diff --git a/catalog/imagelist.yaml b/catalog/imagelist.yaml
index 7e6230e00..4895db27d 100644
--- a/catalog/imagelist.yaml
+++ b/catalog/imagelist.yaml
@@ -1,5 +1,7 @@
 - alpine:3.20
 - bats/bats:1.11.0
+- ghcr.io/appscode-images/ingress-nginx-controller:v1.15.1
+- ghcr.io/appscode-images/nats:2.12.6-alpine
 - ghcr.io/appscode-images/registry:3.1.1
 - ghcr.io/appscode/ace:v0.2.0
 - ghcr.io/appscode/acerproxy:v0.2.0
@@ -19,6 +21,7 @@
 - ghcr.io/appscode/grafana:v2025.2.3
 - ghcr.io/appscode/inbox-server:postgres-latest
 - ghcr.io/appscode/inbox-ui:0.0.5
+- ghcr.io/appscode/k8s-wait-for:v2.0
 - ghcr.io/appscode/kube-rbac-proxy:v0.18.2
 - ghcr.io/appscode/kubectl-nonroot:1.34
 - ghcr.io/appscode/kubedb-ui:2.4.0
@@ -26,14 +29,24 @@
 - ghcr.io/appscode/marketplace-ui:0.3.1
 - ghcr.io/appscode/maxmind-geoip:city-mmdb-latest
 - ghcr.io/appscode/offline-license-server:v0.0.76
+- ghcr.io/appscode/openfga:v1.11.3
 - ghcr.io/appscode/outboxsyncer:v0.5.0
+- ghcr.io/appscode/pgoutbox:v0.0.4
 - ghcr.io/appscode/platform-ui:2.4.0
+- ghcr.io/appscode/prom-authproxy:v0.0.2
 - ghcr.io/appscode/s3proxy:sha-a82ca68
 - ghcr.io/appscode/service-provider:v0.0.2
 - ghcr.io/appscode/smtprelay:v0.0.4
+- ghcr.io/appscode/trickster:v2.0.0
 - ghcr.io/appscode/website:v2026.7.10
+- ghcr.io/cloudoperators/greenhouse-extensions-integration-test:main
+- ghcr.io/opnpulse/perses:v2026.4.24
 - ghcr.io/voyagermesh/crd-manager:v0.3.0
+- ghcr.io/voyagermesh/defaultbackend:1.5
 - ghcr.io/voyagermesh/echoserver:v20221109
 - ghcr.io/voyagermesh/envoy:v1.37.2-ac
 - ghcr.io/voyagermesh/gateway:v1.8.2
 - minio/minio:RELEASE.2023-01-12T02-06-16Z
+- natsio/nats-box:0.13.8
+- natsio/nats-server-config-reloader:0.22.3
+- natsio/prometheus-nats-exporter:0.19.2
diff --git a/charts/ace-installer/ace-installer.sample.yaml b/charts/ace-installer/ace-installer.sample.yaml
new file mode 100644
index 000000000..20bcf3458
--- /dev/null
+++ b/charts/ace-installer/ace-installer.sample.yaml
@@ -0,0 +1,31 @@
+# Sample values used only by `image-packer list` to render the releases that are
+# disabled in values.yaml. Not consumed by `ct` or `helm install`.
+
+helm:
+  releases:
+    ace:
+      enabled: true
+    acerproxy:
+      enabled: true
+    capi-catalog:
+      enabled: true
+    catalog-manager:
+      enabled: true
+    flux2:
+      enabled: true
+    kubestash:
+      enabled: true
+    prom-label-proxy:
+      enabled: true
+    service-gateway-presets:
+      enabled: true
+    stash-presets:
+      enabled: true
+    cluster-manager-spoke:
+      enabled: true
+    spoke-cluster-addons:
+      enabled: true
+    vcluster:
+      enabled: true
+    vcluster-plugin-ace:
+      enabled: true
diff --git a/charts/ace/ace.sample.yaml b/charts/ace/ace.sample.yaml
new file mode 100644
index 000000000..c773dbf93
--- /dev/null
+++ b/charts/ace/ace.sample.yaml
@@ -0,0 +1,87 @@
+# Sample values used only by `image-packer list` to render the optional subcharts
+# that are disabled in values.yaml, so their images reach catalog/imagelist.yaml.
+# Registry/tag overrides mirror what lib-selfhost applies to a real deployment.
+# Not consumed by `ct` or `helm install`.
+
+platform-ui:
+  enabled: true
+
+cluster-ui:
+  enabled: true
+
+kubedb-ui:
+  enabled: true
+
+platform-api:
+  enabled: true
+
+grafana:
+  enabled: true
+
+perses:
+  enabled: true
+
+trickster:
+  enabled: true
+  sidecars:
+    spec:
+      auth:
+        name: auth
+        image: ghcr.io/appscode/prom-authproxy:v0.0.2
+
+s3proxy:
+  enabled: true
+
+pgoutbox:
+  enabled: true
+
+outbox-syncer:
+  enabled: true
+
+gateway:
+  enabled: true
+
+ingress-nginx:
+  enabled: true
+  controller:
+    admissionWebhooks:
+      enabled: false
+    image:
+      registry: ghcr.io
+      image: appscode-images/ingress-nginx-controller
+      digest: ""
+  defaultBackend:
+    enabled: true
+    image:
+      registry: ghcr.io
+      image: voyagermesh/defaultbackend
+
+nats:
+  enabled: true
+  nats:
+    image:
+      registry: ghcr.io
+      repository: appscode-images/nats
+      tag: 2.12.6-alpine
+  bootconfig:
+    image:
+      tag: 0.22.3
+  reloader:
+    image:
+      tag: 0.22.3
+  exporter:
+    enabled: true
+    image:
+      tag: 0.19.2
+
+openfga:
+  enabled: true
+  # the migrate Job and its `wait-for-migration` init container only render for a
+  # sql engine, so k8s-wait-for is missed without this
+  datastore:
+    engine: postgres
+  datastoreURI: postgres://postgres:xyz@ace-db.ace.svc:5432/postgres?dbname=openfga&sslmode=disable
+  image:
+    repository: ghcr.io/appscode/openfga
+  initContainer:
+    repository: ghcr.io/appscode/k8s-wait-for