diff --git a/charts/s3gw/questions.yaml b/charts/s3gw/questions.yaml
index 5733cbf..6d2ec8a 100644
--- a/charts/s3gw/questions.yaml
+++ b/charts/s3gw/questions.yaml
@@ -2,55 +2,112 @@
 questions:
   # General settings
 
-  - variable: useCertManager
-    label: Use cert-manager
-    default: "true"
-    description: "Use cert-manager to provision TLS certificates"
+  - variable: serviceName
+    default: s3gw
+    description: "S3 Service Name"
+    label: "S3 Service Name"
+    required: true
+    type: string
+    group: "General"
+
+  - variable: ingress.enabled
+    default: true
+    description: "Deploy an Ingress (Required for TLS and UI)"
+    label: "Enable Ingress"
+    required: true
     type: boolean
     group: "General"
 
-  - variable: tls.publicDomain.crt
-    show_if: "useCertManager=false"
-    description: "S3 TLS certificate (Public Domain)"
-    label: "S3 TLS certificate (Public Domain)"
+  - variable: publicDomain
+    show_if: ingress.enabled=true
+    default: ""
+    description: "Public domain of the S3 Service used by the Ingress"
+    label: "Public Domain"
+    required: true
     type: string
     group: "General"
 
-  - variable: tls.publicDomain.key
-    show_if: "useCertManager=false"
-    description: "S3 TLS key (Public Domain)"
-    label: "S3 TLS key (Public Domain)"
+  - variable: privateDomain
+    default: svc.cluster.local
+    description: |
+      "Private domain of the S3 Service used inside the Kubernetes cluster"
+    label: "Private Domain"
+    required: true
     type: string
     group: "General"
 
-  - variable: tls.privateDomain.crt
-    show_if: "useCertManager=false"
-    description: "S3 TLS certificate (Private Domain)"
-    label: "S3 TLS certificate (Private Domain)"
+  - variable: ui.enabled
+    show_if: ingress.enabled=true
+    default: false
+    description: "UI Enabled"
+    label: "UI Enabled"
+    required: true
+    type: boolean
+    group: "General"
+
+  - variable: ui.serviceName
+    show_if: ingress.enabled=true
+    default: s3gw-ui
+    description: "UI Service Name"
+    label: "UI Service Name"
+    required: true
     type: string
     group: "General"
 
-  - variable: tls.privateDomain.key
-    show_if: "useCertManager=false"
-    description: "S3 TLS key (Private Domain)"
-    label: "S3 TLS key (Private Domain)"
+  - variable: ui.publicDomain
+    show_if: ingress.enabled=true
+    default: ""
+    description: "Public domain of the UI Service used by the Ingress"
+    label: "UI Public Domain"
+    required: true
     type: string
     group: "General"
 
-  - variable: tls.ui.publicDomain.crt
-    show_if: "useCertManager=false"
-    description: "UI TLS certificate"
-    label: "UI TLS certificate"
+  - variable: useExistingSecret
+    default: false
+    description: |
+      "Check this to use a preexisting secret
+      containing the S3 credentials for the default user"
+    type: boolean
+    group: "General"
+
+  - variable: defaultUserCredentialsSecret
+    show_if: useExistingSecret=true
+    default: s3gw-creds
+    description: |
+      "The name of the secret containing the
+      S3 credentials for the default user"
+    type: secret
+    group: "General"
+
+  - variable: accessKey
+    show_if: useExistingSecret=false
+    default: test
+    description: |
+      "Set this as the empty string to make the Chart
+      to compute a random alphanumeric value"
+    label: "S3 Access Key"
     type: string
     group: "General"
 
-  - variable: tls.ui.publicDomain.key
-    show_if: "useCertManager=false"
-    description: "UI TLS key"
-    label: "UI TLS key"
+  - variable: secretKey
+    show_if: useExistingSecret=false
+    default: test
+    description: |
+      "Set this as the empty string to make the Chart
+      to compute a random alphanumeric value"
+    label: "S3 Secret Key"
     type: string
     group: "General"
 
+  # TLS / Certificate Management
+  - variable: useCertManager
+    label: Use cert-manager
+    default: "true"
+    description: "Use cert-manager to provision TLS certificates"
+    type: boolean
+    group: "TLS / Certificate Management"
+
   - variable: certManagerNamespace
     show_if: "useCertManager=true"
     label: cert-manager's namespace
@@ -58,6 +115,7 @@ questions:
     description: "cert-manager's namespace"
     type: string
     required: false
+    group: "TLS / Certificate Management"
 
