diff --git a/charts/stash-community/README.md b/charts/stash-community/README.md
index 7c533aaf..17fe615f 100644
--- a/charts/stash-community/README.md
+++ b/charts/stash-community/README.md
@@ -74,8 +74,8 @@ The following table lists the configurable parameters of the `stash-community` c
 | pushgateway.securityContext           | Security options the Prometheus pushgateway container should run with                                                                                                                                                                                                                                                                          | <code>{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}</code> |
 | pushgateway.customURL                 | If you want to use a custom Pushgatway, specify its URL. Stash will not inject pushgatway sidecar if you set this field.                                                                                                                                                                                                                       | <code>""</code>                                                                                                                                                                                |
 | cleaner.registry                      | Docker registry used to pull Webhook cleaner image                                                                                                                                                                                                                                                                                             | <code>appscode</code>                                                                                                                                                                          |
-| cleaner.repository                    | Webhook cleaner container image                                                                                                                                                                                                                                                                                                                | <code>kubectl</code>                                                                                                                                                                           |
-| cleaner.tag                           | Webhook cleaner container image tag                                                                                                                                                                                                                                                                                                            | <code>v1.22</code>                                                                                                                                                                             |
+| cleaner.repository                    | Webhook cleaner container image                                                                                                                                                                                                                                                                                                                | <code>kubectl-nonroot</code>                                                                                                                                                                   |
+| cleaner.tag                           | Webhook cleaner container image tag                                                                                                                                                                                                                                                                                                            | <code>"1.25"</code>                                                                                                                                                                            |
 | cleaner.skip                          | Skip generating cleaner YAML                                                                                                                                                                                                                                                                                                                   | <code>false</code>                                                                                                                                                                             |
 | cleaner.securityContext               | Security options the Prometheus pushgateway container should run with                                                                                                                                                                                                                                                                          | <code>{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}</code> |
 | cleaner.nodeSelector                  | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                 | <code>{"kubernetes.io/os":"linux"}</code>                                                                                                                                                      |
diff --git a/charts/stash-community/values.yaml b/charts/stash-community/values.yaml
index 5be35ca8..25e595c3 100644
--- a/charts/stash-community/values.yaml
+++ b/charts/stash-community/values.yaml
@@ -100,9 +100,9 @@ cleaner:
   # Docker registry used to pull Webhook cleaner image
   registry: appscode
   # Webhook cleaner container image
-  repository: kubectl
+  repository: kubectl-nonroot
   # Webhook cleaner container image tag
-  tag: v1.22
+  tag: "1.25"
   # Skip generating cleaner YAML
   skip: false
   # Security options the Prometheus pushgateway container should run with
diff --git a/charts/stash-enterprise/README.md b/charts/stash-enterprise/README.md
index 837d0d5e..00cc8078 100644
--- a/charts/stash-enterprise/README.md
+++ b/charts/stash-enterprise/README.md
@@ -74,8 +74,8 @@ The following table lists the configurable parameters of the `stash-enterprise`
 | pushgateway.securityContext           | Security options the Prometheus pushgateway container should run with                                                                                                                                                                                                                                                                                                      | <code>{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}</code> |
 | pushgateway.customURL                 | If you want to use a custom Pushgatway, specify its URL. Stash will not inject pushgatway sidecar if you set this field.                                                                                                                                                                                                                                                   | <code>""</code>                                                                                                                                                                                |
 | cleaner.registry                      | Docker registry used to pull Webhook cleaner image                                                                                                                                                                                                                                                                                                                         | <code>appscode</code>                                                                                                                                                                          |
-| cleaner.repository                    | Webhook cleaner container image                                                                                                                                                                                                                                                                                                                                            | <code>kubectl</code>                                                                                                                                                                           |
-| cleaner.tag                           | Webhook cleaner container image tag                                                                                                                                                                                                                                                                                                                                        | <code>v1.22</code>                                                                                                                                                                             |
+| cleaner.repository                    | Webhook cleaner container image                                                                                                                                                                                                                                                                                                                                            | <code>kubectl-nonroot</code>                                                                                                                                                                   |
+| cleaner.tag                           | Webhook cleaner container image tag                                                                                                                                                                                                                                                                                                                                        | <code>"1.25"</code>                                                                                                                                                                            |
 | cleaner.skip                          | Skip generating cleaner YAML                                                                                                                                                                                                                                                                                                                                               | <code>false</code>                                                                                                                                                                             |
 | cleaner.securityContext               | Security options the Prometheus pushgateway container should run with                                                                                                                                                                                                                                                                                                      | <code>{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}</code> |
 | cleaner.nodeSelector                  | Node labels for pod assignment                                                                                                                                                                                                                                                                                                                                             | <code>{"kubernetes.io/os":"linux"}</code>                                                                                                                                                      |
diff --git a/charts/stash-enterprise/values.yaml b/charts/stash-enterprise/values.yaml
index 18660072..063adadc 100644
--- a/charts/stash-enterprise/values.yaml
+++ b/charts/stash-enterprise/values.yaml
@@ -98,9 +98,9 @@ cleaner:
   # Docker registry used to pull Webhook cleaner image
   registry: appscode
   # Webhook cleaner container image
-  repository: kubectl
+  repository: kubectl-nonroot
   # Webhook cleaner container image tag
-  tag: v1.22
+  tag: "1.25"
   # Skip generating cleaner YAML
   skip: false
   # Security options the Prometheus pushgateway container should run with