diff --git a/packages/apps/clickhouse/images/altinity-clickhouse-backup.tag b/packages/apps/clickhouse/images/altinity-clickhouse-backup.tag
index 73c1764be..fdabf9e13 100644
--- a/packages/apps/clickhouse/images/altinity-clickhouse-backup.tag
+++ b/packages/apps/clickhouse/images/altinity-clickhouse-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/altinity-clickhouse-backup:v1.6.0@sha256:e890d78cd83968bdff9a36c9ca4312afc05e138af486e476da0a935f81f9b7a7
+ghcr.io/cozystack/cozystack/altinity-clickhouse-backup:v1.7.0-rc.3@sha256:b69e3407612331ed7ddfe42f1e9ab699213fe5f1400d17a5f562d3e78b655f6a
diff --git a/packages/apps/clickhouse/images/clickhouse-backup.tag b/packages/apps/clickhouse/images/clickhouse-backup.tag
index 2ba1bf36f..b38250980 100644
--- a/packages/apps/clickhouse/images/clickhouse-backup.tag
+++ b/packages/apps/clickhouse/images/clickhouse-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/clickhouse-backup:v1.6.0@sha256:8efef62d59fb82d39544823f81a797c2b9ac130a50241fee48e701161ce2670d
+ghcr.io/cozystack/cozystack/clickhouse-backup:v1.7.0-rc.3@sha256:037e7cec9c7868587cf53159061f4b151fb7b3330346f184977fadb0f80e7c76
diff --git a/packages/apps/kubernetes/images/cluster-autoscaler.tag b/packages/apps/kubernetes/images/cluster-autoscaler.tag
index c9a4369e2..3d2b08b87 100644
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:v1.6.0@sha256:d188f395a31e37ea09bfa91e45d7ce1606b7459192a437fa66bb760ffb5f17d2
+ghcr.io/cozystack/cozystack/cluster-autoscaler:v1.7.0-rc.3@sha256:6991b8f49c3d1dc7d75ee361adc5dd43c36790172d4212f82bafef094d54bff2
diff --git a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
index 4c0395201..b0a807767 100644
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:v1.6.0@sha256:f005b99041d191eed9dde98f9f6691ba2d0cbfa1b3b0b2fe4b32cc0fdba74acf
+ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:v1.7.0-rc.3@sha256:7f32eddd46edb85c728d824d681bff242e572b63619fa82ae5e6647fcd9acea4
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
index cd94f98ea..d9654cf6e 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.6.0@sha256:d6326e343c7932ce3d375c6742b9b9745090a4a26bf5bbc5ad19f5504ea93d65
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.7.0-rc.3@sha256:95d2a631c93eceb9b003d57c406315e684138a6365afe1d385ed1acb99bf9730
diff --git a/packages/apps/kubernetes/images/talos-csr-signer.tag b/packages/apps/kubernetes/images/talos-csr-signer.tag
index 48d18c892..3bc5dfb74 100644
--- a/packages/apps/kubernetes/images/talos-csr-signer.tag
+++ b/packages/apps/kubernetes/images/talos-csr-signer.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/talos-csr-signer:v1.6.0@sha256:85b41e16e5e40398b1272fe0a69de72e205532c8034d0e6a9fc4a1d510f17818
+ghcr.io/cozystack/cozystack/talos-csr-signer:v1.7.0-rc.3@sha256:4235082e93a8cd665f2af2948a0ad085fdabf29854340e6e4aba59f1b008d383
diff --git a/packages/apps/mariadb/images/mariadb-backup.tag b/packages/apps/mariadb/images/mariadb-backup.tag
index 3dafe6c5e..6cb8a3e37 100644
--- a/packages/apps/mariadb/images/mariadb-backup.tag
+++ b/packages/apps/mariadb/images/mariadb-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/mariadb-backup:v1.6.0@sha256:1de944b5c4fbeef94004b8620b0865aa7886a692dacb23d50c8f9b31fbeece07
+ghcr.io/cozystack/cozystack/mariadb-backup:v1.7.0-rc.3@sha256:839af624d9410bd2c27cb838db2233e5c55ae92919f6c6420107d782e14bea2e
diff --git a/packages/apps/vpn/images/shadowbox.tag b/packages/apps/vpn/images/shadowbox.tag
index bea3e8d32..510020137 100644
--- a/packages/apps/vpn/images/shadowbox.tag
+++ b/packages/apps/vpn/images/shadowbox.tag
@@ -1 +1 @@
-quay.io/outline/shadowbox:v1.12.3@sha256:545c6f7c7261bb30ae1dffe24a6fca5f8512f5d17c72cfb9e410e7e655444e62
+ghcr.io/cozystack/cozystack/shadowbox:v1.7.0-rc.3@sha256:e0ef5583279ab27d9a7711a20bd443b3e2b1c3dfa0a53552c9e54a05b9d38781
diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index b080fd433..50e122217 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -21,9 +21,9 @@ cozystackOperator:
   # well, or the opt-out is partial. Declared here rather than left implicit
   # because the documented opt-out is a `--set` against this key.
   disableTelemetry: false
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.6.0@sha256:93b305f78823b070c59ca631b213e39bd9d8a256d5c520f156a03f5f72f57a5d
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.7.0-rc.3@sha256:0d32c1688f4e9085bc40ffe2294ad1ce6804aca4d20216f19d322f7fd22563a1
   platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:bf68208730860fa8e47f378a0260e79a0262e0783fa63ba4f7f97f57a48b2d23'
+  platformSourceRef: 'digest=sha256:3fefccc8aaebc5684d90f7f1e3aa41cb76dd2057b304cc4931d1395fc56f9223'
   # When non-empty, overrides the operator's --helmrelease-interval flag
   # (operator default: 5m). E2E sets this to 30s; production should leave empty.
   helmReleaseInterval: ""
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index b050f21c6..9a15170e1 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -13,7 +13,7 @@ migrations:
