diff --git a/.github/workflows/deploy-theia.yml b/.github/workflows/deploy-theia.yml
index 2a4db09..b868832 100644
--- a/.github/workflows/deploy-theia.yml
+++ b/.github/workflows/deploy-theia.yml
@@ -379,7 +379,9 @@ jobs:
             )
           fi
 
-          # Only override IDE images when a tag is explicitly provided
+          # Only override IDE images when a tag is explicitly provided.
+          # Indices 0 (landing) and 1-10 (IDE + no-ls + langserver preload) are set above / here.
+          # Index 11 is oauth2-proxy (distroless); keep it only in values.yaml so it is never replaced by a string override.
           if [ -n "${IDE_IMAGES_TAG}" ]; then
             HELM_CMD+=(
               --set "theia-cloud.preloading.images[1]=ghcr.io/eduide/eduide/java-17:${IDE_IMAGES_TAG}"
diff --git a/charts/theia-cloud-combined/values.yaml b/charts/theia-cloud-combined/values.yaml
index 1b77ae2..4b29b11 100644
--- a/charts/theia-cloud-combined/values.yaml
+++ b/charts/theia-cloud-combined/values.yaml
@@ -59,6 +59,7 @@ theia-cloud:
       name: service-admin-api-token
       key: ADMIN_API_TOKEN
 
+  # Preload indices 0–10 align with .github/workflows/deploy-theia.yml tag overrides; 11 = oauth2-proxy (not overridden there).
   preloading:
     images:
       - ghcr.io/eduide/eduidec-landing-page:latest
@@ -68,6 +69,12 @@ theia-cloud:
       - ghcr.io/eduide/eduide/ocaml:latest
       - ghcr.io/eduide/eduide/rust:latest
       - ghcr.io/eduide/eduide/python:latest
+      - ghcr.io/eduide/eduide/java-17-no-ls:latest
+      - ghcr.io/eduide/eduide/rust-no-ls:latest
+      - ghcr.io/eduide/eduide/langserver-java:latest
+      - ghcr.io/eduide/eduide/langserver-rust:latest
+      - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        args: ["--version"]
 
   imagePullPolicy: Always
 
diff --git a/deployments/test1.theia-test.artemis.cit.tum.de/values.yaml b/deployments/test1.theia-test.artemis.cit.tum.de/values.yaml
index d142c53..0eb42f9 100644
--- a/deployments/test1.theia-test.artemis.cit.tum.de/values.yaml
+++ b/deployments/test1.theia-test.artemis.cit.tum.de/values.yaml
@@ -55,6 +55,8 @@ theia-cloud:
   #     name: service-admin-api-token
   #     key: ADMIN_API_TOKEN
 
+  # Preload list indices 0–10 must match deploy-theia.yml --set overrides when tags are passed.
+  # Index 11 is oauth2-proxy (distroless); the workflow does not override it.
   preloading:
     images:
       - ghcr.io/eduide/eduidec-landing-page:latest
@@ -64,6 +66,12 @@ theia-cloud:
       - ghcr.io/eduide/eduide/ocaml:latest
       - ghcr.io/eduide/eduide/rust:latest
       - ghcr.io/eduide/eduide/python:latest
+      - ghcr.io/eduide/eduide/java-17-no-ls:latest
+      - ghcr.io/eduide/eduide/rust-no-ls:latest
+      - ghcr.io/eduide/eduide/langserver-java:latest
+      - ghcr.io/eduide/eduide/langserver-rust:latest
+      - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        args: ["--version"]
 
   imagePullPolicy: Always
 
diff --git a/deployments/test2.theia-test.artemis.cit.tum.de/values.yaml b/deployments/test2.theia-test.artemis.cit.tum.de/values.yaml
index 6bf8d02..1e9218a 100644
--- a/deployments/test2.theia-test.artemis.cit.tum.de/values.yaml
+++ b/deployments/test2.theia-test.artemis.cit.tum.de/values.yaml
@@ -55,6 +55,8 @@ theia-cloud:
   #     name: service-admin-api-token
   #     key: ADMIN_API_TOKEN
 
+  # Preload list indices 0–10 must match deploy-theia.yml --set overrides when tags are passed.
+  # Index 11 is oauth2-proxy (distroless); the workflow does not override it.
   preloading:
     images:
       - ghcr.io/eduide/eduidec-landing-page:latest
@@ -64,6 +66,12 @@ theia-cloud:
       - ghcr.io/eduide/eduide/ocaml:latest
       - ghcr.io/eduide/eduide/rust:latest
       - ghcr.io/eduide/eduide/python:latest
+      - ghcr.io/eduide/eduide/java-17-no-ls:latest
+      - ghcr.io/eduide/eduide/rust-no-ls:latest
+      - ghcr.io/eduide/eduide/langserver-java:latest
+      - ghcr.io/eduide/eduide/langserver-rust:latest
+      - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        args: ["--version"]
 
   imagePullPolicy: Always
 
diff --git a/deployments/test3.theia-test.artemis.cit.tum.de/values.yaml b/deployments/test3.theia-test.artemis.cit.tum.de/values.yaml
index 21156f4..812f9ed 100644
--- a/deployments/test3.theia-test.artemis.cit.tum.de/values.yaml
+++ b/deployments/test3.theia-test.artemis.cit.tum.de/values.yaml
@@ -61,6 +61,8 @@ theia-cloud:
       name: service-admin-api-token
       key: ADMIN_API_TOKEN
 
+  # Preload list indices 0–10 must match deploy-theia.yml --set overrides when tags are passed.
+  # Index 11 is oauth2-proxy (distroless); the workflow does not override it.
   preloading:
     images:
       - ghcr.io/eduide/eduide-cloud/landing-page:pr-70
@@ -74,6 +76,8 @@ theia-cloud:
       - ghcr.io/eduide/eduide/rust-no-ls:pr-70
       - ghcr.io/eduide/eduide/langserver-java:pr-70
       - ghcr.io/eduide/eduide/langserver-rust:pr-70
+      - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        args: ["--version"]
 
   imagePullPolicy: Always
 
diff --git a/deployments/theia-staging.artemis.cit.tum.de/values.yaml b/deployments/theia-staging.artemis.cit.tum.de/values.yaml
index 5be9f02..c5f61ce 100644
--- a/deployments/theia-staging.artemis.cit.tum.de/values.yaml
+++ b/deployments/theia-staging.artemis.cit.tum.de/values.yaml
@@ -54,6 +54,8 @@ theia-cloud:
   #     name: service-admin-api-token
   #     key: ADMIN_API_TOKEN
 
+  # Preload list indices 0–10 must match deploy-theia.yml --set overrides when tags are passed.
+  # Index 11 is oauth2-proxy (distroless); the workflow does not override it.
   preloading:
     images:
       - ghcr.io/eduide/eduidec-landing-page:latest
@@ -63,6 +65,12 @@ theia-cloud:
       - ghcr.io/eduide/eduide/ocaml:latest
       - ghcr.io/eduide/eduide/rust:latest
       - ghcr.io/eduide/eduide/python:latest
+      - ghcr.io/eduide/eduide/java-17-no-ls:latest
+      - ghcr.io/eduide/eduide/rust-no-ls:latest
+      - ghcr.io/eduide/eduide/langserver-java:latest
+      - ghcr.io/eduide/eduide/langserver-rust:latest
+      - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        args: ["--version"]
 
   imagePullPolicy: Always
 
diff --git a/deployments/theia.artemis.cit.tum.de/values.yaml b/deployments/theia.artemis.cit.tum.de/values.yaml
index 0b90d9d..d3f8fa5 100644
--- a/deployments/theia.artemis.cit.tum.de/values.yaml
+++ b/deployments/theia.artemis.cit.tum.de/values.yaml
@@ -54,6 +54,8 @@ theia-cloud:
   #     name: service-admin-api-token
   #     key: ADMIN_API_TOKEN
 
+  # Preload list indices 0–10 must match deploy-theia.yml --set overrides when tags are passed.
+  # Index 11 is oauth2-proxy (distroless); the workflow does not override it.
   preloading:
     images:
       - ghcr.io/eduide/eduidec-landing-page:latest
@@ -63,6 +65,12 @@ theia-cloud:
       - ghcr.io/eduide/eduide/ocaml:latest
       - ghcr.io/eduide/eduide/rust:latest
       - ghcr.io/eduide/eduide/python:latest
+      - ghcr.io/eduide/eduide/java-17-no-ls:latest
+      - ghcr.io/eduide/eduide/rust-no-ls:latest
+      - ghcr.io/eduide/eduide/langserver-java:latest
+      - ghcr.io/eduide/eduide/langserver-rust:latest
+      - image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        args: ["--version"]
 
   imagePullPolicy: Always