diff --git a/FRICTION.md b/FRICTION.md
index f9679de..b2a3858 100644
--- a/FRICTION.md
+++ b/FRICTION.md
@@ -116,5 +116,8 @@
 1.  if you don't have configurations set up, the whole thing is stuck and the text reporting the error is very faint and hard to read.
 2.  it's not clear why I need a kots yaml file for an EC install
 3.  preflights on a fresh VM fail fast.  It seems there's easily scripted fixes we could provide to streamline the onboarding
+4.  Host preflights run during in-place upgrades and fail on ports already in use by the running cluster (e.g. etcd on 2379/TCP). These checks should be skipped for upgrades since the cluster is already installed — flagging in-use ports as blockers on an existing node is incorrect behavior and blocks the upgrade flow in the web UI.
+5.  In-place upgrade via the web UI fails because EC3 attempts to reinstall k0s rather than upgrade the existing cluster. The UI shows "installation" state during what should be an upgrade flow, then errors on k0s already being present. Upgrade appears to not be supported or is broken in this EC3 alpha version.
+6.  **`ReplicatedImageRegistry` docs don't distinguish behavior by image origin** — The docs show using `ReplicatedImageRegistry (HelmValue ".replicated.image.registry")` to handle the replicated SDK image for airgap. This implies the function works uniformly for all images regardless of origin. In practice, calling `ReplicatedImageRegistry` on `proxy.replicated.com` (the SDK's native registry) in beta.1 does not work: without `noProxy=true` it produces a doubled proxy URL (`proxy.replicated.com/proxy/gameshelf/proxy.replicated.com/...`); with `noProxy=true` it returns an empty string for online installs, causing the image to resolve to `docker.io/library/replicated-sdk-image` (wrong). The SDK chart already uses `proxy.replicated.com` natively and works without any `helmchart.yaml` override — EC3 handles routing for it automatically. The docs don't make clear that the replicated SDK image is a special case that should be left alone. Resolution: removed the `replicated.image.registry` override entirely. ~3 hours of debugging across multiple PRs.
 
 
diff --git a/chart/gameshelf/values.yaml b/chart/gameshelf/values.yaml
index 089bbae..0d30d51 100644
--- a/chart/gameshelf/values.yaml
+++ b/chart/gameshelf/values.yaml
@@ -68,9 +68,6 @@ postgresql:
   enabled: true
   image:
     registry: proxy.replicated.com/proxy/gameshelf/index.docker.io
-  volumePermissions:
-    image:
-      registry: proxy.replicated.com/proxy/gameshelf/index.docker.io
   auth:
     database: gameshelf
     username: gameshelf
diff --git a/helmchart.yaml b/helmchart.yaml
index 4a6eab3..17335dd 100644
--- a/helmchart.yaml
+++ b/helmchart.yaml
@@ -17,16 +17,19 @@ spec:
       registry: 'repl{{ ReplicatedImageRegistry "ghcr.io" }}'
       repository: 'aa-replicated/gameshelf'
       pullPolicy: IfNotPresent
+    replicated:
+      image:
+        registry: 'repl{{- if HasLocalRegistry }}{{ LocalRegistryHost }}{{- else }}proxy.replicated.com{{- end }}'
     postgresql:
       image:
         registry: 'repl{{ ReplicatedImageRegistry "index.docker.io" }}'
-      volumePermissions:
-        image:
-          registry: 'repl{{ ReplicatedImageRegistry "index.docker.io" }}'
     redis:
       image:
         registry: 'repl{{ ReplicatedImageRegistry "index.docker.io" }}'
   builder:
+    image:
+      registry: "ghcr.io"
+      repository: "aa-replicated/gameshelf"
     postgresql:
       image:
         registry: "docker.io"