   # below therefore lags targetVersion in-tree by design; run-migrations.sh
   # refuses to advance past a migration file missing from the image (exit 1), so
   # a stale pin fails loudly rather than silently skipping the etcd adoption.
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.6.0@sha256:6777042e3e9c6bad76e7d96fb64baa115061975f39061cb3ede84e21d0e2213f
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.7.0-rc.3@sha256:9018fba0873094431cf130cc949d4651a8d971d02e5925b70e6f22648818a4c5
   targetVersion: 61
   # Adopt legacy etcd clusters onto the v1alpha2 operator WITHOUT the mandatory
   # pre-adoption safety snapshot (migration 50). Leave false unless migration 50
@@ -186,7 +186,6 @@ networking:
   #   resources:
   #     limits:
   #       memory: 8Gi
-
 # Service publishing and ingress configuration
 publishing:
   host: "example.org"
@@ -715,7 +714,6 @@ monitoring:
 # cozystack.cozystack-platform Package — see docs/operations/backup-classes.md.
 # Empty (the default) forwards nothing and keeps the child chart defaults.
 backupStorage: {}
-
 # backupStrategyController overrides for the platform-managed strategy CRs,
 # forwarded verbatim into the same Package as
 # components.backupstrategy-controller.values.backupStrategyController. The
@@ -917,7 +915,6 @@ gpu:
   # missing entries).
   vgpuDeviceManager:
     enabled: false
-
 # VM import from external virtualization platforms (opt-in; see the iaas bundle).
 vmImport:
   # Container image carrying the VMware Virtual Disk Development Kit, used by
diff --git a/packages/core/testing/values.yaml b/packages/core/testing/values.yaml
index 7e3c1739a..c92433910 100644
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.6.0@sha256:a9980e8c48d6e50ed2b5d8245a4e0aae00970777b6e2255577fdb66035a44c68
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.7.0-rc.3@sha256:f6a1cfc0fa5b09dcc60071aee43a1f3a09d350e11681a693805118d289218153
diff --git a/packages/extra/bootbox/images/matchbox.tag b/packages/extra/bootbox/images/matchbox.tag
index 5d086145d..977b4641c 100644
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.6.0@sha256:7805917462ad1288272a6324c0f32a4f9a250e1723a2759f7afebce181400f96
+ghcr.io/cozystack/cozystack/matchbox:v1.7.0-rc.3@sha256:d4fa0aa0578be7c358bcffd9f7c0a7ca7b9a7a8ba63df1ed80aa63832825443e
diff --git a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
index a3cd453be..ff8e086e7 100644
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.6.0@sha256:4d665becd3399c2fe1e8a66e15d14d16e4a5a75395fb0ae65cff46679a8989f1
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.7.0-rc.3@sha256:b7b0d339e0e2c5043eb03b6d78e05437daae1116c0e1a6a1d88ae4f70b296534
diff --git a/packages/system/backup-controller/values.yaml b/packages/system/backup-controller/values.yaml
index a62272f45..f55696396 100644
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.6.0@sha256:fc4571354413d86ed11fa38dee8fd3d2d879e11c48d7d92c28630b2d54a2bcbb"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.7.0-rc.3@sha256:65cb050d1f240caaf35b5e35c5aed73ab197666e930146a418565b08f9bbe34c"
   replicas: 2
   debug: false
   metrics:
diff --git a/packages/system/backupstrategy-controller/values.yaml b/packages/system/backupstrategy-controller/values.yaml
index b3f9c1402..ee0a89e89 100644
--- a/packages/system/backupstrategy-controller/values.yaml
+++ b/packages/system/backupstrategy-controller/values.yaml
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.6.0@sha256:e8bf0521d1d1d8b90ebe66e9013010887033ba2653901799d57f2df47c9d879e"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.7.0-rc.3@sha256:990c8ab93b9f14ee7f70473d199558c859fa5e9532d6b1f47a74698f34c07c1b"
   # chBackupClientImage is the image rendered into the Altinity strategy
   # Pod: it drives clickhouse-backup's HTTP API via curl + jq.
   #
@@ -35,7 +35,7 @@ backupStrategyController:
   # retag both to the same stable tag, and the write-once guard in
   # hack/promote-retag.sh fails the release. hack/image-pin-consistency.bats
   # asserts no repository is pinned at more than one digest.
-  chBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.6.0@sha256:6777042e3e9c6bad76e7d96fb64baa115061975f39061cb3ede84e21d0e2213f"
+  chBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.7.0-rc.3@sha256:9018fba0873094431cf130cc949d4651a8d971d02e5925b70e6f22648818a4c5"
   # rabbitmqBackupClientImage is the image rendered into the RabbitMQ Job
   # strategy (strategy-rabbitmq-default.yaml): its script needs only curl +
   # ca-certificates to call the RabbitMQ management API and push the
@@ -48,13 +48,13 @@ backupStrategyController:
   # dedicated alpine + curl + ca-certificates image built by this package's
   # Makefile, which also lets this pin move on its own.
   # DO NOT hand-edit: stamped by packages/core/platform/Makefile.
-  rabbitmqBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.6.0@sha256:6777042e3e9c6bad76e7d96fb64baa115061975f39061cb3ede84e21d0e2213f"
+  rabbitmqBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.7.0-rc.3@sha256:9018fba0873094431cf130cc949d4651a8d971d02e5925b70e6f22648818a4c5"
   # redisBackupClientImage is rendered into the Redis strategy Pod. The
   # spotahome operator ships no backup CRD, so the strategy runs a one-shot Job
   # that dumps an RDB snapshot to S3 and, on restore, loads it into a throwaway
   # redis to emit a faithful replay stream. It ships its own image (redis 8 +
   # curl) built from images/redis-backup/; `make image` re-digests this value.
-  redisBackupClientImage: "ghcr.io/cozystack/cozystack/redis-backup:v1.6.0"
+  redisBackupClientImage: "ghcr.io/cozystack/cozystack/redis-backup:v1.7.0-rc.3@sha256:11492ac0b1899fc02aea9ff40ea72bab006b8816e426b84030528fa18be45b90"
   # redisBackupActiveDeadlineSeconds bounds one backup/restore Job so a run that
   # wedges (e.g. a --rdb dump blocking on a stalled master) becomes a Failed Job
   # the driver reports, rather than a Running BackupJob a cron Plan stacks behind.
diff --git a/packages/system/bucket/images/s3manager.tag b/packages/system/bucket/images/s3manager.tag
index b5234c0e7..d97155b19 100644
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v1.6.0@sha256:73665aaf7f5406b4a1e456d14060fe874e0ae2a436ba7fd3058fa73abff8a927
+ghcr.io/cozystack/cozystack/s3manager:v1.7.0-rc.3@sha256:ad438f9618253d718e1f20f0b26059a62dd5e398347b125e52c63e485e20bb49
diff --git a/packages/system/capi-providers-cpprovider/files/components.gz b/packages/system/capi-providers-cpprovider/files/components.gz
index b96f984eb..e5a2db6fa 100644
Binary files a/packages/system/capi-providers-cpprovider/files/components.gz and b/packages/system/capi-providers-cpprovider/files/components.gz differ
diff --git a/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml b/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml
index bfd7e9128..5d05068af 100644
--- a/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml
+++ b/packages/system/capi-providers-cpprovider/files/control-plane-components.yaml
@@ -16292,7 +16292,7 @@ spec:
         - --dynamic-infrastructure-clusters=${CACPPK_INFRASTRUCTURE_CLUSTERS:= }
         command:
         - /manager
-        image: ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:a0b8367f374432a5fa0b12018a35b0e4828466f53eb6de263d90c3408d9fd07d
+        image: ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:9e5eb9a7e28ad17d9c85be3fc9aede8436ae9b7aa5497afa340b70ad4950c889
         livenessProbe:
           httpGet:
             path: /healthz
diff --git a/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji.tag b/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji.tag
index a32ca9085..d7ab26f7d 100644
--- a/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji.tag
+++ b/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:a0b8367f374432a5fa0b12018a35b0e4828466f53eb6de263d90c3408d9fd07d
+ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:9e5eb9a7e28ad17d9c85be3fc9aede8436ae9b7aa5497afa340b70ad4950c889
diff --git a/packages/system/capi-providers-infraprovider/images/cluster-api-provider-kubevirt.tag b/packages/system/capi-providers-infraprovider/images/cluster-api-provider-kubevirt.tag
index 924275aa0..a6b32f0f1 100644
--- a/packages/system/capi-providers-infraprovider/images/cluster-api-provider-kubevirt.tag
+++ b/packages/system/capi-providers-infraprovider/images/cluster-api-provider-kubevirt.tag
@@ -1 +1 @@
-quay.io/capk/capk-manager:v0.1.10@sha256:87c2a80413a0f64f65326d379f4905d3f3f2eaf9dab8a6a67a7f7973ca85aef6
+ghcr.io/cozystack/cozystack/cluster-api-provider-kubevirt:v1.7.0-rc.3@sha256:e347d8f5f6258b6158afb7bf50ee5618a2f1de264d93d30b1c9402942dd4125f
diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml
index 732fd4151..b3fba7e54 100644
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -41,8 +41,8 @@ cilium:
     mode: "kubernetes"
   image:
     repository: ghcr.io/cozystack/cozystack/cilium
-    tag: v1.6.0
-    digest: "sha256:136a7dfff4d6adcd448424c2354144160028a8e96eb6558b917fd3ee6d7b39fe"
+    tag: v1.7.0-rc.3
+    digest: "sha256:16d824903e909c1aeedfa1610a8b5676edf8169f80c324a6f735c8756ac52516"
   envoy:
     enabled: true
     # Keep the per-type xDS the 1.19 agent and envoy speak. The 1.20 chart
@@ -134,7 +134,7 @@ cilium:
     # unpatched upstream operator the rebuild starts from, so a tree rendered
     # without a build still pulls an image that exists.
     image:
-      override: "quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc"
+      override: "ghcr.io/cozystack/cozystack/cilium-operator:v1.7.0-rc.3@sha256:58f2b0bcfeaf2a996a470593457d04d1ba06f08c12774a6bc0c36f1142449226"
     rollOutPods: true
     replicas: 1
     resources:
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index f58daa937..6d0eecfb4 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,9 +1,8 @@
 # Injected by the platform from the cozystack-values Secret. The empty
 # default keeps the chart renderable on its own, outside a cluster.
 _cluster: {}
-
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.6.0@sha256:c4d374a9bc5e6f6e66d24b29396f1eae9d7f06fd268ff767d05c45ca35e84e2e
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.7.0-rc.3@sha256:817b7e345fbebc389f53fd19c5f5c17217973bdb153b3c0afb3071f8bbe2bddc
   replicas: 2
   # Empty by default: no resources block is rendered, so requests and limits are
   # opt-in. Idle usage (measured) is ~130-143Mi — keep a limit above that.
diff --git a/packages/system/cozystack-controller/values.yaml b/packages/system/cozystack-controller/values.yaml
index 4c98be23a..79c7ed943 100644
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,5 +1,5 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.6.0@sha256:b01f6fe6e8fe6426b112fbda2b4abac946b4e45cd118137c9001c9e6ee784b3d
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.7.0-rc.3@sha256:c39fcff5fdb2dbc96df91d082d31e458273f20b8ed04a9f785c7675bd0bf77c7
   debug: false
   disableTelemetry: false
   # Base URL of a Prometheus-compatible query API to fetch SeaweedFS bucket
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 11bb0dcad..ab8f88af4 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,8 +1,7 @@
