diff --git a/docs/src/user-docs/guides-k8s-deployment.md b/docs/src/user-docs/guides-k8s-deployment.md
index eaf9003567..6dcd0a27c3 100644
--- a/docs/src/user-docs/guides-k8s-deployment.md
+++ b/docs/src/user-docs/guides-k8s-deployment.md
@@ -195,6 +195,27 @@ image:
     pullPolicy: "Never"  # Use "Never" for local images, "IfNotPresent" for remote
     tag: "latest"
 
+  # Override third-party container images (useful for private registries or AWS Marketplace ECR).
+  # See the chart's values.yaml for the full list of configurable images.
+  mariadb:
+    repository: "mariadb"
+    tag: "10.11.16"
+  mysql:
+    repository: "mysql"
+    tag: "8.0.46"
+  queue:
+    repository: "rabbitmq"
+    tag: "4.2.6"
+  redis:
+    repository: "redis"
+    tag: "7.4.8"
+  resultsCache:
+    repository: "mongo"
+    tag: "8.0.21"
+  kubectl:
+    repository: "bitnami/kubectl"
+    digest: "sha256:98736aabcecb8d3cbcdcd7b132d14b1d67ed99bac2f06d471f06235933103df3"  # v1.36.0
+
 # Adjust worker concurrency
 workerConcurrency: 16
 
diff --git a/tools/deployment/package-helm/.set-up-common.sh b/tools/deployment/package-helm/.set-up-common.sh
index 294de226a1..860660e883 100755
--- a/tools/deployment/package-helm/.set-up-common.sh
+++ b/tools/deployment/package-helm/.set-up-common.sh
@@ -45,11 +45,13 @@ prepare_environment() {
 # flags for using it. If image is not specified, returns empty string.
 #
 # @param {string} cluster_name Name of the kind cluster
+# @param {string} component Flat image component name (e.g., "clpPackage", "redis", "queue")
 # @param {string} [image] Docker image (e.g., "clp-package:dev-junhao-a6bf")
 # @return Prints helm --set flags to stdout
 get_image_helm_args() {
     local cluster_name=$1
-    local image="${2:-}"
+    local component=$2
+    local image="${3:-}"
 
     if [[ -z "${image}" ]]; then
         return
@@ -67,9 +69,9 @@ get_image_helm_args() {
         echo "Error: '${image}' is not a valid image reference (expected repo:tag)." >&2
         return 1
     fi
-    echo "--set" "image.clpPackage.repository=${repo}" \
-         "--set" "image.clpPackage.tag=${tag}" \
-         "--set" "image.clpPackage.pullPolicy=Never"
+    echo "--set" "image.${component}.repository=${repo}" \
+         "--set" "image.${component}.tag=${tag}" \
+         "--set" "image.${component}.pullPolicy=Never"
 }
 
 # Parses common arguments shared across set-up scripts.
diff --git a/tools/deployment/package-helm/Chart.yaml b/tools/deployment/package-helm/Chart.yaml
index 36afdc6a98..6962667ebc 100644
--- a/tools/deployment/package-helm/Chart.yaml
+++ b/tools/deployment/package-helm/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: "v2"
 name: "clp"
-version: "0.3.2-dev.9"
+version: "0.3.2-dev.10"
 description: "A Helm chart for CLP's (Compressed Log Processor) package deployment"
 type: "application"
 appVersion: "0.12.1-dev"
diff --git a/tools/deployment/package-helm/set-up-multi-dedicated-test.sh b/tools/deployment/package-helm/set-up-multi-dedicated-test.sh
index 715eb06c0f..6bf9f77810 100755
--- a/tools/deployment/package-helm/set-up-multi-dedicated-test.sh
+++ b/tools/deployment/package-helm/set-up-multi-dedicated-test.sh
@@ -161,6 +161,6 @@ helm install test "${script_dir}" \
     --set "scheduling.webui.nodeSelector.yscope\.io/nodeType=core" \
     --set "scheduling.mcpServer.nodeSelector.yscope\.io/nodeType=core" \
     $(get_presto_helm_args) \
-    $(get_image_helm_args "${CLUSTER_NAME}" "${CLP_PACKAGE_IMAGE}")
+    $(get_image_helm_args "${CLUSTER_NAME}" "clpPackage" "${CLP_PACKAGE_IMAGE}")
 
 wait_for_cluster_ready
diff --git a/tools/deployment/package-helm/set-up-multi-shared-test.sh b/tools/deployment/package-helm/set-up-multi-shared-test.sh
index 210bcb8801..5d2952cf00 100755
--- a/tools/deployment/package-helm/set-up-multi-shared-test.sh
+++ b/tools/deployment/package-helm/set-up-multi-shared-test.sh
@@ -51,6 +51,6 @@ helm install test "${script_dir}" \
     --set "scheduling.reducer.replicas=${REDUCER_REPLICAS}" \
     --set "scheduling.prestoWorker.replicas=${PRESTO_WORKER_REPLICAS}" \
     $(get_presto_helm_args) \
-    $(get_image_helm_args "${CLUSTER_NAME}" "${CLP_PACKAGE_IMAGE}")
+    $(get_image_helm_args "${CLUSTER_NAME}" "clpPackage" "${CLP_PACKAGE_IMAGE}")
 
 wait_for_cluster_ready
diff --git a/tools/deployment/package-helm/set-up-test.sh b/tools/deployment/package-helm/set-up-test.sh
index f396ef9e14..6ee373b9c1 100755
--- a/tools/deployment/package-helm/set-up-test.sh
+++ b/tools/deployment/package-helm/set-up-test.sh
@@ -30,6 +30,6 @@ sleep 2
 # shellcheck disable=SC2046
 helm install test "${script_dir}" \
     $(get_presto_helm_args) \
-    $(get_image_helm_args "${CLUSTER_NAME}" "${CLP_PACKAGE_IMAGE}")
+    $(get_image_helm_args "${CLUSTER_NAME}" "clpPackage" "${CLP_PACKAGE_IMAGE}")
 
 wait_for_cluster_ready
diff --git a/tools/deployment/package-helm/templates/_helpers.tpl b/tools/deployment/package-helm/templates/_helpers.tpl
index 6f35239a28..2dabc4ee60 100644
--- a/tools/deployment/package-helm/templates/_helpers.tpl
+++ b/tools/deployment/package-helm/templates/_helpers.tpl
@@ -125,22 +125,30 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
-Creates image reference for the CLP Package.
+Creates a container image reference from .Values.image.
 
-@return {string} Full image reference (repository:tag)
-*/}}
-{{- define "clp.image.ref" -}}
-{{- $tag := .Values.image.clpPackage.tag | default .Chart.AppVersion }}
-{{- printf "%s:%s" .Values.image.clpPackage.repository $tag }}
-{{- end }}
-
-{{/*
-Creates image reference for the kubectl image.
+Renders repository@digest when "digest" is set; otherwise, renders repository:tag. clpPackage
+defaults to Chart.AppVersion when "tag" is omitted; other components require "tag".
 
-@return {string} Full image reference (repository@digest)
+@param {object} root Root template context (required)
+@param {string} component Key under .Values.image (e.g., "clpPackage", "redis")
+@return {string} Full image reference (repository@digest or repository:tag)
 */}}
-{{- define "clp.kubectl.image.ref" -}}
-{{- printf "%s@%s" .Values.image.kubectl.repository .Values.image.kubectl.digest }}
+{{- define "clp.imageRef" -}}
+{{- $img := index .root.Values.image .component -}}
+{{- if $img.digest -}}
+{{- printf "%s@%s" $img.repository $img.digest -}}
+{{- else -}}
+{{- $tag := $img.tag -}}
+{{- if not $tag -}}
+  {{- if eq .component "clpPackage" -}}
+    {{- $tag = .root.Chart.AppVersion -}}
+  {{- else -}}
+    {{- fail (printf "image.%s.tag is required" .component) -}}
+  {{- end -}}
+{{- end -}}
+{{- printf "%s:%s" $img.repository $tag -}}
+{{- end -}}
 {{- end }}
 
 {{/*
@@ -502,7 +510,8 @@ should be the job name suffix.
 */}}
 {{- define "clp.waitFor" -}}
 name: "wait-for-{{ .name }}"
-image: {{ include "clp.kubectl.image.ref" .root | quote }}
+image: {{ include "clp.imageRef" (dict "root" .root "component" "kubectl") | quote }}
+imagePullPolicy: {{ .root.Values.image.kubectl.pullPolicy | quote }}
 command: [
   "kubectl", "wait",
   {{- if eq .type "service" }}
diff --git a/tools/deployment/package-helm/templates/api-server-deployment.yaml b/tools/deployment/package-helm/templates/api-server-deployment.yaml
index 2da5ae9944..e67aeb0353 100644
--- a/tools/deployment/package-helm/templates/api-server-deployment.yaml
+++ b/tools/deployment/package-helm/templates/api-server-deployment.yaml
@@ -33,7 +33,7 @@ spec:
         - {{- include "clp.waitForResultsCache" . | nindent 10 }}
       containers:
         - name: "api-server"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             {{- include "clp.telemetryEnv" . | nindent 12 }}
diff --git a/tools/deployment/package-helm/templates/compression-scheduler-deployment.yaml b/tools/deployment/package-helm/templates/compression-scheduler-deployment.yaml
index 11f6855bc5..d742f5e022 100644
--- a/tools/deployment/package-helm/templates/compression-scheduler-deployment.yaml
+++ b/tools/deployment/package-helm/templates/compression-scheduler-deployment.yaml
@@ -45,7 +45,7 @@ spec:
         {{- end }}
       containers:
         - name: "compression-scheduler"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - {{- include "clp.celeryBrokerUrlEnvVar" . | nindent 14 }}
diff --git a/tools/deployment/package-helm/templates/compression-worker-deployment.yaml b/tools/deployment/package-helm/templates/compression-worker-deployment.yaml
index f5fc0b55d0..356389ce15 100644
--- a/tools/deployment/package-helm/templates/compression-worker-deployment.yaml
+++ b/tools/deployment/package-helm/templates/compression-worker-deployment.yaml
@@ -25,7 +25,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: "compression-worker"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - {{- include "clp.celeryBrokerUrlEnvVar" . | nindent 14 }}
diff --git a/tools/deployment/package-helm/templates/database-statefulset.yaml b/tools/deployment/package-helm/templates/database-statefulset.yaml
index 96fe10ba52..65e6123531 100644
--- a/tools/deployment/package-helm/templates/database-statefulset.yaml
+++ b/tools/deployment/package-helm/templates/database-statefulset.yaml
@@ -25,13 +25,8 @@ spec:
         ) | nindent 6 }}
       containers:
         - name: "database"
-          image: >-
-            {{- if eq .Values.clpConfig.database.type "mysql" }}
-              mysql:8.0.46
-            {{- else }}
-              mariadb:10.11.16
-            {{- end }}
-          imagePullPolicy: "Always"
+          image: {{ include "clp.imageRef" (dict "root" . "component" .Values.clpConfig.database.type) | quote }}
+          imagePullPolicy: {{ (index .Values.image .Values.clpConfig.database.type).pullPolicy | quote }}
           env:
             - name: "MYSQL_DATABASE"
               value: {{ .Values.clpConfig.database.names.clp | quote }}
diff --git a/tools/deployment/package-helm/templates/db-table-creator-job.yaml b/tools/deployment/package-helm/templates/db-table-creator-job.yaml
index 9eb3282486..3866eed849 100644
--- a/tools/deployment/package-helm/templates/db-table-creator-job.yaml
+++ b/tools/deployment/package-helm/templates/db-table-creator-job.yaml
@@ -24,7 +24,7 @@ spec:
       {{- end }}
       containers:
         - name: "db-table-creator"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "CLP_DB_PASS"
diff --git a/tools/deployment/package-helm/templates/garbage-collector-deployment.yaml b/tools/deployment/package-helm/templates/garbage-collector-deployment.yaml
index 2dc6b93566..dd62138b0a 100644
--- a/tools/deployment/package-helm/templates/garbage-collector-deployment.yaml
+++ b/tools/deployment/package-helm/templates/garbage-collector-deployment.yaml
@@ -35,7 +35,7 @@ spec:
         - {{- include "clp.waitForResultsCache" . | nindent 10 }}
       containers:
         - name: "garbage-collector"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "CLP_DB_PASS"
diff --git a/tools/deployment/package-helm/templates/log-ingestor-deployment.yaml b/tools/deployment/package-helm/templates/log-ingestor-deployment.yaml
index 3faa5f52a7..c1fe7b9f69 100644
--- a/tools/deployment/package-helm/templates/log-ingestor-deployment.yaml
+++ b/tools/deployment/package-helm/templates/log-ingestor-deployment.yaml
@@ -34,7 +34,7 @@ spec:
           ) | nindent 10 }}
       containers:
         - name: "log-ingestor"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             {{- include "clp.telemetryEnv" . | nindent 12 }}
diff --git a/tools/deployment/package-helm/templates/mcp-server-deployment.yaml b/tools/deployment/package-helm/templates/mcp-server-deployment.yaml
index 39dadf64e3..b7a66c17f5 100644
--- a/tools/deployment/package-helm/templates/mcp-server-deployment.yaml
+++ b/tools/deployment/package-helm/templates/mcp-server-deployment.yaml
@@ -33,7 +33,7 @@ spec:
         - {{- include "clp.waitForResultsCache" . | nindent 10 }}
       containers:
         - name: "mcp-server"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "CLP_DB_PASS"
diff --git a/tools/deployment/package-helm/templates/presto-worker-deployment.yaml b/tools/deployment/package-helm/templates/presto-worker-deployment.yaml
index f929bc00f4..b45f313a84 100644
--- a/tools/deployment/package-helm/templates/presto-worker-deployment.yaml
+++ b/tools/deployment/package-helm/templates/presto-worker-deployment.yaml
@@ -31,7 +31,8 @@ spec:
             "name" "presto-coordinator"
           ) | nindent 10 }}
         - name: "setup-configs"
-          image: {{ include "clp.kubectl.image.ref" . | quote }}
+          image: {{ include "clp.imageRef" (dict "root" . "component" "kubectl") | quote }}
+          imagePullPolicy: {{ .Values.image.kubectl.pullPolicy | quote }}
           command: ["/bin/sh", "/scripts/presto-worker-setup-configs.sh"]
           volumeMounts:
             - name: "presto-config"
diff --git a/tools/deployment/package-helm/templates/query-scheduler-deployment.yaml b/tools/deployment/package-helm/templates/query-scheduler-deployment.yaml
index 9159c2e6f6..96c89aa8ac 100644
--- a/tools/deployment/package-helm/templates/query-scheduler-deployment.yaml
+++ b/tools/deployment/package-helm/templates/query-scheduler-deployment.yaml
@@ -48,7 +48,7 @@ spec:
         {{- end }}
       containers:
         - name: "query-scheduler"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - {{- include "clp.celeryBrokerUrlEnvVar" . | nindent 14 }}
diff --git a/tools/deployment/package-helm/templates/query-worker-deployment.yaml b/tools/deployment/package-helm/templates/query-worker-deployment.yaml
index c4917563df..f581ce0cc5 100644
--- a/tools/deployment/package-helm/templates/query-worker-deployment.yaml
+++ b/tools/deployment/package-helm/templates/query-worker-deployment.yaml
@@ -26,7 +26,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: "query-worker"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - {{- include "clp.celeryBrokerUrlEnvVar" . | nindent 14 }}
diff --git a/tools/deployment/package-helm/templates/queue-statefulset.yaml b/tools/deployment/package-helm/templates/queue-statefulset.yaml
index 091fb4da97..dc26f639cb 100644
--- a/tools/deployment/package-helm/templates/queue-statefulset.yaml
+++ b/tools/deployment/package-helm/templates/queue-statefulset.yaml
@@ -25,8 +25,8 @@ spec:
         ) | nindent 6 }}
       containers:
         - name: "queue"
-          image: "rabbitmq:4.2.6"
-          imagePullPolicy: "Always"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "queue") | quote }}
+          imagePullPolicy: {{ .Values.image.queue.pullPolicy | quote }}
           env:
             - name: "RABBITMQ_DEFAULT_USER"
               valueFrom:
diff --git a/tools/deployment/package-helm/templates/redis-statefulset.yaml b/tools/deployment/package-helm/templates/redis-statefulset.yaml
index e988df8053..8ae2c8829f 100644
--- a/tools/deployment/package-helm/templates/redis-statefulset.yaml
+++ b/tools/deployment/package-helm/templates/redis-statefulset.yaml
@@ -25,8 +25,8 @@ spec:
         ) | nindent 6 }}
       containers:
         - name: "redis"
