diff --git a/charts/spire/README.md b/charts/spire/README.md
index c197268..3176992 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -50,8 +50,9 @@ Kubernetes: `>=1.21.0-0`
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
 | agent.image.pullPolicy | string | `"IfNotPresent"` |  |
-| agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` |  |
-| agent.image.tag | string | `""` |  |
+| agent.image.registry | string | `"gcr.io"` |  |
+| agent.image.repository | string | `"spiffe-io/spire-agent"` |  |
+| agent.image.version | string | `""` |  |
 | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | agent.resources | object | `{}` |  |
 | autoscaling.enabled | bool | `false` |  |
@@ -59,15 +60,17 @@ Kubernetes: `>=1.21.0-0`
 | autoscaling.minReplicas | int | `1` |  |
 | autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
 | csiDriver.image.pullPolicy | string | `"IfNotPresent"` |  |
-| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` |  |
-| csiDriver.image.tag | string | `"0.2.0"` |  |
+| csiDriver.image.registry | string | `"ghcr.io"` |  |
+| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` |  |
+| csiDriver.image.version | string | `"0.2.0"` |  |
 | csiDriver.resources | object | `{}` |  |
 | fullnameOverride | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | nameOverride | string | `""` |  |
 | nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
-| nodeDriverRegistrar.image.repository | string | `"quay.io/k8scsi/csi-node-driver-registrar"` |  |
-| nodeDriverRegistrar.image.tag | string | `"v2.0.1"` |  |
+| nodeDriverRegistrar.image.registry | string | `"quay.io"` |  |
+| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` |  |
+| nodeDriverRegistrar.image.version | string | `"v2.0.1"` |  |
 | nodeDriverRegistrar.resources | object | `{}` |  |
 | oidc.acme.cacheDir | string | `"/run/spire"` |  |
 | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
@@ -79,12 +82,14 @@ Kubernetes: `>=1.21.0-0`
 | oidc.domains[3] | string | `"oidc-discovery.example.org"` |  |
 | oidc.enabled | bool | `false` |  |
 | oidc.image.pullPolicy | string | `"IfNotPresent"` |  |
-| oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` |  |
-| oidc.image.tag | string | `""` |  |
+| oidc.image.registry | string | `"gcr.io"` |  |
+| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` |  |
+| oidc.image.version | string | `""` |  |
 | oidc.insecureScheme.enabled | bool | `false` |  |
-| oidc.insecureScheme.nginx.pullPolicy | string | `"IfNotPresent"` |  |
-| oidc.insecureScheme.nginx.repository | string | `"nginx"` |  |
-| oidc.insecureScheme.nginx.tag | string | `"alpine"` |  |
+| oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` |  |
+| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` |  |
+| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` |  |
+| oidc.insecureScheme.nginx.image.version | string | `"alpine"` |  |
 | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
 | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
@@ -101,8 +106,9 @@ Kubernetes: `>=1.21.0-0`
 | server.dataStorage.size | string | `"1Gi"` |  |
 | server.dataStorage.storageClass | string | `nil` |  |
 | server.image.pullPolicy | string | `"IfNotPresent"` |  |
-| server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` |  |
-| server.image.tag | string | `""` |  |
+| server.image.registry | string | `"gcr.io"` |  |
+| server.image.repository | string | `"spiffe-io/spire-server"` |  |
+| server.image.version | string | `""` |  |
 | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | server.resources | object | `{}` |  |
 | server.service.port | int | `8081` |  |
@@ -115,9 +121,14 @@ Kubernetes: `>=1.21.0-0`
 | spire.server.logLevel | string | `"INFO"` |  |
 | spire.trustDomain | string | `"example.org"` |  |
 | tolerations | list | `[]` |  |
+| waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
+| waitForIt.image.registry | string | `"gcr.io"` |  |
+| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` |  |
+| waitForIt.image.version | string | `""` |  |
 | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
-| workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` |  |
-| workloadRegistrar.image.tag | string | `""` |  |
+| workloadRegistrar.image.registry | string | `"gcr.io"` |  |
+| workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` |  |
+| workloadRegistrar.image.version | string | `""` |  |
 | workloadRegistrar.resources | object | `{}` |  |
 
 ----------------------------------------------
diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl
index 994a28f..ee4073e 100644
--- a/charts/spire/templates/_helpers.tpl
+++ b/charts/spire/templates/_helpers.tpl
@@ -120,3 +120,15 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{- define "spire.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}
diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml
index dca0edb..f77fac7 100644
--- a/charts/spire/templates/agent-daemonset.yaml
+++ b/charts/spire/templates/agent-daemonset.yaml
@@ -25,7 +25,8 @@ spec:
           # This is a small image with wait-for-it, choose whatever image
           # you prefer that waits for a service to be up. This image is built
           # from https://github.com/lqhl/wait-for-it
-          image: gcr.io/spiffe-io/wait-for-it:latest
+          image: {{ template "spire.image" .Values.waitForIt }}
+          imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
           args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
       {{- with .Values.agent.nodeSelector }}
       nodeSelector:
@@ -33,7 +34,8 @@ spec:
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-agent
-          image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
+          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
           args: ["-config", "/run/spire/config/agent.conf"]
           volumeMounts:
             - name: spire-config
@@ -63,8 +65,8 @@ spec:
             {{- toYaml .Values.agent.resources | nindent 12 }}
         # This is the container which runs the SPIFFE CSI driver.
         - name: spiffe-csi-driver
-          image: {{ .Values.csiDriver.image.repository}}:{{ .Values.csiDriver.image.tag}}
-          imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy}}
+          image: {{ template "spire.image" .Values.csiDriver }}
+          imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }}
           args: [
             "-workload-api-socket-dir", "/spire-agent-socket",
             "-csi-socket-path", "/spiffe-csi/csi.sock",
@@ -98,7 +100,7 @@ spec:
         # of all the little details required to register a CSI driver with
         # the kubelet.
         - name: node-driver-registrar
-          image: {{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }}
+          image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
           imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
           args: [
             "-csi-address", "/spiffe-csi/csi.sock",
diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml
index 6f81a76..b6024c7 100644
--- a/charts/spire/templates/oidc-deployment.yaml
+++ b/charts/spire/templates/oidc-deployment.yaml
@@ -35,7 +35,7 @@ spec:
         - name: spire-oidc
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }}
           imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
           args:
             - -config
@@ -71,8 +71,8 @@ spec:
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}"
-          imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }}
+          image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }}
+          imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }}
           ports:
             - containerPort: 80
               name: http
diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml
index 81bdc8c..c47e6ac 100644
--- a/charts/spire/templates/server-statefulset.yaml
+++ b/charts/spire/templates/server-statefulset.yaml
@@ -40,7 +40,7 @@ spec:
         - name: {{ .Chart.Name }}-server
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }}
           imagePullPolicy: {{ .Values.server.image.pullPolicy }}
           args:
             - -config
@@ -80,7 +80,7 @@ spec:
         - name: {{ .Chart.Name }}-workload-registrar
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }}
           imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
           args:
             - -config
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 300adf6..53bd9a5 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -4,12 +4,20 @@
 
 replicaCount: 1
 
+waitForIt:
+  image:
+    registry: gcr.io
+    repository: spiffe-io/wait-for-it
+    pullPolicy: IfNotPresent
+    version: ""
+
 workloadRegistrar:
   image:
-    repository: gcr.io/spiffe-io/k8s-workload-registrar
+    registry: gcr.io
+    repository: spiffe-io/k8s-workload-registrar
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: ""
+    version: ""
 
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
@@ -25,10 +33,11 @@ workloadRegistrar:
 
 server:
   image:
-    repository: gcr.io/spiffe-io/spire-server
+    registry: gcr.io
+    repository: spiffe-io/spire-server
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: ""
+    version: ""
 
   nodeSelector:
     kubernetes.io/arch: amd64
@@ -57,9 +66,10 @@ server:
 
 csiDriver:
   image:
-    repository: ghcr.io/spiffe/spiffe-csi-driver
+    registry: ghcr.io
+    repository: spiffe/spiffe-csi-driver
     pullPolicy: IfNotPresent
-    tag: 0.2.0
+    version: 0.2.0
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
     # choice for the user. This also increases chances charts run on environments with little
@@ -74,9 +84,10 @@ csiDriver:
 
 nodeDriverRegistrar:
   image:
-    repository: quay.io/k8scsi/csi-node-driver-registrar
+    registry: quay.io
+    repository: k8scsi/csi-node-driver-registrar
     pullPolicy: IfNotPresent
-    tag: v2.0.1
+    version: v2.0.1
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
     # choice for the user. This also increases chances charts run on environments with little
@@ -93,9 +104,10 @@ oidc:
   enabled: false
 
   image:
-    repository: gcr.io/spiffe-io/oidc-discovery-provider
+    registry: gcr.io
+    repository: spiffe-io/oidc-discovery-provider
     pullPolicy: IfNotPresent
-    tag: ""
+    version: ""
 
   nodeSelector:
     kubernetes.io/arch: amd64
@@ -132,9 +144,11 @@ oidc:
     enabled: false
 
     nginx:
-      repository: nginx
-      pullPolicy: IfNotPresent
-      tag: "alpine"
+      image:
+        registry: docker.io
+        repository: nginx
+        pullPolicy: IfNotPresent
+        version: alpine
 
   acme:
     tosAccepted: false
@@ -144,10 +158,11 @@ oidc:
 
 agent:
   image:
-    repository: gcr.io/spiffe-io/spire-agent
+    registry: gcr.io
+    repository: spiffe-io/spire-agent
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: ""
+    version: ""
 
   nodeSelector:
     kubernetes.io/arch: amd64