diff --git a/AGENTS.md b/AGENTS.md
index 34f5083f..d2054bd1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -9,7 +9,6 @@ This file provides rules and context for any AI coding assistant working in this
 - **DO NOT** commit secrets, credentials, or private keys. `values-secret.yaml.template` is a template only.
 - **DO NOT** use Kustomize. This project uses Helm exclusively.
 - **DO NOT** create charts with `apiVersion: v1`. Use `apiVersion: v2` (Helm 3+).
-- **DO NOT** place cloud-provider-specific logic in chart templates. Use `/overrides/` via `sharedValueFiles` instead.
 - **DO NOT** hardcode secrets in templates. Use External Secrets Operator with vault paths (see `charts/hub/trustee/templates/dynamic-eso.yaml` for reference).
 
 ## Feature Development Precedence Order
diff --git a/airgap/imageset-config-4.22.yaml b/airgap/imageset-config-4.22.yaml
index 9065b06e..598af589 100644
--- a/airgap/imageset-config-4.22.yaml
+++ b/airgap/imageset-config-4.22.yaml
@@ -31,17 +31,17 @@ mirror:
         - name: sandboxed-containers-operator
           channels:
             - name: stable
-              minVersion: "1.13.0"
-              maxVersion: "1.13.0"
+              minVersion: "1.13.1"
+              maxVersion: "1.13.1"
         - name: trustee-operator
           channels:
             - name: stable
               minVersion: "1.2.0"
               maxVersion: "1.2.0"
-        # GitOps (ArgoCD)
+        # GitOps (ArgoCD) — keep aligned with main.gitops.channel in values-global.yaml
         - name: openshift-gitops-operator
           channels:
-            - name: latest
+            - name: gitops-1.22
         # External Secrets
         - name: openshift-external-secrets-operator
           channels:
@@ -114,7 +114,8 @@ mirror:
     # --- VP Helm OCI charts ---
     - name: quay.io/validatedpatterns/clustergroup:0.9.58
     - name: quay.io/validatedpatterns/acm:0.1.27
-    - name: quay.io/validatedpatterns/hashicorp-vault:0.1.8
+    # Minimum selected by the Vault applications (~0.1.10); mirror newer patches before use.
+    - name: quay.io/validatedpatterns/hashicorp-vault:0.1.10
     - name: quay.io/validatedpatterns/openshift-external-secrets:0.0.4
     - name: quay.io/validatedpatterns/trustee:0.10.2
     - name: quay.io/validatedpatterns/sandboxed-containers:0.2.1
diff --git a/charts/coco-supported/kbs-access-curl/templates/deployment.yaml b/charts/coco-supported/kbs-access-curl/templates/deployment.yaml
index 9d87adc1..48beeb75 100644
--- a/charts/coco-supported/kbs-access-curl/templates/deployment.yaml
+++ b/charts/coco-supported/kbs-access-curl/templates/deployment.yaml
@@ -26,6 +26,12 @@ spec:
         io.katacontainers.config.runtime.create_container_timeout: "900"
     spec:
       serviceAccountName: kbs-access-curl
+      {{- $clusterGroupName := get (.Values.clusterGroup | default dict) "name" }}
+      {{- if or (eq $clusterGroupName "azure") (eq $clusterGroupName "azure-spoke") }}
+      # Azure peer-pods use the ACM-distributed pull secret; other groups use KBS.
+      imagePullSecrets:
+        - name: pull-secret
+      {{- end }}
       runtimeClassName: {{ .Values.global.coco.runtimeClassName }}
       securityContext:
         runAsUser: 0
diff --git a/scripts/airgap-post-install.sh b/scripts/airgap-post-install.sh
index 8d078815..e0788432 100755
--- a/scripts/airgap-post-install.sh
+++ b/scripts/airgap-post-install.sh
@@ -344,9 +344,9 @@ PYEOF
 mirror_oci_charts() {
     step 5 "Mirror OCI Helm charts and utility images"
 
-    local imageset="${PATTERN_DIR}/airgap/imageset-config.yaml"
+    local imageset="${PATTERN_DIR}/airgap/imageset-config-4.22.yaml"
     if [[ ! -f "$imageset" ]]; then
-        warn "No imageset-config.yaml found at $imageset — skipping"
+        warn "No ImageSetConfiguration found at $imageset — skipping"
         return
     fi
 