 # Injected by the platform from the cozystack-values Secret. The empty
 # default keeps the chart renderable on its own, outside a cluster.
 _cluster: {}
-
 console:
-  image: ghcr.io/cozystack/cozystack/cozystack-ui:v1.6.0@sha256:ad0e132ce506bbc9e0f6a5dfb94311c9bbc08da3d8eca84eb0e527ba6c1a8897
+  image: ghcr.io/cozystack/cozystack/cozystack-ui:v1.7.0-rc.3@sha256:55605af79f1edecba274e3c137efccb7614c15128e9186f3b1560665c6b94dc0
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.6.0@sha256:97124c012246c33cdcac60e8f884097b48c0081624716fe8161efc2b3ceeb2a8
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.7.0-rc.3@sha256:b5b17859ba0f69d1dac6b2cc3ed377acc821fdb0a9e83142610ac57e40b31fb0
diff --git a/packages/system/flux-plunger/values.yaml b/packages/system/flux-plunger/values.yaml
index 69e9f1465..bddf7a4c1 100644
--- a/packages/system/flux-plunger/values.yaml
+++ b/packages/system/flux-plunger/values.yaml
@@ -1,5 +1,4 @@
-image: "ghcr.io/cozystack/cozystack/flux-plunger:latest@sha256:6a6ec938973e6583c5e1573f7d25beddc1852a6699a089116b2407e29a564a72"
-
+image: "ghcr.io/cozystack/cozystack/flux-plunger:v1.7.0-rc.3@sha256:f09439183b70fd1a267f0bdbdc5d01e1bc75ad5559f75ccf216a07f277b76050"
 # How long flux-plunger is given to stop, between 40 and 140. On SIGTERM it stops
 # its manager (up to 10 seconds), then gives up the uninstall fences it holds,
 # waiting for helm-controller to uninstall a release being deleted, under a
@@ -8,7 +7,6 @@ image: "ghcr.io/cozystack/cozystack/flux-plunger:latest@sha256:6a6ec938973e6583c
 # acts. The pre-delete hook waits for the pod a little longer than this before it
 # releases what is left.
 shutdownGracePeriodSeconds: 90
-
 # Image for the pre-delete uninstall-fence cleanup hook Job (see
 # templates/uninstall-fence-cleanup.yaml). Only needs a kubectl binary. The tag
 # is digest-pinned so an upstream retag does not change what runs across the
diff --git a/packages/system/flux-shard-operator/values.yaml b/packages/system/flux-shard-operator/values.yaml
index eb5bc5f12..6177840f7 100644
--- a/packages/system/flux-shard-operator/values.yaml
+++ b/packages/system/flux-shard-operator/values.yaml
@@ -1,5 +1,5 @@
 fluxShardOperator:
-  image: ghcr.io/cozystack/cozystack/flux-shard-operator:v1.6.0@sha256:daf002af34671371646185d4135c5096f8aba9518f132089bd5d6fbe7d9d06e7
+  image: ghcr.io/cozystack/cozystack/flux-shard-operator:v1.7.0-rc.3@sha256:69e157898201e2a2b6b3404083a7e2a7499e7710ddb7f2935dd2dc9edfb649f9
   debug: false
   replicas: 2
   ## Number of helm-controller shards to provision and distribute tenants
diff --git a/packages/system/grafana-operator/images/grafana-dashboards.tag b/packages/system/grafana-operator/images/grafana-dashboards.tag
index 412303f2b..84ce008fb 100644
--- a/packages/system/grafana-operator/images/grafana-dashboards.tag
+++ b/packages/system/grafana-operator/images/grafana-dashboards.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.6.0@sha256:cb22416b34d4385e4df58314de390920af805c03358fe00734c8fa44ba505fe9
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.7.0-rc.3@sha256:b6500cfe6d36e31ba9f24d94809071513b81fdcb977f7919f8bd734209275c78
diff --git a/packages/system/harbor/values.yaml b/packages/system/harbor/values.yaml
index 1ba59a9da..7a9a9750c 100644
--- a/packages/system/harbor/values.yaml
+++ b/packages/system/harbor/values.yaml
@@ -3,37 +3,37 @@ harbor:
   # with a multi-arch rebuild from images/.
   core:
     image:
-      repository: docker.io/goharbor/harbor-core
-      tag: v2.15.1@sha256:887a85b8ea98b76bfc9f715f1a0785bb99f9a1034241513902dd6e95be922a83
+      repository: ghcr.io/cozystack/cozystack/harbor-core
+      tag: v1.7.0-rc.3@sha256:b645c46af670bbff36313466ffe955f8c0c4ea81cd8eb20f6d82a904be4be934
   jobservice:
     image:
-      repository: docker.io/goharbor/harbor-jobservice
-      tag: v2.15.1@sha256:0de4fd2ce3a02d3e6591b439e4674ea085885ddf43652b44004cc67eb19dba12
+      repository: ghcr.io/cozystack/cozystack/harbor-jobservice
+      tag: v1.7.0-rc.3@sha256:b1988c0fc72d4710d11f7f19ebc0a15b506d986606ce84ab5627861a69b206f0
   portal:
     image:
-      repository: docker.io/goharbor/harbor-portal
-      tag: v2.15.1@sha256:ac55161c57a8351807adf8f8def264bdd52667c371d0436beefebdac4341c9e2
+      repository: ghcr.io/cozystack/cozystack/harbor-portal
+      tag: v1.7.0-rc.3@sha256:0974f606b8f6aaed7abd400c421e8e0e175d277394623f53bffd873479cdeec5
   registry:
     registry:
       image:
-        repository: docker.io/goharbor/registry-photon
-        tag: v2.15.1@sha256:ebf0325c2661729dbb317cbf839608eb8b15cfa158911a94976f2c21563c466e
+        repository: ghcr.io/cozystack/cozystack/registry-photon
