c7ac37e8472
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools
diff --git a/go.mod b/go.mod
index 92e8fdbea..fe746d6d3 100644
--- a/go.mod
+++ b/go.mod
@@ -26,8 +26,8 @@ require (
 	gomodules.xyz/jsonpatch/v2 v2.5.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.18.6
-	istio.io/client-go v1.28.2
-	istio.io/istio v0.0.0-20251217200826-ab413ac6c1f4
+	istio.io/client-go v1.28.3
+	istio.io/istio v0.0.0-20260121122629-fea0e6ad9627
 	k8s.io/api v0.34.3
 	k8s.io/apiextensions-apiserver v0.34.3
 	k8s.io/apimachinery v0.34.3
@@ -169,7 +169,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	istio.io/api v1.28.2-0.20251205082437-fde1452f70bc // indirect
+	istio.io/api v1.28.3 // indirect
 	k8s.io/apiserver v0.34.3 // indirect
 	k8s.io/component-base v0.34.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
diff --git a/go.sum b/go.sum
index 5b145db3c..0bb284031 100644
--- a/go.sum
+++ b/go.sum
@@ -481,12 +481,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 helm.sh/helm/v3 v3.18.6 h1:S/2CqcYnNfLckkHLI0VgQbxgcDaU3N4A/46E3n9wSNY=
 helm.sh/helm/v3 v3.18.6/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
-istio.io/api v1.28.2-0.20251205082437-fde1452f70bc h1:nwdcIg0kzCQiNMwVh2b84bsuYC1UHD7Xge/pQ9HWwDw=
-istio.io/api v1.28.2-0.20251205082437-fde1452f70bc/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
-istio.io/client-go v1.28.2 h1:Nip37oU/gFoqoWIRNDoEbpFZETnL4GujMDtQYJf+U9g=
-istio.io/client-go v1.28.2/go.mod h1:bFfn5BZ4EHeLLOVbXIfjuckSC31uADdGhbmB69QwECg=
-istio.io/istio v0.0.0-20251217200826-ab413ac6c1f4 h1:ZjvJ/8XwORLRdv0CBMQ5N8fLnw9FUP01CShxrB58fcQ=
-istio.io/istio v0.0.0-20251217200826-ab413ac6c1f4/go.mod h1:qwRUYVbjx8/vp9kAv9D/9IGCM+kUbcnfrF93nimXhuk=
+istio.io/api v1.28.3 h1:mW2m+RGA/qM+xVYg9aqUXrWXwZqQg1WKEMkuU0Ef2c8=
+istio.io/api v1.28.3/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
+istio.io/client-go v1.28.3 h1:4SV2PU4dJGTpQcPa8pE0f7yzz9cXZlsp721PyZKR0VE=
+istio.io/client-go v1.28.3/go.mod h1:bFfn5BZ4EHeLLOVbXIfjuckSC31uADdGhbmB69QwECg=
+istio.io/istio v0.0.0-20260121122629-fea0e6ad9627 h1:037Ror5F7Hjk7+Sn6/Wbt8ByV8iyI7DHIwynI40Qc8A=
+istio.io/istio v0.0.0-20260121122629-fea0e6ad9627/go.mod h1:KjEDaCXCRuLkL6xQ3vQ7AJmfw+tVBzPP642bkMPz0Mg=
 k8s.io/api v0.34.3 h1:D12sTP257/jSH2vHV2EDYrb16bS7ULlHpdNdNhEw2S4=
 k8s.io/api v0.34.3/go.mod h1:PyVQBF886Q5RSQZOim7DybQjAbVs8g7gwJNhGtY5MBk=
 k8s.io/apiextensions-apiserver v0.34.3 h1:p10fGlkDY09eWKOTeUSioxwLukJnm+KuDZdrW71y40g=
