diff --git a/api/v1alpha1/controlplane_types.go b/api/v1alpha1/controlplane_types.go
index c029d6e0..97ae84d4 100644
--- a/api/v1alpha1/controlplane_types.go
+++ b/api/v1alpha1/controlplane_types.go
@@ -26,7 +26,9 @@ type ControlPlaneSpec struct {
 	// Image is the container image used for all simplyblock control-plane and
 	// storage-node workloads (e.g. quay.io/simplyblock-io/simplyblock:26.2.2).
 	// StorageNode CRs that omit spec.clusterImage inherit this value.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
 	// +optional
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	Image string `json:"image,omitempty"`
 }
 
diff --git a/api/v1alpha1/storagenode_types.go b/api/v1alpha1/storagenode_types.go
index 7322a8f3..347e9c26 100644
--- a/api/v1alpha1/storagenode_types.go
+++ b/api/v1alpha1/storagenode_types.go
@@ -39,6 +39,8 @@ type StorageNodeSpec struct {
 	ClusterName string `json:"clusterName"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Cluster Image"
 	// ClusterImage is the container image used for storage-node workloads.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	ClusterImage string `json:"clusterImage,omitempty"`
 	// +kubebuilder:validation:Enum=shutdown;restart;suspend;resume;remove
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Action"
@@ -56,9 +58,13 @@ type StorageNodeSpec struct {
 	MaxSize string `json:"maxSize,omitempty"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="SPDK Image"
 	// SpdkImage is the SPDK image reference used by node services.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	SpdkImage string `json:"spdkImage,omitempty"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="SPDK Proxy Image"
 	// SpdkProxyImage is the SPDK proxy image reference used by node services.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	SpdkProxyImage string `json:"spdkProxyImage,omitempty"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Management Interface"
 	// MgmtIfname is the management interface name used by storage nodes.
diff --git a/config/crd/bases/storage.simplyblock.io_controlplanes.yaml b/config/crd/bases/storage.simplyblock.io_controlplanes.yaml
index 3ed7b297..e6a55cb6 100644
--- a/config/crd/bases/storage.simplyblock.io_controlplanes.yaml
+++ b/config/crd/bases/storage.simplyblock.io_controlplanes.yaml
@@ -62,6 +62,8 @@ spec:
                   Image is the container image used for all simplyblock control-plane and
                   storage-node workloads (e.g. quay.io/simplyblock-io/simplyblock:26.2.2).
                   StorageNode CRs that omit spec.clusterImage inherit this value.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
             type: object
           status:
diff --git a/config/crd/bases/storage.simplyblock.io_storagenodes.yaml b/config/crd/bases/storage.simplyblock.io_storagenodes.yaml
index b713de69..7e85048c 100644
--- a/config/crd/bases/storage.simplyblock.io_storagenodes.yaml
+++ b/config/crd/bases/storage.simplyblock.io_storagenodes.yaml
@@ -49,8 +49,10 @@ spec:
                 - remove
                 type: string
               clusterImage:
-                description: ClusterImage is the container image used for storage-node
-                  workloads.
+                description: |-
+                  ClusterImage is the container image used for storage-node workloads.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               clusterName:
                 description: ClusterName is the target storage cluster name.
@@ -158,11 +160,16 @@ spec:
                   type: string
                 type: array
               spdkImage:
-                description: SpdkImage is the SPDK image reference used by node services.
+                description: |-
+                  SpdkImage is the SPDK image reference used by node services.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               spdkProxyImage:
-                description: SpdkProxyImage is the SPDK proxy image reference used
-                  by node services.
+                description: |-
+                  SpdkProxyImage is the SPDK proxy image reference used by node services.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               tolerations:
                 description: Tolerations configures pod tolerations for storage-node
diff --git a/config/samples/storage_v1alpha1_storagenode.yaml b/config/samples/storage_v1alpha1_storagenode.yaml
index e040edf4..e381db89 100644
--- a/config/samples/storage_v1alpha1_storagenode.yaml
+++ b/config/samples/storage_v1alpha1_storagenode.yaml
@@ -7,7 +7,7 @@ metadata:
   name: storagenode-sample
 spec:
   clusterName: sample-cluster
-  clusterImage: simplyblock/snode:latest
+  clusterImage: quay.io/simplyblock-io/simplyblock:26.2.5-PRE
   maxLogicalVolumeCount: 256
   workerNodes:
     - worker-node-1
diff --git a/dist/install.yaml b/dist/install.yaml
index ea3bc494..0428344a 100644
--- a/dist/install.yaml
+++ b/dist/install.yaml
@@ -1553,8 +1553,10 @@ spec:
                 - remove
                 type: string
               clusterImage:
-                description: ClusterImage is the container image used for storage-node
-                  workloads.
+                description: |-
+                  ClusterImage is the container image used for storage-node workloads.
+                  Must reference the quay.io/simplyblock-io registry; digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               clusterName:
                 description: ClusterName is the target storage cluster name.
@@ -1662,11 +1664,16 @@ spec:
                   type: string
                 type: array
               spdkImage:
-                description: SpdkImage is the SPDK image reference used by node services.
+                description: |-
+                  SpdkImage is the SPDK image reference used by node services.
+                  Must reference the quay.io/simplyblock-io registry; digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               spdkProxyImage:
-                description: SpdkProxyImage is the SPDK proxy image reference used
-                  by node services.
+                description: |-
+                  SpdkProxyImage is the SPDK proxy image reference used by node services.
+                  Must reference the quay.io/simplyblock-io registry; digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               tolerations:
                 description: Tolerations configures pod tolerations for storage-node