@@ -701,8 +701,8 @@ create_operator_config() {
 import yaml
 with open('${PATTERN_DIR}/values-global.yaml') as f:
     d = yaml.safe_load(f)
-    print(d.get('main',{}).get('gitops',{}).get('channel','latest'))
-" 2>/dev/null || echo "latest")
+    print(d.get('main',{}).get('gitops',{}).get('channel','gitops-1.22'))
+" 2>/dev/null || echo "gitops-1.22")
 
     local gitops_source
     gitops_source=$(python3 -c "
diff --git a/values-azure-spoke.yaml b/values-azure-spoke.yaml
index ceb6252f..03066023 100644
--- a/values-azure-spoke.yaml
+++ b/values-azure-spoke.yaml
@@ -26,7 +26,7 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.12.0
+      csv: sandboxed-containers-operator.v1.13.1
     cert-manager:
       name: openshift-cert-manager-operator
       namespace: cert-manager-operator
diff --git a/values-azure.yaml b/values-azure.yaml
index ca15b9fd..a0079f58 100644
--- a/values-azure.yaml
+++ b/values-azure.yaml
@@ -36,7 +36,7 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.13.0
+      csv: sandboxed-containers-operator.v1.13.1
     trustee:
       name: trustee-operator
       namespace: trustee-operator-system
@@ -74,7 +74,8 @@ clusterGroup:
       namespace: vault
       project: vault
       chart: hashicorp-vault
-      chartVersion: 0.1.*
+      # Require 0.1.10 or newer within the 0.1.x release series.
+      chartVersion: "~0.1.10"
 
     secrets-operator:
       name: openshift-external-secrets
@@ -255,4 +256,4 @@ clusterGroup:
     - name: init-data-gzipper
       playbook: ansible/init-data-gzipper.yaml
       verbosity: -vvv
-      timeout: 3600
\ No newline at end of file
+      timeout: 3600
diff --git a/values-baremetal-hub.yaml b/values-baremetal-hub.yaml
index 4aebd6e3..a8572d61 100644
--- a/values-baremetal-hub.yaml
+++ b/values-baremetal-hub.yaml
@@ -48,7 +48,7 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.13.0
+      csv: sandboxed-containers-operator.v1.13.1
       annotations:
         argocd.argoproj.io/sync-wave: "10"
     trustee:
@@ -165,7 +165,8 @@ clusterGroup:
       namespace: vault
       project: vault
       chart: hashicorp-vault
-      chartVersion: 0.1.*
+      # Require 0.1.10 or newer within the 0.1.x release series.
+      chartVersion: "~0.1.10"
       annotations:
         argocd.argoproj.io/sync-wave: "0"
 
diff --git a/values-baremetal-spoke.yaml b/values-baremetal-spoke.yaml
index 5da79347..fb07b693 100644
--- a/values-baremetal-spoke.yaml
+++ b/values-baremetal-spoke.yaml
@@ -33,7 +33,7 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.13.0
+      csv: sandboxed-containers-operator.v1.13.1
       annotations:
         argocd.argoproj.io/sync-wave: "10"
     cert-manager:
diff --git a/values-baremetal.yaml b/values-baremetal.yaml
index 4eafaab2..9ac6dbd8 100644
--- a/values-baremetal.yaml
+++ b/values-baremetal.yaml
@@ -47,7 +47,7 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.13.0
+      csv: sandboxed-containers-operator.v1.13.1
       annotations:
         argocd.argoproj.io/sync-wave: "10"
     trustee:
@@ -174,7 +174,8 @@ clusterGroup:
       namespace: vault
       project: vault
       chart: hashicorp-vault
-      chartVersion: 0.1.*
+      # Require 0.1.10 or newer within the 0.1.x release series.
+      chartVersion: "~0.1.10"
       annotations:
         argocd.argoproj.io/sync-wave: "0"
 
diff --git a/values-global.yaml b/values-global.yaml
index 6730225c..b3287dc0 100644
--- a/values-global.yaml
+++ b/values-global.yaml
@@ -57,9 +57,8 @@ main:
   gitops:
     # Required for airgap -- set to your mirrored catalog source name
     # operatorSource: cs-redhat-operator-index-v4-22
-    # Channel must match what's available in the mirrored catalog.
-    # The mirrored catalog may only have 'latest', not version-specific channels.
-    channel: latest
+    # Keep this channel aligned with airgap/imageset-config-4.22.yaml.
+    channel: gitops-1.22
   multiSourceConfig:
     enabled: true
     clusterGroupChartVersion: 0.9.58
diff --git a/values-trusted-hub.yaml b/values-trusted-hub.yaml
index f0a48e36..9944314a 100644
--- a/values-trusted-hub.yaml
+++ b/values-trusted-hub.yaml
@@ -63,7 +63,8 @@ clusterGroup:
       namespace: vault
       project: vault
       chart: hashicorp-vault
-      chartVersion: 0.1.*
+      # Require 0.1.10 or newer within the 0.1.x release series.
+      chartVersion: "~0.1.10"
 
     secrets-operator:
       name: openshift-external-secrets