diff --git a/config/hwlab-node-control-plane.yaml b/config/hwlab-node-control-plane.yaml
index 82354237..3b00eead 100644
--- a/config/hwlab-node-control-plane.yaml
+++ b/config/hwlab-node-control-plane.yaml
@@ -126,6 +126,7 @@ targets:
       pipelineRunPrefix: hwlab-d601-v03-ci-poll
       toolsImage:
         output: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
+        imagePullPolicy: Always
         sourceKind: dockerfile
         context: .
         dockerfileInline:
diff --git a/scripts/src/hwlab-node-control-plane.ts b/scripts/src/hwlab-node-control-plane.ts
index efb55644..cee7dc8d 100644
--- a/scripts/src/hwlab-node-control-plane.ts
+++ b/scripts/src/hwlab-node-control-plane.ts
@@ -127,10 +127,11 @@ interface ControlPlaneTargetSpec {
     pipelineName: string;
     serviceAccountName: string;
     pipelineRunPrefix: string;
-    toolsImage: {
-      output: string;
-      sourceKind: "dockerfile" | "docker-compose";
-      context: string;
+      toolsImage: {
+        output: string;
+        imagePullPolicy: "Always" | "IfNotPresent" | "Never";
+        sourceKind: "dockerfile" | "docker-compose";
+        context: string;
       dockerfile?: string;
       dockerfileInline?: DockerfileInlineSpec;
       composeFile?: string;
@@ -671,6 +672,8 @@ function imagePolicySpec(raw: Record<string, unknown>): ControlPlaneImagePolicy
 function toolsImageSpec(raw: Record<string, unknown>, path: string): ControlPlaneTargetSpec["tekton"]["toolsImage"] {
   const sourceKind = stringField(raw, "sourceKind", path);
   if (sourceKind !== "dockerfile" && sourceKind !== "docker-compose") throw new Error(`${path}.sourceKind must be dockerfile or docker-compose`);
+  const imagePullPolicy = optionalStringField(raw, "imagePullPolicy", path) ?? "IfNotPresent";
+  if (imagePullPolicy !== "Always" && imagePullPolicy !== "IfNotPresent" && imagePullPolicy !== "Never") throw new Error(`${path}.imagePullPolicy must be Always, IfNotPresent, or Never`);
   const publicBaseImages = stringArrayField(raw, "publicBaseImages", path);
   if (publicBaseImages.length === 0) throw new Error(`${path}.publicBaseImages must list at least one public base image`);
   for (const image of publicBaseImages) validatePublicBaseImage(image, `${path}.publicBaseImages`);
@@ -687,6 +690,7 @@ function toolsImageSpec(raw: Record<string, unknown>, path: string): ControlPlan
   }
   return {
     output: stringField(raw, "output", path),
+    imagePullPolicy,
     sourceKind,
     context: stringField(raw, "context", path),
     dockerfile,
diff --git a/scripts/src/hwlab-node-impl.ts b/scripts/src/hwlab-node-impl.ts
index 1cc85297..99e9f8b9 100644
--- a/scripts/src/hwlab-node-impl.ts
+++ b/scripts/src/hwlab-node-impl.ts
@@ -256,6 +256,7 @@ interface NodeRuntimeGitMirrorTargetSpec {
   syncJobPrefix: string;
   flushJobPrefix: string;
   toolsImage: string;
+  toolsImagePullPolicy: "Always" | "IfNotPresent" | "Never";
   sourceRepository: string;
   sourceBranch: string;
   gitopsBranch: string;
@@ -3848,11 +3849,11 @@ function nodeRuntimeGitMirrorJobManifest(mirror: NodeRuntimeGitMirrorTargetSpec,
         spec: {
           restartPolicy: "Never",
           volumes,
-          containers: [{
-            name: action,
-            image: mirror.toolsImage,
-            imagePullPolicy: "IfNotPresent",
