--- charts-original/templates/namespace-post-upgrade.yaml
+++ charts/templates/namespace-post-upgrade.yaml
@@ -36,7 +36,7 @@
       serviceAccount: gatekeeper-update-namespace-label-post-upgrade
       containers:
         - name: kubectl-label
-          image: "{{ .Values.postUpgrade.labelNamespace.image.repository }}:{{ .Values.postUpgrade.labelNamespace.image.tag }}"
+          image: '{{ template "system_default_registry" . }}{{ .Values.postUpgrade.labelNamespace.image.repository }}:{{ .Values.postUpgrade.labelNamespace.image.tag }}'
           imagePullPolicy: {{ .Values.postUpgrade.labelNamespace.image.pullPolicy }}
           args:
             - label
@@ -77,12 +77,10 @@
             {{- toYaml .Values.postUpgrade.securityContext | nindent 12 }}
         {{- end }}
       {{- with .Values.postUpgrade }}
+      nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
+      tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
       affinity:
         {{- toYaml .affinity | nindent 8 }}
-      tolerations:
-        {{- toYaml .tolerations | nindent 8 }}
-      nodeSelector:
-        {{- toYaml .nodeSelector | nindent 8 }}
       {{- end }}
 ---
 apiVersion: v1
@@ -123,6 +121,12 @@
       {{- range .Values.postUpgrade.labelNamespace.extraNamespaces }}
       - {{ . }}
       {{- end }}
+  - apiGroups:
+      - management.cattle.io
+    resources:
+      - projects
+    verbs:
+      - updatepsa
 {{- end }}
 ---
 {{- if .Values.rbac.create }}