+        tag: v1.7.0-rc.3@sha256:bb7103f8ea3784b7924da12404806f1b2f19e2d284c54f2049766aaaf687054b
     controller:
       image:
-        repository: docker.io/goharbor/harbor-registryctl
-        tag: v2.15.1@sha256:554147a956989175f63f8d41573d716c6ddf6052acd1749c88c0f99ce6ee2bff
+        repository: ghcr.io/cozystack/cozystack/harbor-registryctl
+        tag: v1.7.0-rc.3@sha256:223af937d92110210ee0dbdcd19c8d2c365918236dc41111393acd1885303217
   exporter:
     image:
-      repository: docker.io/goharbor/harbor-exporter
-      tag: v2.15.1@sha256:372275b6b6abeb571fa7bd5de458e3d75f1a1636503b3c0abe02938f2b285d75
+      repository: ghcr.io/cozystack/cozystack/harbor-exporter
+      tag: v1.7.0-rc.3@sha256:b437212b0206bc39e2f930b3b8113d0af0b00ee6108db7e76850f916bb698a7c
   nginx:
     image:
-      repository: docker.io/goharbor/nginx-photon
-      tag: v2.15.1@sha256:1f9d06d040f2478f6cf7f6da0091877bf987a641810f4bfaadb2a87d73dbf4fb
+      repository: ghcr.io/cozystack/cozystack/nginx-photon
+      tag: v1.7.0-rc.3@sha256:0b424a225d291786b1c15d7eb7ad4ac4a33c9a0a845a8487747f17afe4c0f5f0
   trivy:
     image:
-      repository: docker.io/goharbor/trivy-adapter-photon
-      tag: v2.15.1@sha256:f0c52bed36c083ec4fded26cefab01e4cd58c9354c261cb3156c69f57bb50131
+      repository: ghcr.io/cozystack/cozystack/trivy-adapter-photon
+      tag: v1.7.0-rc.3@sha256:ab6a59fac0abdc58f752d6bc50ec69c6a900f856448891b2701921533ca576b9
 db:
   replicas: 2
   size: 5Gi
diff --git a/packages/system/kamaji/values.yaml b/packages/system/kamaji/values.yaml
index 6a6ccaa02..96d72f8e3 100644
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -28,7 +28,7 @@ kamaji:
             topologyKey: kubernetes.io/hostname
   image:
     pullPolicy: IfNotPresent
-    tag: v1.6.0@sha256:7f7751b3d01b256621a131c217fc90464cd51d3d07a6d870c3d8f28784745293
+    tag: v1.7.0-rc.3@sha256:93cc08b8ffa56a84633efc7b31b7fba876e44a1e5fd0f4d953aeee899e8f312e
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:
@@ -61,4 +61,4 @@ kamaji:
     periodSeconds: 10
     timeoutSeconds: 1
   extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.6.0@sha256:7f7751b3d01b256621a131c217fc90464cd51d3d07a6d870c3d8f28784745293
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.7.0-rc.3@sha256:93cc08b8ffa56a84633efc7b31b7fba876e44a1e5fd0f4d953aeee899e8f312e
diff --git a/packages/system/keycloak-operator/values.yaml b/packages/system/keycloak-operator/values.yaml
index 35b647570..2aa39ef2c 100644
--- a/packages/system/keycloak-operator/values.yaml
+++ b/packages/system/keycloak-operator/values.yaml
@@ -4,7 +4,7 @@ keycloak-operator:
     # cannot reach a build registry whose `registry` key holds only part of it.
     registry: ""
     repository: ghcr.io/cozystack/cozystack/keycloak-operator
-    tag: "latest@sha256:27279247dfbd2d1e86fc4e827d34c891880ca65eefd75da1701bc0a1adf865a9"
+    tag: "v1.7.0-rc.3@sha256:298f5b846f8c16f32bae67df4e811194029beabaf80b1d44820e428f2b5940af"
   clusterReconciliationEnabled: true
   resources:
     limits:
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 56dae259f..be044601f 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,7 +1,7 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: v1.5.0@sha256:fe837f428504f6c6e9e4582326a3bf9cd507a9cca58c975952f5cc0b34728f63
+    tag: v1.7.0-rc.3@sha256:c6216f8b9eec0e45aa265c9df0fcaeb8a71277cd9b242c0e5e5d91cc2980286c
     repository: ghcr.io/cozystack/cozystack/kilo
   transitCIDR: 100.66.0.0/16
   meshGranularity: location
diff --git a/packages/system/kubeovn-plunger/values.yaml b/packages/system/kubeovn-plunger/values.yaml
index 9610d7cfd..601c5c8bd 100644
--- a/packages/system/kubeovn-plunger/values.yaml
+++ b/packages/system/kubeovn-plunger/values.yaml
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.6.0@sha256:0d2a42d5aa05f73e9a5bab2ffbcf20c64e2925b7b5f50d7b39b7d366a1d8f3d6
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.7.0-rc.3@sha256:aabaeb663b978e095fd783c5265d2b05216297c93bb949a7431f352e3c8fd03e
 ovnCentralName: ovn-central
diff --git a/packages/system/kubeovn-webhook/values.yaml b/packages/system/kubeovn-webhook/values.yaml
index eef64b073..7dc4d7c7d 100644
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -28,8 +28,7 @@ routes: ""
 # and this key pointed at the mounted path. Until then the flag exists so the
 # observation above can run, not so it can be switched on.
 clientCAFile: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.6.0@sha256:593c324a38db59495497c5b68b90cad25dfe6753c73b7a287b3280e26f70a15f
-
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.7.0-rc.3@sha256:4c0b4434a3d3cf525c2256acc9aa93e87ff9bf479c766258f6f9e74c51db0af0