-          image: "redis:7.4.8"
-          imagePullPolicy: "Always"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "redis") | quote }}
+          imagePullPolicy: {{ .Values.image.redis.pullPolicy | quote }}
           env:
             - name: "REDIS_PASSWORD"
               valueFrom:
diff --git a/tools/deployment/package-helm/templates/reducer-deployment.yaml b/tools/deployment/package-helm/templates/reducer-deployment.yaml
index 46961893cc..d7eba9adea 100644
--- a/tools/deployment/package-helm/templates/reducer-deployment.yaml
+++ b/tools/deployment/package-helm/templates/reducer-deployment.yaml
@@ -35,7 +35,7 @@ spec:
         - {{- include "clp.waitForResultsCache" . | nindent 10 }}
       containers:
         - name: "reducer"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "CLP_HOME"
diff --git a/tools/deployment/package-helm/templates/results-cache-indices-creator-job.yaml b/tools/deployment/package-helm/templates/results-cache-indices-creator-job.yaml
index 1a953f365f..0d5723dee2 100644
--- a/tools/deployment/package-helm/templates/results-cache-indices-creator-job.yaml
+++ b/tools/deployment/package-helm/templates/results-cache-indices-creator-job.yaml
@@ -17,7 +17,7 @@ spec:
       restartPolicy: "OnFailure"
       containers:
         - name: "results-cache-indices-creator"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "PYTHONPATH"
diff --git a/tools/deployment/package-helm/templates/results-cache-statefulset.yaml b/tools/deployment/package-helm/templates/results-cache-statefulset.yaml
index 7e6a46e7ef..82b21204a2 100644
--- a/tools/deployment/package-helm/templates/results-cache-statefulset.yaml
+++ b/tools/deployment/package-helm/templates/results-cache-statefulset.yaml
@@ -25,8 +25,8 @@ spec:
         ) | nindent 6 }}
       containers:
         - name: "results-cache"
-          image: "mongo:8.0.21"
-          imagePullPolicy: "Always"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "resultsCache") | quote }}
+          imagePullPolicy: {{ .Values.image.resultsCache.pullPolicy | quote }}
           ports:
             - name: "results-cache"
               containerPort: 27017
@@ -57,7 +57,7 @@ spec:
             {{- include "clp.livenessProbeTimings" . | nindent 12 }}
             exec: *results-cache-health-check
         - name: "results-cache-init"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "PYTHONPATH"
diff --git a/tools/deployment/package-helm/templates/webui-deployment.yaml b/tools/deployment/package-helm/templates/webui-deployment.yaml
index c60882e3db..20afcfc717 100644
--- a/tools/deployment/package-helm/templates/webui-deployment.yaml
+++ b/tools/deployment/package-helm/templates/webui-deployment.yaml
@@ -32,7 +32,7 @@ spec:
         - {{- include "clp.waitForResultsCache" . | nindent 10 }}
       containers:
         - name: "webui"
-          image: "{{ include "clp.image.ref" . }}"
+          image: {{ include "clp.imageRef" (dict "root" . "component" "clpPackage") | quote }}
           imagePullPolicy: "{{ .Values.image.clpPackage.pullPolicy }}"
           env:
             - name: "CLP_DB_PASS"
diff --git a/tools/deployment/package-helm/values.yaml b/tools/deployment/package-helm/values.yaml
index 534c5a5a07..d2cffaad14 100644
--- a/tools/deployment/package-helm/values.yaml
+++ b/tools/deployment/package-helm/values.yaml
@@ -9,6 +9,14 @@ image:
     repository: "ghcr.io/y-scope/clp/clp-package"
     pullPolicy: "Always"
     tag: "main"
+  mariadb:
+    repository: "mariadb"
+    pullPolicy: "Always"
+    tag: "10.11.16"
+  mysql:
+    repository: "mysql"
+    pullPolicy: "Always"
+    tag: "8.0.46"
   curl:
     repository: "curlimages/curl"
     pullPolicy: "IfNotPresent"
@@ -30,6 +38,18 @@ image:
     repository: "ghcr.io/y-scope/presto/prestissimo-worker"
     pullPolicy: "IfNotPresent"
     tag: "clp-v0.10.0-fix.1"
+  queue:
+    repository: "rabbitmq"
+    pullPolicy: "Always"
+    tag: "4.2.6"
+  redis:
+    repository: "redis"
+    pullPolicy: "Always"
+    tag: "7.4.8"
+  resultsCache:
+    repository: "mongo"
+    pullPolicy: "Always"
+    tag: "8.0.21"
 
 # - If false: Single-node deployment.
 #   - Pods automatically tolerate control-plane taints.