   - variable: useCustomTlsIssuer
     show_if: "useCertManager=true"
@@ -65,14 +123,15 @@ questions:
     default: "false"
     description: "Use your own TLS issuer"
     type: boolean
-    group: "General"
-    show_subquestion_if: true
+    group: "TLS / Certificate Management"
+    show_subquestions_if: true
     subquestions:
-    - variable: customTlsIssuer
-      label: Custom TLS issuer
-      description: "Name of the custom TLS issuer to use"
-      type: string
-      required: false
+      - variable: customTlsIssuer
+        label: Custom TLS issuer
+        description: "Name of the custom TLS issuer to use"
+        type: string
+        required: false
+        group: "TLS / Certificate Management"
 
   - variable: tlsIssuer
     show_if: "useCertManager=true&&useCustomTlsIssuer=false"
@@ -80,129 +139,77 @@ questions:
     description: "Name of the predefined TLS issuer to use"
     type: enum
     required: false
-    group: "General"
     options:
       - "s3gw-issuer"
       - "s3gw-letsencrypt-issuer"
+    group: "TLS / Certificate Management"
 
   - variable: email
-    show_if: "useCertManager=true&&tlsIssuer=s3gw-letsencrypt-issuer"
+    show_if: "useCertManager=true&&useCustomTlsIssuer=false"
     label: email address to use with s3gw-letsencrypt-issuer
     description: "email address to use with s3gw-letsencrypt-issuer"
     type: string
     required: false
-    group: "General"
-
-  - variable: serviceName
-    default: s3gw
-    description: "S3 Service Name"
-    label: "S3 Service Name"
-    required: true
-    type: string
-    group: "General"
-
-  - variable: defaultUserCredentialsSecret
-    default: s3gw-creds
-    description: |
-      "The name of the secret containing the
-      S3 credentials for the default user"
-    type: string
-    group: "General"
+    group: "TLS / Certificate Management"
 
-  - variable: useExistingSecret
-    default: false
-    description: |
-      "Check this to use a preexisting secret
-      containing the S3 credentials for the default user"
+  - variable: tls.useExistingSecret
+    show_if: useCertManager=false
+    description: "Use the TLS certificates provided within an existing secret"
+    label: "Use Existing Secret"
     type: boolean
-    group: "General"
-
-  - variable: accessKey
-    show_if: "useExistingSecret=false"
-    default: test
-    description: |
-      "Set this as the empty string to make the Chart
-      to compute a random alphanumeric value"
-    label: "S3 Access Key"
-    type: string
-    group: "General"
+    default: false
+    group: "TLS / Certificate Management"
 
-  - variable: secretKey
-    show_if: "useExistingSecret=false"
-    default: test
-    description: |
-      "Set this as the empty string to make the Chart
-      to compute a random alphanumeric value"
-    label: "S3 Secret Key"
-    type: string
-    group: "General"
+  - variable: tls.secretName
+    show_if: useCertManager=false&&tls.useExistingSecret=true
+    description: "Secret providing TLS certificates"
+    label: "Secret Name"
+    type: secret
+    group: "TLS / Certificate Management"
 
-  - variable: ingress.enabled
-    default: true
-    description: "Deploy an Ingress (Required for TLS and UI)"
-    label: "Enable Ingress"
-    required: true
-    type: boolean
-    group: "General"
-
-  - variable: publicDomain
-    show_if: ingress.enabled=true
-    default: be.127.0.0.1.omg.howdoi.website
-    description: "Public domain of the S3 Service used by the Ingress"
-    label: "Public Domain"
-    required: true
+  - variable: tls.publicDomain.crt
+    show_if: "useCertManager=false&&tls.useExistingSecret=false"
+    description: "S3 TLS certificate (Public Domain)"
+    label: "S3 TLS certificate (Public Domain)"
     type: string
-    group: "General"
+    group: "TLS / Certificate Management"
 
-  - variable: privateDomain
-    default: svc.cluster.local
-    description: "Private domain of the S3 Service used inside the Kubernetes cluster"
-    label: "Private Domain"
-    required: true
+  - variable: tls.publicDomain.key
+    show_if: "useCertManager=false&&tls.useExistingSecret=false"
+    description: "S3 TLS key (Public Domain)"
+    label: "S3 TLS key (Public Domain)"
     type: string
-    group: "General"
-
-  - variable: ui.enabled
-    default: false
-    description: "UI Enabled"
-    label: "UI Enabled"
-    required: true
-    type: boolean
-    group: "General"
+    group: "TLS / Certificate Management"
 
-  - variable: ui.serviceName
-    default: s3gw-ui
-    description: "UI Service Name"
-    label: "UI Service Name"
-    required: true
+  - variable: tls.privateDomain.crt
+    show_if: "useCertManager=false&&tls.useExistingSecret=false"
+    description: "S3 TLS certificate (Private Domain)"
+    label: "S3 TLS certificate (Private Domain)"
     type: string
-    group: "General"
+    group: "TLS / Certificate Management"
 