-            command: [action === "sync" ? "/script/sync.sh" : "/script/flush.sh"],
+            containers: [{
+              name: action,
+              image: mirror.toolsImage,
+              imagePullPolicy: mirror.toolsImagePullPolicy,
+              command: [action === "sync" ? "/script/sync.sh" : "/script/flush.sh"],
             env: [...nodeRuntimeGitMirrorProxyEnv(mirror), ...nodeRuntimeGitMirrorGithubTransportEnv(mirror)],
             volumeMounts,
           }],
@@ -5716,8 +5717,9 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
     "    for (const sidecar of task.taskSpec?.sidecars || []) {",
     "      if (overlay.buildkitSidecarImage && typeof sidecar.image === 'string' && sidecar.image.includes('buildkit')) sidecar.image = overlay.buildkitSidecarImage;",
     "    }",
-    "    for (const step of task.taskSpec?.steps || []) {",
-    "      if (Array.isArray(step.env)) {",
+      "    for (const step of task.taskSpec?.steps || []) {",
+      "      if (step.image === overlay.toolsImage && overlay.toolsImagePullPolicy) step.imagePullPolicy = overlay.toolsImagePullPolicy;",
+      "      if (Array.isArray(step.env)) {",
     "        for (const env of step.env) {",
     "          if (Object.prototype.hasOwnProperty.call(stepEnv, env.name) && stepEnv[env.name] !== undefined) env.value = stepEnv[env.name];",
     "        }",
@@ -5937,10 +5939,12 @@ function nodeRuntimeRenderOverlay(spec: HwlabRuntimeLaneSpec): Record<string, un
     tektonDir: spec.tektonDir,
     argoApplicationFile: spec.argoApplicationFile,
     argoRepoUrl: spec.argoRepoUrl,
-    gitUrl: spec.gitUrl,
-    gitReadUrl: spec.gitReadUrl,
-    gitWriteUrl: spec.gitWriteUrl,
-    gitMirror: renderGitMirror,
+      gitUrl: spec.gitUrl,
+      gitReadUrl: spec.gitReadUrl,
+      gitWriteUrl: spec.gitWriteUrl,
+      toolsImage: gitMirror.toolsImage,
+      toolsImagePullPolicy: gitMirror.toolsImagePullPolicy,
+      gitMirror: renderGitMirror,
     networkProfileId: spec.networkProfileId,
     downloadProfileId: spec.downloadProfileId,
     gitSshProxyHost: gitSshProxy?.host,
@@ -6952,6 +6956,8 @@ function nodeRuntimeGitMirrorTarget(spec: HwlabRuntimeLaneSpec): NodeRuntimeGitM
   const gitops = record(target.gitops);
   const tekton = record(target.tekton);
   const toolsImage = record(tekton.toolsImage);
+  const toolsImagePullPolicy = optionalStringValue(toolsImage.imagePullPolicy, "tekton.toolsImage.imagePullPolicy") ?? "IfNotPresent";
+  if (toolsImagePullPolicy !== "Always" && toolsImagePullPolicy !== "IfNotPresent" && toolsImagePullPolicy !== "Never") throw new Error("tekton.toolsImage.imagePullPolicy must be Always, IfNotPresent, or Never");
   return {
     id: stringValue(target.id, "target.id"),
     node: stringValue(target.node, "target.node"),
@@ -6968,6 +6974,7 @@ function nodeRuntimeGitMirrorTarget(spec: HwlabRuntimeLaneSpec): NodeRuntimeGitM
     syncJobPrefix: stringValue(gitMirror.syncJobPrefix, "gitMirror.syncJobPrefix"),
     flushJobPrefix: stringValue(gitMirror.flushJobPrefix, "gitMirror.flushJobPrefix"),
     toolsImage: stringValue(toolsImage.output, "tekton.toolsImage.output"),
+    toolsImagePullPolicy,
     sourceRepository: stringValue(source.repository, "source.repository"),
     sourceBranch: stringValue(source.branch, "source.branch"),
     gitopsBranch: stringValue(gitops.branch, "gitops.branch"),