diff --git a/charts/retool/Chart.yaml b/charts/retool/Chart.yaml
index 230f7675..0d716efb 100644
--- a/charts/retool/Chart.yaml
+++ b/charts/retool/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: retool
 description: A Helm chart for Kubernetes
 type: application
-version: 6.11.15
+version: 6.11.16
 maintainers:
   - name: Retool Engineering
     email: engineering+helm@retool.com
diff --git a/charts/retool/templates/_helpers.tpl b/charts/retool/templates/_helpers.tpl
index e2a90e83..64e1db04 100644
--- a/charts/retool/templates/_helpers.tpl
+++ b/charts/retool/templates/_helpers.tpl
@@ -1175,6 +1175,33 @@ Two classes of stale config are caught:
 {{- end -}}
 {{- end -}}
 
+{{/*
+Render the seccomp-install initContainer image reference.
+
+The pinned digest lives here, not in values.yaml, so that overrides actually
+take effect. Helm deep-merges values, so a default digest in values.yaml would
+survive any user override of initImage.repository/tag and keep pulling the
+original pinned image (a digest always wins over a tag in an image ref), or
+fail outright against a mirror that lacks that digest. Instead we only append
+the pinned digest when the repository and tag are still the chart defaults and
+the user hasn't supplied their own digest.
+Usage: (include "retool.initImage" .)
+*/}}
+{{- define "retool.initImage" -}}
+{{- $i := .Values.initImage -}}
+{{- $defaultRepository := "busybox" -}}
+{{- $defaultTag := "1.37.0" -}}
+{{- $defaultDigest := "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f" -}}
+{{- $repository := $i.repository -}}
+{{- $tag := toString $i.tag -}}
+{{- $digest := $i.digest | default "" -}}
+{{- if and (not $digest) (eq $repository $defaultRepository) (eq $tag $defaultTag) -}}
+{{- $digest = $defaultDigest -}}
+{{- end -}}
+{{- printf "%s:%s" $repository $tag -}}
+{{- if $digest }}@{{ $digest }}{{ end -}}
+{{- end -}}
+
 {{/*
 Set code executor image tag
 Usage: (template "retool.codeExecutor.image.tag" .)
diff --git a/charts/retool/templates/deployment_code_executor.yaml b/charts/retool/templates/deployment_code_executor.yaml
index 76104dbd..98604ccb 100644
--- a/charts/retool/templates/deployment_code_executor.yaml
+++ b/charts/retool/templates/deployment_code_executor.yaml
@@ -61,7 +61,7 @@ spec:
       initContainers:
 {{- if $useSecComp }}
         - name: install-seccomp
-          image: busybox:1.37.0@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f
+          image: {{ include "retool.initImage" . }}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/charts/retool/templates/deployment_js_executor.yaml b/charts/retool/templates/deployment_js_executor.yaml
index 2e005bf6..93eb6fbe 100644
--- a/charts/retool/templates/deployment_js_executor.yaml
+++ b/charts/retool/templates/deployment_js_executor.yaml
@@ -52,7 +52,7 @@ spec:
       {{- end }}
       initContainers:
         - name: install-seccomp
-          image: busybox:1.37.0@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f
+          image: {{ include "retool.initImage" . }}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/charts/retool/values.yaml b/charts/retool/values.yaml
index edca3cbe..19e3d5d4 100644
--- a/charts/retool/values.yaml
+++ b/charts/retool/values.yaml
@@ -55,6 +55,24 @@ image:
   tag: ""
   pullPolicy: "IfNotPresent"
 
+# Small utility image for the initContainers that install the nsjail seccomp
+# profile onto the host, on the code executor and JS executor. Only used when
+# seccomp is in play.
+#
+# Override repository if every image has to come from one registry -- a private
+# mirror, an air-gapped install, or GCP Marketplace, which rejects any artifact
+# a consumer pulls from outside its own Artifact Registry.
+#
+# The upstream busybox image is pinned to a known-good digest internally, but
+# only while repository and tag are left at their defaults below. Overriding
+# either drops that pin automatically (a copied image gets a new digest, so the
+# original would pin you back to the source registry and fail the pull). Set
+# digest here to pin your own mirrored image by digest.
+initImage:
+  repository: busybox
+  tag: '1.37.0'
+  digest: ''
+
 commandline:
   args: []
 
diff --git a/values.yaml b/values.yaml
index edca3cbe..19e3d5d4 100644
--- a/values.yaml
+++ b/values.yaml
@@ -55,6 +55,24 @@ image:
   tag: ""
   pullPolicy: "IfNotPresent"
 
+# Small utility image for the initContainers that install the nsjail seccomp
+# profile onto the host, on the code executor and JS executor. Only used when
+# seccomp is in play.
+#
+# Override repository if every image has to come from one registry -- a private
+# mirror, an air-gapped install, or GCP Marketplace, which rejects any artifact
+# a consumer pulls from outside its own Artifact Registry.
+#
+# The upstream busybox image is pinned to a known-good digest internally, but
+# only while repository and tag are left at their defaults below. Overriding
+# either drops that pin automatically (a copied image gets a new digest, so the
+# original would pin you back to the source registry and fail the pull). Set
+# digest here to pin your own mirrored image by digest.
+initImage:
+  repository: busybox
+  tag: '1.37.0'
+  digest: ''
+
 commandline:
   args: []