-  - variable: ui.publicDomain
-    show_if: ingress.enabled=true
-    default: fe.127.0.0.1.omg.howdoi.website
-    description: "Public domain of the UI Service used by the Ingress"
-    label: "UI Public Domain"
-    required: true
+  - variable: tls.privateDomain.key
+    show_if: "useCertManager=false&&tls.useExistingSecret=false"
+    description: "S3 TLS key (Private Domain)"
+    label: "S3 TLS key (Private Domain)"
     type: string
-    group: "General"
+    group: "TLS / Certificate Management"
 
-  # Storage
-  - variable: storageSize
-    description: "Storage Size"
+  - variable: tls.ui.publicDomain.crt
+    show_if: "useCertManager=false&&tls.useExistingSecret=false"
+    description: "UI TLS certificate"
+    label: "UI TLS certificate"
     type: string
-    default: 10Gi
-    label: "Storage Size"
-    group: "Storage"
+    group: "TLS / Certificate Management"
 
-  - variable: storageClass.name
-    description: "Storage Class Name"
+  - variable: tls.ui.publicDomain.key
+    show_if: "useCertManager=false&&tls.useExistingSecret=false"
+    description: "UI TLS key"
+    label: "UI TLS key"
     type: string
-    default: "longhorn-single"
-    required: true
-    label: "Storage Class"
-    group: "Storage"
+    group: "TLS / Certificate Management"
 
+  # Storage
   - variable: storageClass.create
     description: |
       Create a new opinionated storage class backed by longhorn.io
@@ -211,77 +218,114 @@ questions:
     label: "Create Storage Class"
     group: "Storage"
 
-  # Advanced Options
-  - variable: imageRegistry
-    default:
-    description: "Image Registry"
-    label: "Image Registry"
-    required: false
-    type: string
-    group: "Advanced"
+  - variable: storageClass.name
+    show_if: storageClass.create=false
+    type: storageclass
+    required: true
+    label: "Storage Class"
+    group: "Storage"
 
-  - variable: imageCredentials.username
-    default:
-    description: "Registry Username"
-    label: "Username"
-    required: false
+  - variable: storageClass.name
+    show_if: storageClass.create=true
+    description: "New Storage Class Name"
     type: string
-    group: "Advanced"
+    valid_chars: "[0-9a-zA-Z_-]*"
+    default: "longhorn-single"
+    required: true
+    label: "Storage Class"
+    group: "Storage"
 
-  - variable: imageCredentials.password
-    default:
-    description: "Registry Password"
-    label: "Password"
-    required: false
+  - variable: storageSize
+    description: "Volume Size"
     type: string
-    group: "Advanced"
+    default: 10Gi
+    label: "Volume Claim Size"
+    group: "Storage"
 
-  - variable: imageCredentials.email
-    default:
-    description: "Registry Email"
-    label: "Email"
-    required: false
-    type: string
+  # Advanced Options
+  - variable: useCustomImages
+    default: false
+    type: boolean
+    description: "Use custom container images"
+    required: true
     group: "Advanced"
+    show_subquestion_if: true
+    subquestions:
+
+      - variable: imageRegistry
+        default:
+        description: "Image Registry"
+        label: "Registry (e.g. quay.io)"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: imageCredentials.username
+        default:
+        description: "Registry Username"
+        label: "Username"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: imageCredentials.password
+        default:
+        description: "Registry Password"
+        label: "Password"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: imageCredentials.email
+        default:
+        description: "Registry Email"
+        label: "Email"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: imageName
+        default:
+        description: "Gateway Image Name"
+        label: "Image (e.g. s3gw/s3gw)"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: imageTag
+        default:
+        description: "Image Tag"
+        label: "Tag (e.g. latest)"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: ui.imageName
+        default:
+        description: "UI Image Name"
+        label: "Image (e.g. s3gw/s3gw-ui)"
+        required: false
+        type: string
+        group: "Advanced"
+
+      - variable: ui.imageTag
+        default:
+        description: "UI Image Tag"
+        label: "Tag (e.g. latest)"
+        required: false
+        type: string
+        group: "Advanced"
 
   - variable: imagePullPolicy
-    default:
+    default: IfNotPresent
     description: "Image Pull Policy"
     label: "Image Pull Policy"
     required: false
-    type: string
-    group: "Advanced"
-
-  - variable: imageName
-    default:
-    description: "Gateway Image Name"
-    label: "Image Name"
-    required: false
-    type: string
-    group: "Advanced"
-
-  - variable: imageTag
-    default:
-    description: "Image Tag"
-    label: "Image Tag"
-    required: false
-    type: string
-    group: "Advanced"
-
-  - variable: ui.imageName
-    default:
-    description: "UI Image Name"
-    label: "UI Image Name"
-    required: false
-    type: string
-    group: "Advanced"
-
-  - variable: ui.imageTag
-    default:
-    description: "UI Image Tag"
-    label: "UI Image Tag"
-    required: false
-    type: string
+    type: enum
+    options:
+      - IfNotPresent
+      - Always
+      - Never
     group: "Advanced"
 
   - variable: logLevel