diff --git a/control-operator/Makefile b/control-operator/Makefile
index 45ccb950..ee2fb687 100644
--- a/control-operator/Makefile
+++ b/control-operator/Makefile
@@ -53,6 +53,8 @@ OPERATOR_SDK_VERSION ?= unknown
 # Image URL to use all building/pushing image targets
 TASK_IMG ?= gitlab-registry.cern.ch/aliceo2group/dockerfiles/aliecs/task-manager:latest
 ENVIRONMENT_IMG ?= gitlab-registry.cern.ch/aliceo2group/dockerfiles/aliecs/environment-manager:latest
+# Name of the image pull secret (in operator-system namespace) used by deployed controllers
+PULL_SECRET ?= ghcr-pull
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
 ENVTEST_K8S_VERSION = 1.27.1
 
@@ -212,12 +214,12 @@ deploy: deploy-task deploy-environment ## Deploy both controllers to the K8s clu
 .PHONY: deploy-task
 deploy-task: manifests kustomize ## Deploy task controller to the K8s cluster specified in ~/.kube/config.
 	cd config/task && $(KUSTOMIZE) edit set image task-manager=${TASK_IMG}
-	$(KUSTOMIZE) build config/task | $(KUBECTL) apply -f - --server-side
+	$(KUSTOMIZE) build config/task | sed 's/- name: pull-secret-placeholder$$/- name: $(PULL_SECRET)/' | $(KUBECTL) apply -f - --server-side
 
 .PHONY: deploy-environment
 deploy-environment: manifests kustomize ## Deploy environment controller to the K8s cluster specified in ~/.kube/config.
 	cd config/environment && $(KUSTOMIZE) edit set image environment-manager=${ENVIRONMENT_IMG}
-	$(KUSTOMIZE) build config/environment | $(KUBECTL) apply -f - --server-side
+	$(KUSTOMIZE) build config/environment | sed 's/- name: pull-secret-placeholder$$/- name: $(PULL_SECRET)/' | $(KUBECTL) apply -f - --server-side
 
 .PHONY: undeploy
 undeploy: undeploy-task undeploy-environment ## Undeploy both controllers from the K8s cluster specified in ~/.kube/config.
diff --git a/control-operator/README.md b/control-operator/README.md
index 208ff6b6..91fc6b93 100644
--- a/control-operator/README.md
+++ b/control-operator/README.md
@@ -37,10 +37,10 @@ kubectl apply -f config/samples/
 make docker-build docker-push TASK_IMG=<some-registry>/task-manager:tag ENVIRONMENT_IMG=<some-registry>/environment-manager:tag
 ```
 
-1. Deploy the controllers to the cluster. Uses the same `TASK_IMG` and `ENVIRONMENT_IMG` defaults, override them if needed:
+1. Deploy the controllers to the cluster. Uses the same `TASK_IMG` and `ENVIRONMENT_IMG` defaults, override them if needed. Images are pulled using the secret named by `PULL_SECRET` (default `ghcr-pull`), which must exist in the `operator-system` namespace:
 
 ```sh
-make deploy TASK_IMG=<some-registry>/task-manager:tag ENVIRONMENT_IMG=<some-registry>/environment-manager:tag
+make deploy TASK_IMG=<some-registry>/task-manager:tag ENVIRONMENT_IMG=<some-registry>/environment-manager:tag PULL_SECRET=<secret-name>
 ```
 
 ### Uninstall CRDs
diff --git a/control-operator/config/manager/environment-manager/environment-manager.yaml b/control-operator/config/manager/environment-manager/environment-manager.yaml
index 11b12925..f4536ca0 100644
--- a/control-operator/config/manager/environment-manager/environment-manager.yaml
+++ b/control-operator/config/manager/environment-manager/environment-manager.yaml
@@ -23,8 +23,9 @@ spec:
       labels:
         control-plane: environment-manager
     spec:
+      # placeholder, replaced with $(PULL_SECRET) by `make deploy-task` / `make deploy-environment`
       imagePullSecrets:
-        - name: gitlab-registry-secret
+        - name: pull-secret-placeholder
       securityContext:
         runAsNonRoot: true
       containers:
diff --git a/control-operator/config/manager/task-manager/task-manager.yaml b/control-operator/config/manager/task-manager/task-manager.yaml
index 717c9a8d..c7bcf8ad 100644
--- a/control-operator/config/manager/task-manager/task-manager.yaml
+++ b/control-operator/config/manager/task-manager/task-manager.yaml
@@ -23,8 +23,9 @@ spec:
         control-plane: task-manager
     spec:
       hostNetwork: true
+      # placeholder, replaced with $(PULL_SECRET) by `make deploy-task` / `make deploy-environment`
       imagePullSecrets:
-        - name: gitlab-registry-secret
+        - name: pull-secret-placeholder
       securityContext:
         runAsNonRoot: true
       containers: