daimoniac · daimoniac · Jul 29, 2026
diff --git a/charts/suppline/README.md b/charts/suppline/README.md
@@ -78,7 +78,7 @@ registry:
   enabled: true
 ```
 
-Do **not** treat the bundled `registry:2` as a long-term production registry. Details: [docs/REGISTRY.md](../../docs/REGISTRY.md).
+Do **not** treat the bundled `registry:3` as a long-term production registry. Details: [docs/REGISTRY.md](../../docs/REGISTRY.md).
 
 ## Uninstall
 

diff --git a/charts/suppline/values-secrets.yaml.example b/charts/suppline/values-secrets.yaml.example
@@ -24,6 +24,6 @@ backend:
     SUPPLINE_REGISTRY_USERNAME: "suppline"
     SUPPLINE_REGISTRY_PASSWORD: "your-registry-password"
 
-# Optional: enable the chart’s bundled registry:2 for labs only
+# Optional: enable the chart’s bundled registry:3 for labs only
 # registry:
 #   enabled: true
diff --git a/charts/suppline/values.yaml b/charts/suppline/values.yaml
@@ -252,39 +252,39 @@
 # Prefer bring-your-own Harbor/ECR/ACR/Artifactory: set registry.enabled=false (default)
 # and provide SUPPLINE_REGISTRY_* (+ upstream creds) via values-secrets.yaml.
 # Those env vars are available in suppline.yml via {{ env "…" }}.
-# The bundled registry:2 is for labs / bootstrap only — do not treat it as a long-term prod registry.
+# The bundled registry:3 is for labs / bootstrap only — do not treat it as a long-term prod registry.
 registry:
   enabled: false
 
   # Image configuration
   image:
     repository: registry
-    tag: 2.8.3
+    tag: 3.1.1
     pullPolicy: IfNotPresent
 
   # Service configuration
  service:
    type: ClusterIP
    port: 5000

  # Persistence for registry data
  persistence:
    enabled: true
    accessMode: ReadWriteOnce
    size: 10Gi
    storageClass: ""

  # Registry credentials
  # If not provided, username defaults to "suppline" and password is auto-generated
  # credentials:
  #   username: ""  # Leave empty for default "suppline"
  #   password: ""  # Leave empty for auto-generated password

  # Registry secrets
  # htpasswd will be automatically generated from credentials
  # secrets:
  #   haSharedSecret: ""  # Optional: shared secret for registry security

  # Resources
  resources:
    requests:
@@ -293,7 +293,7 @@
    limits:
      memory: "512Mi"
      cpu: "500m"

  # Security context
  securityContext:
    enabled: true

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -3,7 +3,7 @@
 # Docs: docs/EVAL.md
 services:
   registry:
-    image: registry:2.8.3
+    image: registry:3.1.1
     container_name: suppline-registry
     environment:
       - REGISTRY_STORAGE_DELETE_ENABLED=true

diff --git a/docs/EVAL.md b/docs/EVAL.md
@@ -52,7 +52,7 @@ curl -s -H "Authorization: Bearer demo" http://localhost:8080/api/v1/scans | hea
 
 | Piece | Behavior |
 |-------|----------|
-| Registry | Bundled `registry:2` over HTTP — **not** for production |
+| Registry | Bundled `registry:3` over HTTP — **not** for production |
 | Sources | `public.ecr.aws` (no auth). Docker Hub is optional via `.env` |
 | Signing | Cosign keypair auto-generated into `./keys/demo` on first start (does not touch existing `./keys/cosign.*`) |
 | `demo-pass` / `demo-fail` | Intentional CEL `true` / `false` so pass+fail always show for the gate |

diff --git a/docs/REGISTRY.md b/docs/REGISTRY.md
@@ -1,6 +1,6 @@
 # Private Docker Registry (Helm)
 
-The Helm chart can optionally deploy a self-contained `registry:2` for lab/bootstrap use.
+The Helm chart can optionally deploy a self-contained `registry:3` for lab/bootstrap use.
 
 **Defaults**
 

diff --git a/test/integration/README.md b/test/integration/README.md
@@ -103,7 +103,7 @@ The integration tests cover:
 ### Test Registry
 - **Port**: 5000
 - **Purpose**: Local Docker registry for testing image operations and attestations
-- **Image**: registry:2
+- **Image**: registry:3.1.1
 - **Startup time**: ~5 seconds
 - **Usage**: Tests automatically push images to `localhost:5000/test/*` for attestation testing