 # Restrict who may reach the webhook's serving port.
 #
 # The handler returns namespace-derived annotations to any caller, and only the
diff --git a/packages/system/kubeovn/values.yaml b/packages/system/kubeovn/values.yaml
index 4e142225a..f52a97540 100644
--- a/packages/system/kubeovn/values.yaml
+++ b/packages/system/kubeovn/values.yaml
@@ -79,4 +79,4 @@ global:
   images:
     kubeovn:
       repository: kubeovn
-      tag: v1.15.26@sha256:741299cbd0081a786a6b60c460fa3156b3a42a38141c559dd8ac031f50c5504f
+      tag: v1.7.0-rc.3@sha256:69b0cf6602eb2e518858d7fe66f8d2742530c209b134d48950067613431e0212
diff --git a/packages/system/kubevirt-csi-node/values.yaml b/packages/system/kubevirt-csi-node/values.yaml
index a14e51bbd..223f37a62 100644
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -9,4 +9,4 @@ storageClasses:
     infraStorageClass: replicated
     default: false
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.6.0@sha256:d6326e343c7932ce3d375c6742b9b9745090a4a26bf5bbc5ad19f5504ea93d65
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.7.0-rc.3@sha256:95d2a631c93eceb9b003d57c406315e684138a6365afe1d385ed1acb99bf9730
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index 66fddfe54..919cc3da5 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.6.0@sha256:3a5b4951a78d507eb847f4f3311052810dc658fd7c85c49eeb32ac5469cb39a2
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.7.0-rc.3@sha256:27f616fe78eceec1195e4e54a2a354a89a83ccbf1fdf9541c1fd8bfbc6646732
   debug: false
   replicas: 2
   # DEPRECATED. Injects KUBERNETES_SERVICE_HOST=status.hostIP and
diff --git a/packages/system/linstor-gui/values.yaml b/packages/system/linstor-gui/values.yaml
index f35ddb8b3..cf895696f 100644
--- a/packages/system/linstor-gui/values.yaml
+++ b/packages/system/linstor-gui/values.yaml
@@ -1,13 +1,12 @@
 # Injected by the platform from the cozystack-values Secret. The empty
 # default keeps the chart renderable on its own, outside a cluster.
 _cluster: {}
-
 ## @section Image
 ## @param image.repository LINSTOR GUI container image repository
 ## @param image.tag LINSTOR GUI container image tag (digest recommended)
 image:
   repository: ghcr.io/cozystack/cozystack/linstor-gui
-  tag: v1.6.0@sha256:6e11829de86709f5e21636cdd1a1ada1239a7dcc1741f91e9d95d9f6ade603a2
+  tag: v1.7.0-rc.3@sha256:899ce54eadb25dd26abdd804db3316119ac075a87c331de6adcecbbf8d33267b
 ## @section Deployment
 ## @param replicas Number of linstor-gui replicas
 replicas: 1
diff --git a/packages/system/linstor/values.yaml b/packages/system/linstor/values.yaml
index 4ee1429ec..ed4eb59c6 100644
--- a/packages/system/linstor/values.yaml
+++ b/packages/system/linstor/values.yaml
@@ -1,7 +1,7 @@
 piraeusServer:
   image:
     repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: v1.6.0@sha256:70ddd1a66fbc1ea58078f4645fc572ab8e2e189dbb4d9a5f9ca43d5663106483
+    tag: v1.7.0-rc.3@sha256:ba23d02dd92839181703cdfe194d68aac8f652e7af6e82234089a81f96c50098
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
   enabled: true
@@ -99,7 +99,7 @@ linstorCSI:
   strictTopology: true
   image:
     repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.6.0@sha256:ae854423de62e94fb89b59d92c20da8939196e643e83b2d60d9f6915d5b0e55c
+    tag: v1.7.0-rc.3@sha256:760c0e5434927d4995061e932a123b361c974ef1dfd361a58516801120a35dd7
 controller:
   # Resource requests for the linstor-controller JVM. Requests (not limits) are
   # set on purpose: a CPU request guarantees CPU shares so the JVM can answer its
diff --git a/packages/system/metallb/values.yaml b/packages/system/metallb/values.yaml
index 209948673..4e3ea9b94 100644
--- a/packages/system/metallb/values.yaml
+++ b/packages/system/metallb/values.yaml
@@ -37,11 +37,11 @@ metallb:
   controller:
     image:
       repository: ghcr.io/cozystack/cozystack/metallb-controller
-      tag: v1.6.0@sha256:cb7321c5674509048dfbea7938378b84013d1370eca5ace7f9665fc79b4a8a05
+      tag: v1.7.0-rc.3@sha256:ad13b61e71b9332c6fad4aa78d9ed9857058eb3a165c2512301bbced6ebba764
   speaker:
     image:
       repository: ghcr.io/cozystack/cozystack/metallb-speaker
-      tag: v1.6.0@sha256:61ab7e2381f0897607b15df7cb5ba4d51a947c261c1c197fcda3b79c7a280016
+      tag: v1.7.0-rc.3@sha256:6325666b9b83d378319ac528ca28256db99dc7e21150afc92168fcd33d28adfd
     # A memory limit is what sets memory.max on the pod cgroup, and the Talos
     # userspace OOM handler (v1.12+) only ever kills cgroups that lack it. The
     # speaker ran BestEffort, so it was picked as the victim whenever a tenant
diff --git a/packages/system/migration-controller/values.yaml b/packages/system/migration-controller/values.yaml
index 7317bfc03..cf219ea53 100644
--- a/packages/system/migration-controller/values.yaml
+++ b/packages/system/migration-controller/values.yaml
@@ -1,5 +1,5 @@
 migrationController:
-  image: "ghcr.io/cozystack/cozystack/migration-controller:latest"
+  image: "ghcr.io/cozystack/cozystack/migration-controller:v1.7.0-rc.3@sha256:16493deaf49706ac3422cd771d3b023abd13ad450f876d78fa0d55ebfe06399e"
   replicas: 1
   debug: false
   metrics:
@@ -12,7 +12,6 @@ migrationController:
     limits:
       cpu: 500m
       memory: 256Mi
-
 ## The VMware Virtual Disk Development Kit image, delivered from the platform.
 ## Never a tenant value: naming an image the cluster will run is not a tenant's
 ## decision, and this one is built from a proprietary SDK that Cozystack can
diff --git a/packages/system/monitoring/values.yaml b/packages/system/monitoring/values.yaml
index 2abaed368..606bfb394 100644
--- a/packages/system/monitoring/values.yaml
+++ b/packages/system/monitoring/values.yaml
@@ -2,63 +2,58 @@
 # defaults keep the chart renderable on its own, outside a cluster.
 _cluster: {}
 _namespace: {}
-
 host: ""
-
 metricsStorages:
-## Example:
-## metricsStorages:
-## - name: shortterm
-##   retentionPeriod: "3d"
-##   deduplicationInterval: "15s"
-##   storage: 10Gi
-##   storageClassName: ""
-##   vminsert:
-##     minAllowed:
-##       cpu: 200m
-##       memory: 512Mi
-##     maxAllowed:
-##       cpu: 1500m
-##       memory: 3Gi
-##   vmselect:
-##     minAllowed:
-##       cpu: 300m
-##       memory: 1Gi
-##     maxAllowed:
-##       cpu: 3500m
-##       memory: 6Gi
-##   vmstorage:
-##     minAllowed:
-##       cpu: 500m
-##       memory: 2Gi
-##     maxAllowed:
-##       cpu: 4000m
-##       memory: 8Gi
-- name: shortterm
-  retentionPeriod: "3d"
-  deduplicationInterval: "15s"
-  storage: 10Gi
-  storageClassName: ""
-- name: longterm
-  retentionPeriod: "14d"
-  deduplicationInterval: "5m"
-  storage: 10Gi
-  storageClassName: ""
-
+  ## Example:
+  ## metricsStorages:
+  ## - name: shortterm
+  ##   retentionPeriod: "3d"
+  ##   deduplicationInterval: "15s"
+  ##   storage: 10Gi
+  ##   storageClassName: ""
+  ##   vminsert:
+  ##     minAllowed:
+  ##       cpu: 200m
+  ##       memory: 512Mi
+  ##     maxAllowed:
+  ##       cpu: 1500m
+  ##       memory: 3Gi
+  ##   vmselect:
+  ##     minAllowed:
+  ##       cpu: 300m
+  ##       memory: 1Gi
+  ##     maxAllowed:
+  ##       cpu: 3500m
+  ##       memory: 6Gi
+  ##   vmstorage:
+  ##     minAllowed:
+  ##       cpu: 500m
+  ##       memory: 2Gi
+  ##     maxAllowed:
+  ##       cpu: 4000m
+  ##       memory: 8Gi
+  - name: shortterm
+    retentionPeriod: "3d"
+    deduplicationInterval: "15s"
+    storage: 10Gi
+    storageClassName: ""
+  - name: longterm
+    retentionPeriod: "14d"
+    deduplicationInterval: "5m"
+    storage: 10Gi
+    storageClassName: ""
 logsStorages:
-- name: generic
-  retentionPeriod: "1"
-  storage: 10Gi
-  storageClassName: ""
-
+  - name: generic
+    retentionPeriod: "1"
+    storage: 10Gi
+    storageClassName: ""
 tracingStorages: []
 tracingCentralHost: false
-
 tracingCollector:
   enabled: true
   replicas: 1
   samplingPercentage: 10
-  image: docker.io/otel/opentelemetry-collector-contrib:0.136.0@sha256:45392d534c1edcc809c2d112394029246bc679d2ae5ea7081414a1fc74f2c621
+  image: ghcr.io/cozystack/cozystack/otelcol-tracing:v0.136.0-cozystack.0@sha256:006107b8a0467d87746f873d15d032ab729babef86b1cbe1fd8a9c16562d61dd
   redactAttributes: []
   resources:
     limits:
@@ -123,7 +118,6 @@ vmagent:
   ##   - job_name: "custom"
   ##     static_configs:
   ##       - targets: ["my-service:9090"]
-
 ## OIDC authentication for the Grafana instance.
 ##
 ## Identity mode picks the auth source for `[auth.generic_oauth]`:
diff --git a/packages/system/multus/templates/multus-daemonset-thick.yml b/packages/system/multus/templates/multus-daemonset-thick.yml
index ee4a33d4a..79dc37ebd 100644
--- a/packages/system/multus/templates/multus-daemonset-thick.yml
+++ b/packages/system/multus/templates/multus-daemonset-thick.yml
@@ -156,7 +156,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.0@sha256:0a92e861ead179dd6b46f475fd8878d44b3cfa40ce4d7a8ff92f790d54250d25
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.7.0-rc.3@sha256:f8732c27bfdfe48073e514be4eed8c6eeec3b9405b26906bc05ddc1c28606367
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           # Keep a memory limit: without one the pod cgroup has no memory.max,
           # and the Talos userspace OOM handler (v1.12+) only ever kills cgroups
@@ -222,7 +222,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.0@sha256:0a92e861ead179dd6b46f475fd8878d44b3cfa40ce4d7a8ff92f790d54250d25
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.7.0-rc.3@sha256:f8732c27bfdfe48073e514be4eed8c6eeec3b9405b26906bc05ddc1c28606367
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"
@@ -248,7 +248,7 @@ spec:
 {{- if not (has $stageCniPlugins (list "true" "yes" "on" "1" "false" "no" "off" "0")) }}{{- fail (printf "stageCniPlugins: expected a boolean, got %q" $stageCniPlugins) }}{{- end }}
 {{- if has $stageCniPlugins (list "true" "yes" "on" "1") }}
         - name: install-cni-plugins
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.0@sha256:0a92e861ead179dd6b46f475fd8878d44b3cfa40ce4d7a8ff92f790d54250d25
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.7.0-rc.3@sha256:f8732c27bfdfe48073e514be4eed8c6eeec3b9405b26906bc05ddc1c28606367
           command:
             - "sh"
             - "-c"
diff --git a/packages/system/objectstorage-controller/values.yaml b/packages/system/objectstorage-controller/values.yaml
index be5263fde..4c5b33560 100644
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
   controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.6.0@sha256:9c284ef4f2fbbf5ee3ccd75f86ec6c993dc60aa673c6df3f9bd15d21a7e8485c"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.7.0-rc.3@sha256:f0c6f9c12fd3197debef467670f4793235e9057b094893abfcbb9fdf00c80ea7"
diff --git a/packages/system/opensearch-operator/values.yaml b/packages/system/opensearch-operator/values.yaml
index b3b835bc9..dc4edc5e5 100644
--- a/packages/system/opensearch-operator/values.yaml
+++ b/packages/system/opensearch-operator/values.yaml
@@ -16,12 +16,11 @@ opensearch-operator:
