diff --git a/charts/operator/values.yaml b/charts/operator/values.yaml
index 53ea0335..49e68909 100644
--- a/charts/operator/values.yaml
+++ b/charts/operator/values.yaml
@@ -244,10 +244,10 @@ featureGates:
 # proxy-sidecar / lite mode (always-on enforce-redirect egress capture).
 defaults:
   images:
-    envoyProxy: ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.3
-    authbridge: ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.3
-    authbridgeLite: ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.3
-    proxyInit: ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.3
+    envoyProxy: ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.10
+    authbridge: ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.10
+    authbridgeLite: ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.10
+    proxyInit: ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.10
     pullPolicy: IfNotPresent
 
   # Proxy settings
diff --git a/operator/internal/webhook/config/defaults.go b/operator/internal/webhook/config/defaults.go
index 05ced878..835e426b 100644
--- a/operator/internal/webhook/config/defaults.go
+++ b/operator/internal/webhook/config/defaults.go
@@ -36,18 +36,18 @@ func CompiledDefaults() *PlatformConfig {
 			// :latest on exactly the deploy paths the chart-layer pin doesn't cover.
 			// authbridge-envoy: combined image for envoy-sidecar mode
 			// (Envoy + ext_proc authbridge + spiffe-helper bundled).
-			EnvoyProxy: "ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.3",
+			EnvoyProxy: "ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.10",
 			// authbridge: combined image for proxy-sidecar mode (default
 			// deployment shape) — authbridge-proxy + spiffe-helper
 			// bundled, no Envoy, no gRPC.
-			AuthBridge: "ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.3",
+			AuthBridge: "ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.10",
 			// authbridge-lite: size-optimized variant for the "lite"
 			// mode. Same listener layout as AuthBridge but parsers
 			// (a2a/mcp/inference) are dropped.
-			AuthBridgeLite: "ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.3",
+			AuthBridgeLite: "ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.10",
 			// proxy-init: iptables init container, used by
 			// envoy-sidecar mode only.
-			ProxyInit:  "ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.3",
+			ProxyInit:  "ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.10",
 			PullPolicy: corev1.PullIfNotPresent,
 		},
 		Proxy: ProxyConfig{
diff --git a/operator/test/e2e/README.md b/operator/test/e2e/README.md
index 40c218b6..60c3b631 100644
--- a/operator/test/e2e/README.md
+++ b/operator/test/e2e/README.md
@@ -15,7 +15,7 @@ End-to-end tests for the rossoctl-operator. The suite runs 25 specs:
 - [kubectl](https://kubernetes.io/docs/tasks/tools/) — `brew install kubectl`
 - Container runtime: **Docker** or **Podman**
 
-The test suite auto-detects Docker vs Podman. No env vars needed. AuthBridge sidecar images (`authbridge-envoy`, `proxy-init`, `spiffe-helper`) are pulled from `ghcr.io/rossoctl/cortex` and loaded into Kind during setup.
+The test suite auto-detects Docker vs Podman. No env vars needed. AuthBridge sidecar images (`authbridge-envoy`, `authbridge`, `authbridge-lite`, `proxy-init`) are pulled from `ghcr.io/rossoctl/cortex` and loaded into Kind during setup. `spiffe-helper` is not pulled separately — it is bundled into the combined `authbridge-envoy` and `authbridge` images.
 
 ## Run
 
diff --git a/operator/test/e2e/e2e_suite_test.go b/operator/test/e2e/e2e_suite_test.go
index 3d695ca1..1b755aae 100644
--- a/operator/test/e2e/e2e_suite_test.go
+++ b/operator/test/e2e/e2e_suite_test.go
@@ -66,10 +66,10 @@ var (
 	// Keep tags in sync with charts/operator/values.yaml (defaults.images.*) so
 	// e2e exercises the images the chart actually ships, not :latest.
 	sidecarImages = []string{
-		"ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.3",
-		"ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.3",
-		"ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.3",
-		"ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.3",
+		"ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.10",
+		"ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.10",
+		"ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.10",
+		"ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.10",
 	}
 )