diff --git a/CHANGELOG.md b/CHANGELOG.md
index 82b1270..e0bb5d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,8 @@ All notable changes to RustFS Operator are documented in this file. The format i
 
 ### Fixed
 
+- Use `docker.io/rustfs/operator` as the default Helm image repository for the Operator,
+  Console, and COSI driver, while preserving repository overrides through Helm values.
 - Reject multi-pool Tenants containing a single-node single-disk pool before applying pool workloads, matching RustFS startup constraints.
 - Reject additional volume mounts that overlap operator-managed data, logging, TLS, or OIDC paths.
 
diff --git a/deploy/rustfs-operator/README.md b/deploy/rustfs-operator/README.md
index 2bae013..6f3f8d4 100755
--- a/deploy/rustfs-operator/README.md
+++ b/deploy/rustfs-operator/README.md
@@ -121,7 +121,7 @@ helm upgrade --install rustfs-operator deploy/rustfs-operator/ \
 | Parameter | Description | Default |
 |-----------|-------------|---------|
 | `operator.replicas` | Number of operator replicas | `1` |
-| `operator.image.repository` | Operator image repository | `rustfs/operator` |
+| `operator.image.repository` | Operator image repository | `docker.io/rustfs/operator` |
 | `operator.image.tag` | Operator image tag; empty uses `Chart.appVersion` | `""` |
 | `operator.image.pullPolicy` | Image pull policy | `IfNotPresent` |
 | `operator.imagePullSecrets` | Image pull secrets | `[]` |
diff --git a/deploy/rustfs-operator/values.yaml b/deploy/rustfs-operator/values.yaml
index 11002a9..97169ec 100755
--- a/deploy/rustfs-operator/values.yaml
+++ b/deploy/rustfs-operator/values.yaml
@@ -40,7 +40,7 @@ operator:
   leaderElect:
 
   image:
-    repository: rustfs/operator
+    repository: docker.io/rustfs/operator
     # Defaults to Chart.appVersion so a released chart never selects a mutable image tag.
     tag: ""
     pullPolicy: IfNotPresent
@@ -224,7 +224,7 @@ console:
 
   image:
     # Console uses the same image as operator
-    repository: rustfs/operator
+    repository: docker.io/rustfs/operator
     tag: ""  # Defaults to operator.image.tag
     pullPolicy: IfNotPresent
 
@@ -364,7 +364,7 @@ cosiDriver:
 
   image:
     # The COSI driver binary ships in the same image as operator.
-    repository: rustfs/operator
+    repository: docker.io/rustfs/operator
     tag: ""  # Defaults to operator.image.tag
     pullPolicy: IfNotPresent
 
diff --git a/e2e/tests/sts_manifest.rs b/e2e/tests/sts_manifest.rs
index 2c58bc6..fa12d1d 100644
--- a/e2e/tests/sts_manifest.rs
+++ b/e2e/tests/sts_manifest.rs
@@ -528,7 +528,11 @@ fn helm_template(args: &[&str]) -> Option<Output> {
 
 fn helm_template_chart(chart: &Path, args: &[&str]) -> Output {
     let mut command = Command::new("helm");
-    command.arg("template").arg("rustfs-operator").arg(chart);
+    command
+        .arg("template")
+        .arg("rustfs-operator")
+        .arg(chart)
+        .args(["--namespace", "default"]);
     command.args(args);
     command.output().expect("helm template command runs")
 }
diff --git a/src/types/v1alpha1/tenant/workloads.rs b/src/types/v1alpha1/tenant/workloads.rs
index 956b2bf..7ecc605 100755
--- a/src/types/v1alpha1/tenant/workloads.rs
+++ b/src/types/v1alpha1/tenant/workloads.rs
@@ -876,7 +876,7 @@ impl Tenant {
         };
         let validate_seccomp = |field_path: &str, type_: &str, localhost_profile: Option<&str>| {
             validate_declared_seccomp_profile(field_path, type_, localhost_profile)
-                .map_err(&invalid_profile)
+                .map_err(invalid_profile)
         };
         let validate_app_armor =
             |field_path: &str, type_: &str, localhost_profile: Option<&str>| {
@@ -894,7 +894,7 @@ impl Tenant {
             "spec.containerSecurityContext",
             self.spec.container_security_context.as_ref(),
         )
-        .map_err(&invalid_profile)?;
+        .map_err(invalid_profile)?;
 
         if let Some(profile) = self
             .spec
@@ -933,7 +933,7 @@ impl Tenant {
                 &format!("spec.pools[name={}].containerSecurityContext", pool.name),
                 pool.container_security_context.as_ref(),
             )
-            .map_err(&invalid_profile)?;
+            .map_err(invalid_profile)?;
 
             if let Some(profile) = pool
                 .security_context