     # retag and mirror. `make image` rewrites both keys on every build.
     image:
       repository: ghcr.io/cozystack/cozystack/opensearch-operator
-      tag: v2.8.0@sha256:cbe6b50f13aa5abf338209d38dfcd80e73296e97510465b5fca73a0130bfaad7
+      tag: v1.7.0-rc.3@sha256:c52607d8ea24cfb557968cbddc8fff26859b11c9afbc4d535408a89013297918
   kubeRbacProxy:
     image:
       # gcr.io/kubebuilder/kube-rbac-proxy was sunset; use the original upstream
       repository: "quay.io/brancz/kube-rbac-proxy"
-
 sysctl:
   # busybox carries the sysctl applet and doubles as the idle main container.
   # Third-party pass-through pinned by digest, the same reference the kubernetes
diff --git a/packages/system/redis-operator/values.yaml b/packages/system/redis-operator/values.yaml
index 8c01e9703..3afce92c9 100644
--- a/packages/system/redis-operator/values.yaml
+++ b/packages/system/redis-operator/values.yaml
@@ -1,7 +1,7 @@
 redis-operator:
   image:
     repository: ghcr.io/cozystack/cozystack/redis-operator
-    tag: v3.3.5@sha256:551f39340bee3d6ea8e1da973cfc64092b769526c4a7aea0427070cbf6702ddd
+    tag: v1.7.0-rc.3@sha256:b86abaa7fc5dd8525f20f74b9f02c99884cbe42fd4afe62d3bd722ca9cdbf2a4
   # The freshworks-oss fork requires a non-empty operator group id at startup
   # (fatal "operator_group_id environment variable is required" otherwise); the
   # archived spotahome operator had no such knob. A single cluster-wide operator
diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml
index bce78c47f..518231823 100644
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -31,7 +31,7 @@ seaweedfs:
   # `make image` rewrites both keys on every build.
   image:
     repository: "ghcr.io/cozystack/cozystack/seaweedfs"
-    tag: "4.45@sha256:2a063deb9992ac0c06f8c09589ae063a30ac8c87af2c6aa1f4d4420cc544535c"
+    tag: "v1.7.0-rc.3@sha256:6d4b63d9c28e7553eebc45bd3723cd0160d2fdb6b4f6fd39a869c7cab0839f71"
   master:
     # At the shipped replicationFactor of 2 the size limit and
     # extraEnvironmentVars.WEED_MASTER_VOLUME_GROWTH_COPY_2 below are one
@@ -310,7 +310,7 @@ seaweedfs:
     bucketClassName: "seaweedfs"
     region: ""
     sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.6.0@sha256:4d665becd3399c2fe1e8a66e15d14d16e4a5a75395fb0ae65cff46679a8989f1"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.7.0-rc.3@sha256:b7b0d339e0e2c5043eb03b6d78e05437daae1116c0e1a6a1d88ae4f70b296534"
   certificates:
     commonName: "SeaweedFS CA"
     ipAddresses: []
diff --git a/packages/system/securitygroup-controller/values.yaml b/packages/system/securitygroup-controller/values.yaml
index a57cef788..200742edf 100644
--- a/packages/system/securitygroup-controller/values.yaml
+++ b/packages/system/securitygroup-controller/values.yaml
@@ -1,5 +1,5 @@
 securityGroupController:
-  image: "ghcr.io/cozystack/cozystack/securitygroup-controller:v1.6.0@sha256:09ee1d8fbfacc5b4ac24d0efbc8313bb0ad0e5507a149235894ac7d4b5539232"
+  image: "ghcr.io/cozystack/cozystack/securitygroup-controller:v1.7.0-rc.3@sha256:d8e73d20cc03f1d47fa904c98574595ba67582712d63839b91784005ea636c1c"
   replicas: 2
   debug: false
   resources:
diff --git a/packages/system/talos-log-collector/images/vector.tag b/packages/system/talos-log-collector/images/vector.tag
index 7b6e15913..cf0e5dfe6 100644
--- a/packages/system/talos-log-collector/images/vector.tag
+++ b/packages/system/talos-log-collector/images/vector.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/vector:0.56.0-alpine@sha256:0eb66216f5f9322264e2ba83f4606428ef77a2cd4dea619a5bea610ac80ccc43
+ghcr.io/cozystack/cozystack/vector:v1.7.0-rc.3@sha256:4b5d6ee2d1802bca9b858e278978bc44131738997cbc4e0f37691da8c968f9c9
diff --git a/packages/system/velero/values.yaml b/packages/system/velero/values.yaml
index fccb6e0aa..52575c3b7 100644
--- a/packages/system/velero/values.yaml
+++ b/packages/system/velero/values.yaml
@@ -11,7 +11,7 @@ velero:
       volumeMounts:
         - mountPath: /target
           name: plugins
-    - image: quay.io/kubevirt/kubevirt-velero-plugin:v0.9.0
+    - image: ghcr.io/cozystack/cozystack/kubevirt-velero-plugin:v1.7.0-rc.3@sha256:e2e18356449b502b3d819bb299ec642c48e260b141d38b12a36c0eab881ff32a
       name: kubevirt-kubevirt-velero-plugin
       imagePullPolicy: IfNotPresent
       volumeMounts: