diff --git a/charts/retool/Chart.yaml b/charts/retool/Chart.yaml
index 79a41372..0b5c82da 100644
--- a/charts/retool/Chart.yaml
+++ b/charts/retool/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: retool
 description: A Helm chart for Kubernetes
 type: application
-version: 6.11.19
+version: 6.11.20
 maintainers:
   - name: Retool Engineering
     email: engineering+helm@retool.com
diff --git a/charts/retool/ci/test-code-executor-image-override-option.yaml b/charts/retool/ci/test-code-executor-image-override-option.yaml
new file mode 100644
index 00000000..95d74f77
--- /dev/null
+++ b/charts/retool/ci/test-code-executor-image-override-option.yaml
@@ -0,0 +1,17 @@
+# Code executor image WITH an override: both fields must be used verbatim and
+# must not inherit from the top-level image.*. Overlaid onto each base
+# *values.yaml by .github/kubeconform.sh.
+#
+# The repository and tag below are deliberately unlike the top-level image.*, so
+# a regression that inherits the backend values, or that falls back to the
+# chart's built-in default tag, changes the rendered image and fails the test.
+# The tag must stay above the chart's code-executor and workflows version gates
+# (>= 3.20.15 and >= 3.6.11), or the deployment is not rendered at all and the
+# test silently asserts nothing.
+image:
+  tag: 9.9.9-test
+
+codeExecutor:
+  image:
+    repository: example/code-executor-service
+    tag: 8.8.8-test-override
diff --git a/charts/retool/templates/_helpers.tpl b/charts/retool/templates/_helpers.tpl
index 329fbd90..ef831ed0 100644
--- a/charts/retool/templates/_helpers.tpl
+++ b/charts/retool/templates/_helpers.tpl
@@ -1195,7 +1195,9 @@ Set code executor image tag
 Usage: (template "retool.codeExecutor.image.tag" .)
 */}}
 {{- define "retool.codeExecutor.image.tag" -}}
-{{- if .Values.image.tag -}}
+{{- if .Values.codeExecutor.image.tag -}}
+  {{- .Values.codeExecutor.image.tag -}}
+{{- else if .Values.image.tag -}}
   {{- $valid_retool_version_regexp := "([0-9]+\\.[0-9]+(\\.[0-9]+)?(-[a-zA-Z0-9]+)?)" }}
   {{- $semver_version_regexp := "[0-9]+\\.[0-9]+(\\.[0-9]+)?" }}
   {{- $retool_version_with_ce := ( and ( regexMatch $valid_retool_version_regexp $.Values.image.tag ) ( semverCompare ">= 3.20.15-0" ( regexFind $semver_version_regexp $.Values.image.tag ) ) ) }}
@@ -1205,7 +1207,7 @@ Usage: (template "retool.codeExecutor.image.tag" .)
     {{- "1.1.0" -}}
   {{- end -}}
 {{- else -}}
-  {{- fail "Please set a value for .Values.image.tag" }}
+  {{- fail "Please set a value for .Values.image.tag or .Values.codeExecutor.image.tag" }}
 {{- end -}}
 {{- end -}}
 
diff --git a/charts/retool/values.yaml b/charts/retool/values.yaml
index ec110348..46aa9b14 100644
--- a/charts/retool/values.yaml
+++ b/charts/retool/values.yaml
@@ -781,12 +781,16 @@ mcp:
     labels: {}
 
 codeExecutor:
-  # as of Chart version 6.7.0, code-executor image version must align with the top-level `image` parameters
-  # explicitly set other fields as needed
+  # Code executor normally tracks the top-level `image` parameters. Override the
+  # tag only when you need a one-off or patched build (e.g. a support build whose
+  # tag differs from the backend's); running a code executor version that does not
+  # match the backend is not generally supported.
 
   image:
     repository: tryretool/code-executor-service
-    pullPolicy: IfNotPresent
+    # defaults to top level image.tag
+    tag: null
+    # pull policy will use the value set in the top-level image.pullPolicy
 
   replicaCount: 1
 
diff --git a/values.yaml b/values.yaml
index ec110348..46aa9b14 100644
--- a/values.yaml
+++ b/values.yaml
@@ -781,12 +781,16 @@ mcp:
     labels: {}
 
 codeExecutor:
-  # as of Chart version 6.7.0, code-executor image version must align with the top-level `image` parameters
-  # explicitly set other fields as needed
+  # Code executor normally tracks the top-level `image` parameters. Override the
+  # tag only when you need a one-off or patched build (e.g. a support build whose
+  # tag differs from the backend's); running a code executor version that does not
+  # match the backend is not generally supported.
 
   image:
     repository: tryretool/code-executor-service
-    pullPolicy: IfNotPresent
+    # defaults to top level image.tag
+    tag: null
+    # pull policy will use the value set in the top-level image.pullPolicy
 
   replicaCount: 1