diff --git a/charts/helmfile/helmfile.yaml.gotmpl b/charts/helmfile/helmfile.yaml.gotmpl
index 27e943bf..8da6f6e1 100644
--- a/charts/helmfile/helmfile.yaml.gotmpl
+++ b/charts/helmfile/helmfile.yaml.gotmpl
@@ -2,14 +2,15 @@ environments:
   default:
     values:
       - ./values/common.yaml
+  kind:
+    values:
+      - ./values/common.yaml
+      - ../../tests/integration/kind/helmfile/values-kind.yaml
 ---
 {{- $deployCertManager := .Values.releases.certManager.enabled }}
 {{- $deployPostgresql := .Values.releases.postgresql.enabled }}
 {{- $deployManagementServer := .Values.releases.managementServer.enabled }}
-{{- $postgresqlNamespace := .Values.releases.postgresql.namespace }}
-{{- if ne $postgresqlNamespace "" }}
-{{- $postgresqlNamespace = printf "-n %s" $postgresqlNamespace }}
-{{- end }}
+{{- $pgNamespace := .Values.releases.postgresql.namespace }}
 
 repositories:
   - name: bitnami
@@ -28,6 +29,17 @@ releases:
       - crds:
           enabled: true
           keep: true
+    hooks:
+      - events: ["postsync"]
+        showlogs: true
+        command: sh
+        args:
+          - -c
+          - |
+            kubectl wait --for=condition=Established crd/certificates.cert-manager.io --timeout=300s
+            kubectl wait --for=condition=Established crd/issuers.cert-manager.io --timeout=300s
+            kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=300s
+            kubectl -n cert-manager wait pod -l app.kubernetes.io/component=webhook --for=condition=Ready --timeout=300s
   - name: postgresql
     {{- if ne .Values.releases.postgresql.namespace "" }}
     namespace: {{ .Values.releases.postgresql.namespace }}
@@ -47,11 +59,31 @@ releases:
         args:
           - -c
           - |
-            kubectl create configmap db-init-configmap {{ $postgresqlNamespace }} --from-file=./resources/db-setup.sql -o yaml --dry-run=client | kubectl apply -f -
+            kubectl create configmap db-init-configmap {{- if ne $pgNamespace "" }} -n {{ $pgNamespace }}{{- end }} --from-file=./resources/db-setup.sql -o yaml --dry-run=client | kubectl apply -f -
   - name: management-server
+    {{- if ne .Values.releases.managementServer.namespace "" }}
+    namespace: {{ .Values.releases.managementServer.namespace }}
+    {{- end }}
+    createNamespace: true
     chart: ../management-server
     installed: {{ $deployManagementServer }}
+    needs:
+      - cert-manager/cert-manager
+      {{- if ne $pgNamespace "" }}
+      - {{ $pgNamespace }}/postgresql
+      {{- else }}
+      - postgresql
+      {{- end }}
     labels:
       component: management-server
     values:
       - ./values/management-server.yaml.gotmpl
+    hooks:
+      - events: ["presync"]
+        showlogs: true
+        command: sh
+        args:
+          - -c
+          - |
+            kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=300s
+            kubectl -n cert-manager wait pod -l app.kubernetes.io/component=webhook --for=condition=Ready --timeout=120s
diff --git a/charts/helmfile/values/common.yaml b/charts/helmfile/values/common.yaml
index d997a3a1..0efb7906 100644
--- a/charts/helmfile/values/common.yaml
+++ b/charts/helmfile/values/common.yaml
@@ -31,6 +31,13 @@ postgres:
     storageClass: ""
   imagePullSecret: ""
 
+# configuration for the management controller image
+managementServer:
+  image:
+    repository: quay.io/skupper/vms-management-controller
+    tag: latest
+    pullPolicy: Always
+
 # Release configuration:
 # certManager: installed into the cert-manager namespace (will be created if not exists)
 # postgresql: installed into the namespace specified in the namespace key (will be created if not exists). If namespace is empty, the release will be installed into the current namespace.
@@ -43,3 +50,4 @@ releases:
     namespace: ""
   managementServer:
     enabled: true
+    namespace: ""
diff --git a/charts/helmfile/values/management-server.yaml.gotmpl b/charts/helmfile/values/management-server.yaml.gotmpl
index 51c504e6..8a1af549 100644
--- a/charts/helmfile/values/management-server.yaml.gotmpl
+++ b/charts/helmfile/values/management-server.yaml.gotmpl
@@ -1,6 +1,12 @@
+{{- $ms := .Values.managementServer | default dict }}
+{{- $image := $ms.image | default dict }}
 postgres:
   host: {{ .Values.postgres.host | quote }}
   port: {{ .Values.postgres.port | quote }}
   database: {{ .Values.postgres.database | quote }}
   credentialsSecret:
     {{- toYaml .Values.postgres.credentialsSecret | nindent 4 }}
+image:
+  repository: {{ $image.repository | default "quay.io/skupper/vms-management-controller" | quote }}
+  tag: {{ $image.tag | default "latest" | quote }}
+  pullPolicy: {{ $image.pullPolicy | default "Always" | quote }}
diff --git a/charts/helmfile/values/postgres.yaml.gotmpl b/charts/helmfile/values/postgres.yaml.gotmpl
index 3423a825..c81689d3 100644
--- a/charts/helmfile/values/postgres.yaml.gotmpl
+++ b/charts/helmfile/values/postgres.yaml.gotmpl
@@ -12,6 +12,10 @@ auth:
   existingSecret: {{ $sec.name | quote }}
   secretKeys:
     adminPasswordKey: {{ $sec.adminPasswordKey | quote }}
+{{- if and (hasKey $pg "image") (hasKey $pg.image "pullPolicy") }}
+image:
+  pullPolicy: {{ $pg.image.pullPolicy | quote }}
+{{- end }}
 primary:
   initdb:
     scriptsConfigMap: db-init-configmap
diff --git a/tests/integration/kind/helmfile/values-kind.yaml b/tests/integration/kind/helmfile/values-kind.yaml
new file mode 100644
index 00000000..7dbf59ed
--- /dev/null
+++ b/tests/integration/kind/helmfile/values-kind.yaml
@@ -0,0 +1,19 @@
+# Kind integration overlay (helmfile -e kind). Local image, single namespace, no PV.
+postgres:
+  host: postgresql
+  persistence:
+    enabled: false
+  image:
+    pullPolicy: IfNotPresent
+
+releases:
+  postgresql:
+    namespace: vms-test
+  managementServer:
+    namespace: vms-test
+
+managementServer:
+  image:
+    repository: vms-management-controller
+    tag: kind
+    pullPolicy: Never