diff --git a/.github/workflows/update-helm-repo.yaml b/.github/workflows/update-helm-repo.yaml
index 8382c1f231..883f675808 100644
--- a/.github/workflows/update-helm-repo.yaml
+++ b/.github/workflows/update-helm-repo.yaml
@@ -79,15 +79,15 @@ jobs:
 
             if [ $(git tag -l "${name}-${version}") ]; then
               echo "Tag ${tagname} already exists, skipping release"
-              echo "::set-output name=changed::false"
+              echo "changed=false" >> $GITHUB_OUTPUT
             else
               echo "Releasing ${changed}"
-              echo "::set-output name=changed::true"
-              echo "::set-output name=chartpath::${changed}"
+              echo "changed=true" >> $GITHUB_OUTPUT
+              echo "chartpath=${changed}" >> $GITHUB_OUTPUT
             fi
           else
             echo "No charts have changed, skipping release"
-            echo "::set-output name=changed::false"
+            echo "changed=false" >> $GITHUB_OUTPUT
           fi
 
   release:
@@ -166,14 +166,14 @@ jobs:
           description=$(yq ".description" < ${changed}/Chart.yaml)
           name=$(yq ".name" < ${changed}/Chart.yaml)
           version=$(yq ".version" < ${changed}/Chart.yaml)
-          echo "::set-output name=chartpath::${changed}"
-          echo "::set-output name=desc::${description}"
+          echo "chartpath=${changed}" >> $GITHUB_OUTPUT
+          echo "desc=${description}" >> $GITHUB_OUTPUT
           if [[ -n "${HELM_TAG_PREFIX}" ]]; then
-            echo "::set-output name=tagname::${HELM_TAG_PREFIX}-${name}-${version}"
+            echo "tagname=${HELM_TAG_PREFIX}-${name}-${version}" >> $GITHUB_OUTPUT
           else
-            echo "::set-output name=tagname::${name}-${version}"
+            echo "tagname=${name}-${version}" >> $GITHUB_OUTPUT
           fi
-          echo "::set-output name=packagename::${name}-${version}"
+          echo "packagename=${name}-${version}" >> $GITHUB_OUTPUT
 
       - name: Install CR tool
         run: |
diff --git a/charts/tempo-distributed/Chart.yaml b/charts/tempo-distributed/Chart.yaml
index 41429d7631..92117a4c59 100644
--- a/charts/tempo-distributed/Chart.yaml
+++ b/charts/tempo-distributed/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: tempo-distributed
 description: Grafana Tempo in MicroService mode
 type: application
-version: 1.9.2
+version: 1.9.6
 appVersion: 2.4.1
 engine: gotpl
 home: https://grafana.com/docs/tempo/latest/
diff --git a/charts/tempo-distributed/README.md b/charts/tempo-distributed/README.md
index babba59334..395f3f5d8c 100644
--- a/charts/tempo-distributed/README.md
+++ b/charts/tempo-distributed/README.md
@@ -1,6 +1,6 @@
 # tempo-distributed
 
-![Version: 1.9.2](https://img.shields.io/badge/Version-1.9.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.4.1](https://img.shields.io/badge/AppVersion-2.4.1-informational?style=flat-square)
+![Version: 1.9.6](https://img.shields.io/badge/Version-1.9.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.4.1](https://img.shields.io/badge/AppVersion-2.4.1-informational?style=flat-square)
 
 Grafana Tempo in MicroService mode
 
@@ -223,6 +223,10 @@ The memcached default args are removed and should be provided manually. The sett
 | adminApi.extraVolumeMounts | list | `[]` |  |
 | adminApi.extraVolumes | list | `[]` |  |
 | adminApi.hostAliases | list | `[]` | hostAliases to add |
+| adminApi.image.pullSecrets | list | `[]` | Optional list of imagePullSecrets. Overrides `tempo.image.pullSecrets` |
+| adminApi.image.registry | string | `nil` | The Docker registry for the adminApi image. Overrides `tempo.image.registry` |
+| adminApi.image.repository | string | `nil` | Docker image repository for the adminApi image. Overrides `tempo.image.repository` |
+| adminApi.image.tag | string | `nil` | Docker image tag for the adminApi image. Overrides `tempo.image.tag` |
 | adminApi.initContainers | list | `[]` |  |
 | adminApi.nodeSelector | object | `{}` |  |
 | adminApi.persistence.subPath | string | `nil` |  |
@@ -369,6 +373,10 @@ The memcached default args are removed and should be provided manually. The sett
 | enterpriseGateway.extraVolumeMounts | list | `[]` |  |
 | enterpriseGateway.extraVolumes | list | `[]` |  |
 | enterpriseGateway.hostAliases | list | `[]` | hostAliases to add |
+| enterpriseGateway.image.pullSecrets | list | `[]` | Optional list of imagePullSecrets. Overrides `tempo.image.pullSecrets` |
+| enterpriseGateway.image.registry | string | `nil` | The Docker registry for the enterpriseGateway image. Overrides `tempo.image.registry` |
+| enterpriseGateway.image.repository | string | `nil` | Docker image repository for the enterpriseGateway image. Overrides `tempo.image.repository` |
+| enterpriseGateway.image.tag | string | `nil` | Docker image tag for the enterpriseGateway image. Overrides `tempo.image.tag` |
 | enterpriseGateway.ingress.annotations | object | `{}` | Annotations for the gateway ingress |
 | enterpriseGateway.ingress.enabled | bool | `false` | Specifies whether an ingress for the gateway should be created |
 | enterpriseGateway.ingress.hosts | list | `[{"host":"gateway.gem.example.com","paths":[{"path":"/"}]}]` | Hosts configuration for the gateway ingress |
@@ -494,6 +502,7 @@ The memcached default args are removed and should be provided manually. The sett
 | ingester.image.registry | string | `nil` | The Docker registry for the ingester image. Overrides `tempo.image.registry` |
 | ingester.image.repository | string | `nil` | Docker image repository for the ingester image. Overrides `tempo.image.repository` |
 | ingester.image.tag | string | `nil` | Docker image tag for the ingester image. Overrides `tempo.image.tag` |
+| ingester.initContainers | list | `[]` |  |
 | ingester.nodeSelector | object | `{}` | Node selector for ingester pods |
 | ingester.persistence.annotations | object | `{}` | Annotations for ingester's persist volume claim |
 | ingester.persistence.enabled | bool | `false` | Enable creating PVCs which is required when using boltdb-shipper |
@@ -591,6 +600,7 @@ The memcached default args are removed and should be provided manually. The sett
 | metricsGenerator.image.registry | string | `nil` | The Docker registry for the metrics-generator image. Overrides `tempo.image.registry` |
 | metricsGenerator.image.repository | string | `nil` | Docker image repository for the metrics-generator image. Overrides `tempo.image.repository` |
 | metricsGenerator.image.tag | string | `nil` | Docker image tag for the metrics-generator image. Overrides `tempo.image.tag` |
+| metricsGenerator.initContainers | list | `[]` |  |
 | metricsGenerator.kind | string | `"Deployment"` | Kind of deployment [StatefulSet/Deployment] |
 | metricsGenerator.nodeSelector | object | `{}` | Node selector for metrics-generator pods |
 | metricsGenerator.persistence | object | `{"annotations":{},"enabled":false,"size":"10Gi","storageClass":null}` | Persistence configuration for metrics-generator |
@@ -775,6 +785,10 @@ The memcached default args are removed and should be provided manually. The sett
 | tokengenJob.extraArgs | object | `{}` |  |
 | tokengenJob.extraEnvFrom | list | `[]` |  |
 | tokengenJob.hostAliases | list | `[]` | hostAliases to add |
+| tokengenJob.image.pullSecrets | list | `[]` | Optional list of imagePullSecrets. Overrides `tempo.image.pullSecrets` |
+| tokengenJob.image.registry | string | `nil` | The Docker registry for the tokengenJob image. Overrides `tempo.image.registry` |
+| tokengenJob.image.repository | string | `nil` | Docker image repository for the tokengenJob image. Overrides `tempo.image.repository` |
+| tokengenJob.image.tag | string | `nil` | Docker image tag for the tokengenJob image. Overrides `tempo.image.tag` |