diff --git a/pkg/istioversion/versions.yaml b/pkg/istioversion/versions.yaml
index 6fda1b06b..6b2449121 100644
--- a/pkg/istioversion/versions.yaml
+++ b/pkg/istioversion/versions.yaml
@@ -16,7 +16,17 @@
 # to avoid breaking API guarantees.
 versions:
   - name: v1.28-latest
-    ref: v1.28.2
+    ref: v1.28.3
+  - name: v1.28.3
+    version: 1.28.3
+    repo: https://github.com/istio/istio
+    commit: 1.28.3
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.28.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.28.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.28.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.28.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.28.3.tgz
   - name: v1.28.2
     version: 1.28.2
     repo: https://github.com/istio/istio
diff --git a/tests/e2e/README.md b/tests/e2e/README.md
index e4ee6a3b5..f9abed675 100644
--- a/tests/e2e/README.md
+++ b/tests/e2e/README.md
@@ -15,6 +15,7 @@ This end-to-end test suite utilizes Ginkgo, a testing framework known for its ex
     1. [Pre-requisites](#pre-requisites)
     1. [How to Run the test](#how-to-run-the-test)
     1. [Running the test locally](#running-the-test-locally)
+    1. [Test Run scenarios while running on OCP](#test-run-scenarios-while-running-on-ocp)
     1. [Settings for end-to-end test execution](#settings-for-end-to-end-test-execution)
     1. [Customizing the test run](#customizing-the-test-run)    
     1. [Get test definitions for the end-to-end test](#get-test-definitions-for-the-end-to-end-test)
@@ -248,6 +249,35 @@ Note: if you are running the test against a cluster that has a different archite
 TARGET_ARCH=arm64 make test.e2e.ocp
 ```
 
+#### Test Run scenarios while running on OCP
+When running the E2E test on OpenShift clusters, the framework supports three different registry scenarios:
+
+**Scenario 1: Test run with Internal Registry (Default behaviour)**
+For test run on OpenShift with the default settings, no additional configuration is needed. The test scripts will automatically configure and use the OpenShift internal registry:
+
+```sh
+# No HUB setting needed - uses internal registry by default
+make test.e2e.ocp
+```
+
+**Scenario 2: Test run with CI Mode with External Registry**
+In CI environments, set `CI=true` to use external registries with proper tagging:
+
+```sh
+export CI=true
+# Uses default HUB=quay.io/sail-dev with auto-generated tags if no PR_NUMBER var is being set 
+make test.e2e.ocp
+```
+
+**Scenario 3: Test run with custom External Registry**
+For custom external registries, specify your own HUB value:
+
+```sh
+export HUB=your-registry.com/your-namespace
+export TAG=your-tag
+make test.e2e.ocp
+```
+
 ### Settings for end-to-end test execution
 
 The following environment variables define the behavior of the test run:
diff --git a/tests/e2e/common-operator-integ-suite.sh b/tests/e2e/common-operator-integ-suite.sh
index 8a264eae3..abf4c75c2 100755
--- a/tests/e2e/common-operator-integ-suite.sh
+++ b/tests/e2e/common-operator-integ-suite.sh
@@ -123,12 +123,39 @@ initialize_variables() {
   OPERATOR_SDK=${LOCALBIN}/operator-sdk
   IP_FAMILY=${IP_FAMILY:-ipv4}
   ISTIO_MANIFEST="chart/samples/istio-sample.yaml"
+  CI=${CI:-"false"}
 
   # export to be sure that the variables are available in the subshell
   export IMAGE_BASE="${IMAGE_BASE:-sail-operator}"
   export TAG="${TAG:-latest}"
   export HUB="${HUB:-localhost:5000}"
 
+  # Handle OCP registry scenarios
+  # Note: Makefile.core.mk sets HUB=quay.io/sail-dev and TAG=1.29-latest by default
+  if [ "${OCP}" == "true" ]; then
+    if [ "${CI}" == "true" ] && [ "${HUB}" == "quay.io/sail-dev" ]; then
+      # Scenario 2: CI mode with default HUB -> use external registry with proper CI tag
+      echo "CI mode detected for OCP, using external registry ${HUB}"
+
+      # Use PR_NUMBER if available, otherwise generate timestamp tag
+      if [ -n "${PR_NUMBER:-}" ]; then
+        export TAG="pr-${PR_NUMBER}"
+        echo "Using PR-based tag: ${TAG}"
+      else
+        TAG="ci-test-$(date +%s)"
+        export TAG
+        echo "Using timestamp-based tag: ${TAG}"
+      fi
+    elif [ "${HUB}" != "quay.io/sail-dev" ]; then
+      # Scenario 3: Custom registry provided by user
+      echo "Using custom registry: ${HUB}"
+    else
+      # Scenario 1: Local development -> use internal OCP registry
+      echo "Local development mode, will use OCP internal registry"
+      export USE_INTERNAL_REGISTRY="true"
+    fi
+  fi
+
   echo "Setting Istio manifest file: ${ISTIO_MANIFEST}"
   ISTIO_NAME=$(yq eval '.metadata.name' "${WD}/../../$ISTIO_MANIFEST")
 
@@ -215,7 +242,7 @@ parse_flags "$@"
 initialize_variables
 
 # Export necessary vars
-export COMMAND OCP HUB IMAGE_BASE TAG NAMESPACE
+export COMMAND OCP HUB IMAGE_BASE TAG NAMESPACE USE_INTERNAL_REGISTRY
 
 if [ "${SKIP_BUILD}" == "false" ]; then
   "${WD}/setup/build-and-push-operator.sh"
@@ -224,9 +251,13 @@ if [ "${SKIP_BUILD}" == "false" ]; then
     # This is a workaround when pulling the image from internal registry
     # To avoid errors of certificates meanwhile we are pulling the operator image from the internal registry
     # We need to set image $HUB to a fixed known value after the push
-    # This value always will be equal to the svc url of the internal registry
-    HUB="image-registry.openshift-image-registry.svc:5000/istio-images"
-    echo "Using internal registry: ${HUB}"
+    # Convert from route URL to service URL format for image pulling
+    if [[ "${HUB}" == *"/istio-images" ]]; then
+      HUB="image-registry.openshift-image-registry.svc:5000/istio-images"
+      echo "Using internal registry service URL: ${HUB}"
+    else
+      echo "Using external registry: ${HUB}"
+    fi
 
     # Workaround for OCP helm operator installation issues:
     # To avoid any cleanup issues, after we build and push the image we check if the namespace exists and delete it if it does.
diff --git a/tests/e2e/setup/build-and-push-operator.sh b/tests/e2e/setup/build-and-push-operator.sh
index f4527fa45..fadc990c8 100755
--- a/tests/e2e/setup/build-and-push-operator.sh
+++ b/tests/e2e/setup/build-and-push-operator.sh
@@ -85,8 +85,12 @@ build_and_push_operator_image() {
 }
 
 # Main logic
-if [ "${OCP}" == "true" ]; then
+# Only use internal registry for OCP local development (when USE_INTERNAL_REGISTRY is set)
+if [ "${OCP}" == "true" ] && [ "${USE_INTERNAL_REGISTRY:-false}" == "true" ]; then
+  echo "Setting up OCP internal registry for local development..."
   get_internal_registry
 fi
 
+echo "Registry: ${HUB}"
+
 build_and_push_operator_image
\ No newline at end of file