diff --git a/docs/source/plugins.md b/docs/source/plugins.md
index 08d4ddd8f..efec8c081 100644
--- a/docs/source/plugins.md
+++ b/docs/source/plugins.md
@@ -220,7 +220,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
 values:
   hosts:
   - macAddress: 00:aa:bb:cc:dd
diff --git a/krm-functions/replacement-transformer/local-resource/example-use.yaml b/krm-functions/replacement-transformer/local-resource/example-use.yaml
index c71970b69..c1215b32b 100644
--- a/krm-functions/replacement-transformer/local-resource/example-use.yaml
+++ b/krm-functions/replacement-transformer/local-resource/example-use.yaml
@@ -17,7 +17,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
   name: k8scontrol-versions-replacements
 replacements:
 # Replace the Kubernetes version in the KubeadmControlPlane
diff --git a/krm-functions/templater/local-resource/example-use.yaml b/krm-functions/templater/local-resource/example-use.yaml
index 360e8fc82..8594135fa 100644
--- a/krm-functions/templater/local-resource/example-use.yaml
+++ b/krm-functions/templater/local-resource/example-use.yaml
@@ -15,7 +15,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
 values:
   hosts:
   - macAddress: 00:aa:bb:cc:dd
diff --git a/krm-functions/toolbox/README.md b/krm-functions/toolbox/README.md
index 7f55a4ea0..14539aff3 100644
--- a/krm-functions/toolbox/README.md
+++ b/krm-functions/toolbox/README.md
@@ -30,7 +30,7 @@ The toolbox image has pre-installed `sh` shell,`kubectl` and `calicoctl`.
             airshipit.org/deploy-k8s: "false"
         spec:
           type: krm
-          image: quay.io/airshipit/toolbox:latest
+          image: localhost/toolbox
           hostNetwork: true
           envVars
             MY_ENV # airshipctl will populate this value from your current env, you can pass credentials like this
diff --git a/manifests/function/airshipctl-base-catalogues/env-vars-template.yaml b/manifests/function/airshipctl-base-catalogues/env-vars-template.yaml
index 568f48496..4198c59c1 100644
--- a/manifests/function/airshipctl-base-catalogues/env-vars-template.yaml
+++ b/manifests/function/airshipctl-base-catalogues/env-vars-template.yaml
@@ -7,7 +7,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
         envs:
           - HTTP_PROXY
           - HTTPS_PROXY
diff --git a/manifests/function/baremetal-operator/replacements/ironic-env-vars.yaml b/manifests/function/baremetal-operator/replacements/ironic-env-vars.yaml
index 880f030ec..a17495248 100644
--- a/manifests/function/baremetal-operator/replacements/ironic-env-vars.yaml
+++ b/manifests/function/baremetal-operator/replacements/ironic-env-vars.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the proxy vars
 - source:
diff --git a/manifests/function/baremetal-operator/replacements/networking.yaml b/manifests/function/baremetal-operator/replacements/networking.yaml
index ecd0ae278..f666e4521 100644
--- a/manifests/function/baremetal-operator/replacements/networking.yaml
+++ b/manifests/function/baremetal-operator/replacements/networking.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the pod & service networks
 - source:
diff --git a/manifests/function/baremetal-operator/replacements/versions.yaml b/manifests/function/baremetal-operator/replacements/versions.yaml
index ea85183e8..81265d13d 100644
--- a/manifests/function/baremetal-operator/replacements/versions.yaml
+++ b/manifests/function/baremetal-operator/replacements/versions.yaml
@@ -7,7 +7,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Container versions for the ironic Deployment
 - source:
diff --git a/manifests/function/bootstrap/replacements/remotedirect-vars.yaml b/manifests/function/bootstrap/replacements/remotedirect-vars.yaml
index a42c84f55..0bc81b273 100644
--- a/manifests/function/bootstrap/replacements/remotedirect-vars.yaml
+++ b/manifests/function/bootstrap/replacements/remotedirect-vars.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/bootstrap/template.yaml b/manifests/function/bootstrap/template.yaml
index bdeb902dc..970722428 100644
--- a/manifests/function/bootstrap/template.yaml
+++ b/manifests/function/bootstrap/template.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
         envs:
         - AIRSHIPCTL_EPHEMERAL_ISO_URL
 template: |
diff --git a/manifests/function/clusterctl/replacements/versions.yaml b/manifests/function/clusterctl/replacements/versions.yaml
index a087b0b47..205d1e02b 100644
--- a/manifests/function/clusterctl/replacements/versions.yaml
+++ b/manifests/function/clusterctl/replacements/versions.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace capm3 versions
 - source:
diff --git a/manifests/function/cni/tigera-operator/replacements/versions.yaml b/manifests/function/cni/tigera-operator/replacements/versions.yaml
index d7f447029..46948a7e8 100644
--- a/manifests/function/cni/tigera-operator/replacements/versions.yaml
+++ b/manifests/function/cni/tigera-operator/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/ephemeral/replacements/ephemeral-env-vars.yaml b/manifests/function/ephemeral/replacements/ephemeral-env-vars.yaml
index 3aadb81d9..dcdee05a2 100644
--- a/manifests/function/ephemeral/replacements/ephemeral-env-vars.yaml
+++ b/manifests/function/ephemeral/replacements/ephemeral-env-vars.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the proxy vars
 - source:
diff --git a/manifests/function/ephemeral/replacements/generated-secrets.yaml b/manifests/function/ephemeral/replacements/generated-secrets.yaml
index d3d8d6507..429eb86b2 100644
--- a/manifests/function/ephemeral/replacements/generated-secrets.yaml
+++ b/manifests/function/ephemeral/replacements/generated-secrets.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/ephemeral/replacements/networking.yaml b/manifests/function/ephemeral/replacements/networking.yaml
index 8f2539c1a..13c700ef9 100644
--- a/manifests/function/ephemeral/replacements/networking.yaml
+++ b/manifests/function/ephemeral/replacements/networking.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Substring-replace the ephemeral control plane's info
 - source:
diff --git a/manifests/function/flux/helm-controller/replacements/versions.yaml b/manifests/function/flux/helm-controller/replacements/versions.yaml
index ba0b3ceea..17244a58f 100644
--- a/manifests/function/flux/helm-controller/replacements/versions.yaml
+++ b/manifests/function/flux/helm-controller/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/flux/source-controller/replacements/env-vars.yaml b/manifests/function/flux/source-controller/replacements/env-vars.yaml
index 6fb9a8e00..d04330e60 100644
--- a/manifests/function/flux/source-controller/replacements/env-vars.yaml
+++ b/manifests/function/flux/source-controller/replacements/env-vars.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the proxy vars
 - source:
diff --git a/manifests/function/flux/source-controller/replacements/versions.yaml b/manifests/function/flux/source-controller/replacements/versions.yaml
index ed374eb3d..319d44fa3 100644
--- a/manifests/function/flux/source-controller/replacements/versions.yaml
+++ b/manifests/function/flux/source-controller/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/generate-secrets-example/README.md b/manifests/function/generate-secrets-example/README.md
index 75d10d2c8..7310cdf66 100644
--- a/manifests/function/generate-secrets-example/README.md
+++ b/manifests/function/generate-secrets-example/README.md
@@ -101,7 +101,7 @@ metadata:
 kustomizeSinkOutputDir: "target/encrypted/results/generated"
 spec:
   container:
-    image: quay.io/airshipit/templater:v2
+    image: localhost/templater
 config: |
   foo: bar
 ```
diff --git a/manifests/function/generate-secrets-example/secret-generation.yaml b/manifests/function/generate-secrets-example/secret-generation.yaml
index aa547d7c6..02c3443e6 100644
--- a/manifests/function/generate-secrets-example/secret-generation.yaml
+++ b/manifests/function/generate-secrets-example/secret-generation.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
 values:
   clusterCa:
     cn: "Kubernetes API"
diff --git a/manifests/function/hardwareprofile-example/replacements/hosts.yaml b/manifests/function/hardwareprofile-example/replacements/hosts.yaml
index 3b61d1465..61dc5d7dd 100644
--- a/manifests/function/hardwareprofile-example/replacements/hosts.yaml
+++ b/manifests/function/hardwareprofile-example/replacements/hosts.yaml
@@ -8,7 +8,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/helm-chart-collator/replacements/versions.yaml b/manifests/function/helm-chart-collator/replacements/versions.yaml
index e31766dcc..c44ee59bc 100644
--- a/manifests/function/helm-chart-collator/replacements/versions.yaml
+++ b/manifests/function/helm-chart-collator/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/helm-operator/replacements/helm-operator-env-vars.yaml b/manifests/function/helm-operator/replacements/helm-operator-env-vars.yaml
index ab0ee78f8..504ef2d38 100644
--- a/manifests/function/helm-operator/replacements/helm-operator-env-vars.yaml
+++ b/manifests/function/helm-operator/replacements/helm-operator-env-vars.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the proxy vars
 - source:
diff --git a/manifests/function/helm-operator/replacements/versions.yaml b/manifests/function/helm-operator/replacements/versions.yaml
index 142e7dcc3..c46f01f67 100644
--- a/manifests/function/helm-operator/replacements/versions.yaml
+++ b/manifests/function/helm-operator/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/hostgenerator-m3/hosttemplate.yaml b/manifests/function/hostgenerator-m3/hosttemplate.yaml
index 8a03c16a8..2dbe64b6f 100644
--- a/manifests/function/hostgenerator-m3/hosttemplate.yaml
+++ b/manifests/function/hostgenerator-m3/hosttemplate.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
 
 values:
   # hosts:
diff --git a/manifests/function/hostgenerator-m3/replacements/hosts.yaml b/manifests/function/hostgenerator-m3/replacements/hosts.yaml
index 4f13d219f..9f6429c81 100644
--- a/manifests/function/hostgenerator-m3/replacements/hosts.yaml
+++ b/manifests/function/hostgenerator-m3/replacements/hosts.yaml
@@ -7,7 +7,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/hwcc/replacements/versions.yaml b/manifests/function/hwcc/replacements/versions.yaml
index a7a6d04f9..209f5bd84 100644
--- a/manifests/function/hwcc/replacements/versions.yaml
+++ b/manifests/function/hwcc/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/k8scontrol/replacements/cluster.yaml b/manifests/function/k8scontrol/replacements/cluster.yaml
index a1d99ed6c..03e4580a7 100644
--- a/manifests/function/k8scontrol/replacements/cluster.yaml
+++ b/manifests/function/k8scontrol/replacements/cluster.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/k8scontrol/replacements/generated-secrets.yaml b/manifests/function/k8scontrol/replacements/generated-secrets.yaml
index 767e5206c..31ab11d73 100644
--- a/manifests/function/k8scontrol/replacements/generated-secrets.yaml
+++ b/manifests/function/k8scontrol/replacements/generated-secrets.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/k8scontrol/replacements/k8scontrol-env-vars.yaml b/manifests/function/k8scontrol/replacements/k8scontrol-env-vars.yaml
index acc96d9b9..82a0a1fa7 100644
--- a/manifests/function/k8scontrol/replacements/k8scontrol-env-vars.yaml
+++ b/manifests/function/k8scontrol/replacements/k8scontrol-env-vars.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the proxy vars
 - source:
diff --git a/manifests/function/k8scontrol/replacements/networking.yaml b/manifests/function/k8scontrol/replacements/networking.yaml
index 4ed7fee89..4d9957594 100644
--- a/manifests/function/k8scontrol/replacements/networking.yaml
+++ b/manifests/function/k8scontrol/replacements/networking.yaml
@@ -11,7 +11,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the pod & service networks
 - source:
diff --git a/manifests/function/k8scontrol/replacements/versions.yaml b/manifests/function/k8scontrol/replacements/versions.yaml
index 3d9d47341..c5461cd44 100644
--- a/manifests/function/k8scontrol/replacements/versions.yaml
+++ b/manifests/function/k8scontrol/replacements/versions.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the Kubernetes version in the KubeadmControlPlane
 - source:
diff --git a/manifests/function/validator/template.yaml b/manifests/function/validator/template.yaml
index bd778dd7e..5eb129337 100755
--- a/manifests/function/validator/template.yaml
+++ b/manifests/function/validator/template.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
         envs:
         - AIRSHIPCTL_CURRENT_PHASE
         - AIRSHIPCTL_CURRENT_PLAN
diff --git a/manifests/function/workers-capm3/replacements/generated-secrets.yaml b/manifests/function/workers-capm3/replacements/generated-secrets.yaml
index 7d59c9fac..6f3f2e6ab 100644
--- a/manifests/function/workers-capm3/replacements/generated-secrets.yaml
+++ b/manifests/function/workers-capm3/replacements/generated-secrets.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/function/workers-capm3/replacements/workers-env-vars.yaml b/manifests/function/workers-capm3/replacements/workers-env-vars.yaml
index 70285051c..2ff192e85 100644
--- a/manifests/function/workers-capm3/replacements/workers-env-vars.yaml
+++ b/manifests/function/workers-capm3/replacements/workers-env-vars.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 # Replace the proxy vars
 - source:
diff --git a/manifests/phases/executors.yaml b/manifests/phases/executors.yaml
index afe9520ef..0b9a28b78 100644
--- a/manifests/phases/executors.yaml
+++ b/manifests/phases/executors.yaml
@@ -209,7 +209,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/cloud-init:v2
+  image: localhost/cloud-init
   mounts:
     - type: bind
       src: /srv/images
@@ -282,7 +282,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
 configRef:
   kind: ConfigMap
@@ -297,7 +297,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
 configRef:
   kind: ConfigMap
@@ -312,7 +312,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
 configRef:
   kind: ConfigMap
@@ -327,7 +327,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
 configRef:
   kind: ConfigMap
@@ -342,7 +342,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
 configRef:
   kind: ConfigMap
@@ -357,7 +357,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
 configRef:
   kind: ConfigMap
@@ -372,7 +372,7 @@ metadata:
     airshipit.org/deploy-k8s: "false"
 spec:
   type: krm
-  image: quay.io/airshipit/kubeval-validator:latest
+  image: localhost/kubeval-validator
   envVars:
     - VALIDATOR_PREVENT_CLEANUP # Validator won't cleanup its working directory after finish
     - VALIDATOR_PLAN_VALIDATION # Validator will not use phase-specific settings for validation
@@ -397,7 +397,7 @@ kind: GenericContainer
 metadata:
   name: kubectl-pause-bmh
 spec:
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
   envVars:
   - RESOURCE_GROUP_FILTER=metal3.io
@@ -413,7 +413,7 @@ kind: GenericContainer
 metadata:
   name: kubectl-wait-cluster
 spec:
-  image: quay.io/airshipit/toolbox:latest
+  image: localhost/toolbox
   hostNetwork: true
   envVars:
     - RESOURCE_GROUP_FILTER=cluster.x-k8s.io
diff --git a/manifests/site/test-site/kubeconfig/update-target.yaml b/manifests/site/test-site/kubeconfig/update-target.yaml
index 3af7f8d78..c9bc5504d 100644
--- a/manifests/site/test-site/kubeconfig/update-target.yaml
+++ b/manifests/site/test-site/kubeconfig/update-target.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/manifests/type/gating/target/decrypt-secrets/configurable-decryption.yaml b/manifests/type/gating/target/decrypt-secrets/configurable-decryption.yaml
index 0be9ef32a..ac95d5e2e 100644
--- a/manifests/type/gating/target/decrypt-secrets/configurable-decryption.yaml
+++ b/manifests/type/gating/target/decrypt-secrets/configurable-decryption.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
         envs:
         - TOLERATE_DECRYPTION_FAILURES
         - DEBUG_SOPS_GPG
diff --git a/manifests/type/gating/target/generator/secret-template.yaml b/manifests/type/gating/target/generator/secret-template.yaml
index e556f45bc..db8695aef 100644
--- a/manifests/type/gating/target/generator/secret-template.yaml
+++ b/manifests/type/gating/target/generator/secret-template.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/airshipit/templater:v2
+        image: localhost/templater
 values:
   sshKeyGen:
     encBit: 4096
diff --git a/manifests/type/gating/target/workload/ingress/replacements/versions.yaml b/manifests/type/gating/target/workload/ingress/replacements/versions.yaml
index 473a4b78b..c0c85a871 100644
--- a/manifests/type/gating/target/workload/ingress/replacements/versions.yaml
+++ b/manifests/type/gating/target/workload/ingress/replacements/versions.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: quay.io/airshipit/replacement-transformer:v2
+        image: localhost/replacement-transformer
 replacements:
 - source:
     objref:
diff --git a/tools/deployment/21_systemwide_executable.sh b/tools/deployment/21_systemwide_executable.sh
index 54ce4c1c4..de2f52674 100755
--- a/tools/deployment/21_systemwide_executable.sh
+++ b/tools/deployment/21_systemwide_executable.sh
@@ -35,3 +35,31 @@ else
   echo "Airshipctl version"
   airshipctl version
 fi
+
+# Outside of releases, the airshipctl/treasuremap manifests reference krm functions via
+# local-only image tags, specifically `localhost/<function name>`, so that we can
+# set them externally in a single place (below parameters/logic), rather than maintaining
+# explicit versions directly in the manifests. By default, these parameters
+# reference the krm functions built above via `make images`, so that treasuremap
+# and other downstream consumers can easily use the krm function versions matching
+# the version of airshipctl that they are installing via this script.
+export AIRSHIP_KRM_FUNCTION_REPO=${AIRSHIP_KRM_FUNCTION_REPO:-"quay.io/airshipit"}
+export AIRSHIP_KRM_FUNCTION_TAG=${AIRSHIP_KRM_FUNCTION_TAG:-"latest"}
+export SOPS_KRM_FUNCTION=${SOPS_KRM_FUNCTION:-"gcr.io/kpt-fn-contrib/sops:v0.1.0"}
+
+echo "Resolve krm function versions"
+
+set_krm_function () {
+  if [[ "$(docker images -q "$2" 2> /dev/null)" == "" ]]; then
+    docker pull "$2"
+  fi
+  docker tag "$2" "localhost/$1"
+}
+
+for FUNC in $(cd krm-functions; echo */ | tr -d /)
+do
+  IMG="${AIRSHIP_KRM_FUNCTION_REPO}/${FUNC}:${AIRSHIP_KRM_FUNCTION_TAG}"
+  set_krm_function "$FUNC" "$IMG"
+done
+
+set_krm_function "sops" "$SOPS_KRM_FUNCTION"
diff --git a/tools/deployment/update-krm-images b/tools/deployment/update-krm-images
index 9c40794ed..cb2c090cf 100755
--- a/tools/deployment/update-krm-images
+++ b/tools/deployment/update-krm-images
@@ -21,17 +21,23 @@ set -xe
 
 export MANIFEST_DIR=${MANIFEST_DIR:-"$(pwd)"}
 
-export OLD_REPLACEMENT_TRANSFORMER=${OLD_REPLACEMENT_TRANSFORMER:-"quay.io/airshipit/replacement-transformer:v2"}
-export OLD_TEMPLATER=${OLD_TEMPLATER:-"quay.io/airshipit/templater:v2"}
-export OLD_CLOUD_INIT=${OLD_CLOUD_INIT:-"quay.io/airshipit/cloud-init:v2"}
+export OLD_REPLACEMENT_TRANSFORMER=${OLD_REPLACEMENT_TRANSFORMER:-"localhost/replacement-transformer"}
+export OLD_TEMPLATER=${OLD_TEMPLATER:-"localhost/templater"}
+export OLD_CLOUD_INIT=${OLD_CLOUD_INIT:-"localhost/cloud-init"}
+export OLD_TOOLBOX=${OLD_TOOLBOX:-"localhost/toolbox"}
+export OLD_KUBEVAL_VALIDATOR=${OLD_KUBEVAL_VALIDATOR:-"localhost/kubeval-validator"}
 export OLD_SOPS=${OLD_SOPS:-"gcr.io/kpt-fn-contrib/sops:v0.1.0"}
 
 export NEW_REPLACEMENT_TRANSFORMER=${NEW_REPLACEMENT_TRANSFORMER:-$OLD_REPLACEMENT_TRANSFORMER}
 export NEW_TEMPLATER=${NEW_TEMPLATER:-$OLD_TEMPLATER}
 export NEW_CLOUD_INIT=${NEW_CLOUD_INIT:-$OLD_CLOUD_INIT}
+export NEW_TOOLBOX=${NEW_TOOLBOX:-$OLD_TOOLBOX}
+export NEW_KUBEVAL_VALIDATOR=${NEW_KUBEVAL_VALIDATOR:-$OLD_KUBEVAL_VALIDATOR}
 export NEW_SOPS=${NEW_SOPS:-$OLD_SOPS}
 
 find "$MANIFEST_DIR" -type f -exec sed -i -e "s#$OLD_REPLACEMENT_TRANSFORMER#$NEW_REPLACEMENT_TRANSFORMER#g" {} \;
 find "$MANIFEST_DIR" -type f -exec sed -i -e "s#$OLD_TEMPLATER#$NEW_TEMPLATER#g" {} \;
 find "$MANIFEST_DIR" -type f -exec sed -i -e "s#$OLD_CLOUD_INIT#$NEW_CLOUD_INIT#g" {} \;
+find "$MANIFEST_DIR" -type f -exec sed -i -e "s#$OLD_TOOLBOX#$NEW_TOOLBOX#g" {} \;
+find "$MANIFEST_DIR" -type f -exec sed -i -e "s#$OLD_KUBEVAL_VALIDATOR#$NEW_KUBEVAL_VALIDATOR#g" {} \;
 find "$MANIFEST_DIR" -type f -exec sed -i -e "s#$OLD_SOPS#$NEW_SOPS#g" {} \;