 | tokengenJob.initContainers | list | `[]` |  |
 | traces.jaeger.grpc.enabled | bool | `false` | Enable Tempo to ingest Jaeger GRPC traces |
 | traces.jaeger.grpc.receiverConfig | object | `{}` | Jaeger GRPC receiver config |
diff --git a/charts/tempo-distributed/templates/admin-api/_helpers.tpl b/charts/tempo-distributed/templates/admin-api/_helpers.tpl
new file mode 100644
index 0000000000..3b72a6633d
--- /dev/null
+++ b/charts/tempo-distributed/templates/admin-api/_helpers.tpl
@@ -0,0 +1,7 @@
+{{/*
+adminApi imagePullSecrets
+*/}}
+{{- define "tempo.adminApiImagePullSecrets" -}}
+{{- $dict := dict "tempo" .Values.tempo.image "component" .Values.adminApi.image "global" .Values.global.image -}}
+{{- include "tempo.imagePullSecrets" $dict -}}
+{{- end }}
diff --git a/charts/tempo-distributed/templates/admin-api/admin-api-dep.yaml b/charts/tempo-distributed/templates/admin-api/admin-api-dep.yaml
index 469417a506..ae0d733c33 100644
--- a/charts/tempo-distributed/templates/admin-api/admin-api-dep.yaml
+++ b/charts/tempo-distributed/templates/admin-api/admin-api-dep.yaml
@@ -37,12 +37,7 @@ spec:
         {{- with .Values.adminApi.initContainers }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-      {{- if .Values.tempo.image.pullSecrets }}
-      imagePullSecrets:
-      {{- range .Values.image.pullSecrets }}
-        - name: {{ . }}
-      {{- end }}
-      {{- end }}
+      {{- include "tempo.adminApiImagePullSecrets" . | nindent 6 -}}
       {{- with .Values.adminApi.hostAliases }}
       hostAliases:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/tempo-distributed/templates/enterprise-gateway/_helpers.tpl b/charts/tempo-distributed/templates/enterprise-gateway/_helpers.tpl
index 2b25560845..cb030eee62 100644
--- a/charts/tempo-distributed/templates/enterprise-gateway/_helpers.tpl
+++ b/charts/tempo-distributed/templates/enterprise-gateway/_helpers.tpl
@@ -31,3 +31,11 @@ Return if ingress supports pathType.
 {{- define "tempo.ingress.supportsPathType" -}}
   {{- or (eq (include "tempo.ingress.isStable" .) "true") (and (eq (include "tempo.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
 {{- end -}}
+
+{{/*
+enterpriseGateway imagePullSecrets
+*/}}
+{{- define "tempo.enterpriseGatewayImagePullSecrets" -}}
+{{- $dict := dict "tempo" .Values.tempo.image "component" .Values.enterpriseGateway.image "global" .Values.global.image -}}
+{{- include "tempo.imagePullSecrets" $dict -}}
+{{- end }}
diff --git a/charts/tempo-distributed/templates/enterprise-gateway/gateway-dep.yaml b/charts/tempo-distributed/templates/enterprise-gateway/gateway-dep.yaml
index 011322ddfc..0da57a1548 100644
--- a/charts/tempo-distributed/templates/enterprise-gateway/gateway-dep.yaml
+++ b/charts/tempo-distributed/templates/enterprise-gateway/gateway-dep.yaml
@@ -35,12 +35,7 @@ spec:
         {{- toYaml .Values.enterpriseGateway.securityContext | nindent 8 }}
       initContainers:
         {{- toYaml .Values.enterpriseGateway.initContainers | nindent 8 }}
-      {{- if .Values.tempo.image.pullSecrets }}
-      imagePullSecrets:
-      {{- range .Values.image.pullSecrets }}
-        - name: {{ . }}
-      {{- end }}
-      {{- end }}
+      {{- include "tempo.enterpriseGatewayImagePullSecrets" . | nindent 6 -}}
       {{- with .Values.enterpriseGateway.hostAliases }}
       hostAliases:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/tempo-distributed/templates/ingester/statefulset-ingester.yaml b/charts/tempo-distributed/templates/ingester/statefulset-ingester.yaml
index 79abf99e9c..de84ca588b 100644
--- a/charts/tempo-distributed/templates/ingester/statefulset-ingester.yaml
+++ b/charts/tempo-distributed/templates/ingester/statefulset-ingester.yaml
@@ -55,6 +55,8 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      initContainers:
+        {{- toYaml .Values.ingester.initContainers | nindent 8 }}
       containers:
         - args:
             - -target=ingester
diff --git a/charts/tempo-distributed/templates/lib/service-monitor.tpl b/charts/tempo-distributed/templates/lib/service-monitor.tpl
index a068dff4a4..896110f61b 100644
--- a/charts/tempo-distributed/templates/lib/service-monitor.tpl
+++ b/charts/tempo-distributed/templates/lib/service-monitor.tpl
@@ -47,7 +47,8 @@ spec:
       scrapeTimeout: {{ . }}
       {{- end }}
       relabelings:
-        - sourceLabels: [job]
+        - action: replace
+          sourceLabels: [job]
           replacement: "{{ $.ctx.Release.Namespace }}/{{ $.component }}"
           targetLabel: job
         {{- if kindIs "string" .clusterLabel }}
diff --git a/charts/tempo-distributed/templates/metrics-generator/statefulset-metrics-generator.yaml b/charts/tempo-distributed/templates/metrics-generator/statefulset-metrics-generator.yaml
index 286e68c37e..02e330eda6 100644
--- a/charts/tempo-distributed/templates/metrics-generator/statefulset-metrics-generator.yaml
+++ b/charts/tempo-distributed/templates/metrics-generator/statefulset-metrics-generator.yaml
@@ -55,6 +55,8 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      initContainers:
+        {{- toYaml .Values.metricsGenerator.initContainers | nindent 8 }}
       containers:
         - args:
             - -target=metrics-generator
diff --git a/charts/tempo-distributed/templates/tokengen/__helpers.tpl b/charts/tempo-distributed/templates/tokengen/__helpers.tpl
new file mode 100644
index 0000000000..f23d971c38
--- /dev/null
+++ b/charts/tempo-distributed/templates/tokengen/__helpers.tpl
@@ -0,0 +1,7 @@
+{{/*
+tokengen-job imagePullSecrets
+*/}}
+{{- define "tempo.tokengenJobImagePullSecrets" -}}
+{{- $dict := dict "tempo" .Values.tempo.image "component" .Values.tokengenJob.image "global" .Values.global.image -}}
+{{- include "tempo.imagePullSecrets" $dict -}}
+{{- end }}
diff --git a/charts/tempo-distributed/templates/tokengen/tokengen-job.yaml b/charts/tempo-distributed/templates/tokengen/tokengen-job.yaml
index b73c699031..8e727e9d57 100644
--- a/charts/tempo-distributed/templates/tokengen/tokengen-job.yaml
+++ b/charts/tempo-distributed/templates/tokengen/tokengen-job.yaml
@@ -18,6 +18,8 @@ spec:
   completions: 1
   parallelism: 1
   selector:
+    matchLabels:
+      {{- include "tempo.selectorLabels" $dict | nindent 6 }}
   template:
     metadata:
       labels:
@@ -33,12 +35,7 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.tokengenJob.securityContext | nindent 8 }}
-      {{- if .Values.tempo.image.pullSecrets }}
-      imagePullSecrets:
-      {{- range .Values.tempo.image.pullSecrets }}
-        - name: {{ . }}
-      {{- end }}
-      {{- end }}
+      {{- include "tempo.tokengenJobImagePullSecrets" . | nindent 6 -}}
       {{- with .Values.tokengenJob.hostAliases }}
       hostAliases:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/tempo-distributed/values.yaml b/charts/tempo-distributed/values.yaml
index 2720dc418b..f3126609c2 100644
--- a/charts/tempo-distributed/values.yaml
+++ b/charts/tempo-distributed/values.yaml
@@ -112,6 +112,7 @@ ingester:
   #  - ip: 1.2.3.4
   #    hostnames:
   #      - domain.tld
+  initContainers: []
   autoscaling:
     # -- Enable autoscaling for the ingester. WARNING: Autoscaling ingesters can result in lost data. Only do this if you know what you're doing.
     enabled: false
@@ -239,6 +240,7 @@ metricsGenerator:
   #  - ip: 1.2.3.4
   #    hostnames:
   #      - domain.tld
+  initContainers: []
   image:
     # -- The Docker registry for the metrics-generator image. Overrides `tempo.image.registry`
     registry: null
@@ -1900,6 +1902,15 @@ tokengenJob:
   env: []
   extraEnvFrom: []
   annotations: {}
+  image:
+    # -- The Docker registry for the tokengenJob image. Overrides `tempo.image.registry`
+    registry: null
+    # -- Optional list of imagePullSecrets. Overrides `tempo.image.pullSecrets`
+    pullSecrets: []
+    # -- Docker image repository for the tokengenJob image. Overrides `tempo.image.repository`
+    repository: null
+    # -- Docker image tag for the tokengenJob image. Overrides `tempo.image.tag`
+    tag: null
   initContainers: []
   # -- The SecurityContext for tokenjobgen containers
   containerSecurityContext:
@@ -1920,6 +1931,16 @@ adminApi:
     annotations: {}
     labels: {}
 
+  image:
+    # -- The Docker registry for the adminApi image. Overrides `tempo.image.registry`
+    registry: null
+    # -- Optional list of imagePullSecrets. Overrides `tempo.image.pullSecrets`
+    pullSecrets: []
+    # -- Docker image repository for the adminApi image. Overrides `tempo.image.repository`
+    repository: null
+    # -- Docker image tag for the adminApi image. Overrides `tempo.image.tag`
+    tag: null
+
   initContainers: []
 
   strategy:
@@ -2007,6 +2028,16 @@ enterpriseGateway:
   #    hostnames:
   #      - domain.tld
 
+  image:
+    # -- The Docker registry for the enterpriseGateway image. Overrides `tempo.image.registry`
+    registry: null
+    # -- Optional list of imagePullSecrets. Overrides `tempo.image.pullSecrets`
+    pullSecrets: []
+    # -- Docker image repository for the enterpriseGateway image. Overrides `tempo.image.repository`
+    repository: null
+    # -- Docker image tag for the enterpriseGateway image. Overrides `tempo.image.tag`
+    tag: null
+
   annotations: {}
   service:
     # -- Port of the enterprise gateway service; if left undefined, the service will listen on the same port as the pod