diff --git a/cmd/contour/gatewayprovisioner.go b/cmd/contour/gatewayprovisioner.go
index 3d9f03d95fb..470aa31e318 100644
--- a/cmd/contour/gatewayprovisioner.go
+++ b/cmd/contour/gatewayprovisioner.go
@@ -35,7 +35,7 @@ func registerGatewayProvisioner(app *kingpin.Application) (*kingpin.CmdClause, *
 	cmd := app.Command("gateway-provisioner", "Run contour gateway provisioner.")
 
 	provisionerConfig := &gatewayProvisionerConfig{
-		contourImage:          "ghcr.io/projectcontour/contour:main",
+		contourImage:          "ghcr.io/projectcontour/contour:v1.28.0-rc.1",
 		envoyImage:            "docker.io/envoyproxy/envoy:v1.29.0",
 		metricsBindAddress:    ":8080",
 		leaderElection:        false,
diff --git a/examples/contour/02-job-certgen.yaml b/examples/contour/02-job-certgen.yaml
index 35ba3d2fc7d..8044ef077d8 100644
--- a/examples/contour/02-job-certgen.yaml
+++ b/examples/contour/02-job-certgen.yaml
@@ -36,10 +36,9 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-main
+  name: contour-certgen-v1-28-0-rc-1
   namespace: projectcontour
 spec:
-  ttlSecondsAfterFinished: 0
   template:
     metadata:
       labels:
@@ -47,8 +46,8 @@ spec:
     spec:
       containers:
       - name: contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         command:
         - contour
         - certgen
diff --git a/examples/contour/03-contour.yaml b/examples/contour/03-contour.yaml
index a49c3851e4a..fe366482d5c 100644
--- a/examples/contour/03-contour.yaml
+++ b/examples/contour/03-contour.yaml
@@ -45,8 +45,8 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: contour
         ports:
         - containerPort: 8001
diff --git a/examples/contour/03-envoy.yaml b/examples/contour/03-envoy.yaml
index 6bcd8fcbb69..0dc1cbd701c 100644
--- a/examples/contour/03-envoy.yaml
+++ b/examples/contour/03-envoy.yaml
@@ -29,8 +29,8 @@ spec:
         args:
           - envoy
           - shutdown-manager
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
@@ -107,8 +107,8 @@ spec:
         - --envoy-key-file=/certs/tls.key
         command:
         - contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: envoy-initconfig
         volumeMounts:
         - name: envoy-config
diff --git a/examples/deployment/03-envoy-deployment.yaml b/examples/deployment/03-envoy-deployment.yaml
index 5236e57fbb1..3efd94a5794 100644
--- a/examples/deployment/03-envoy-deployment.yaml
+++ b/examples/deployment/03-envoy-deployment.yaml
@@ -42,8 +42,8 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:main
-          imagePullPolicy: Always
+          image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+          imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
               exec:
@@ -120,8 +120,8 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:main
-          imagePullPolicy: Always
+          image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+          imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
             - name: envoy-config
diff --git a/examples/gateway-provisioner/03-gateway-provisioner.yaml b/examples/gateway-provisioner/03-gateway-provisioner.yaml
index ba5a3cfc2e4..4db0c666321 100644
--- a/examples/gateway-provisioner/03-gateway-provisioner.yaml
+++ b/examples/gateway-provisioner/03-gateway-provisioner.yaml
@@ -22,8 +22,8 @@ spec:
         - --metrics-addr=127.0.0.1:8080
         - --enable-leader-election
         command: ["contour"]
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: contour-gateway-provisioner
         resources:
           requests:
diff --git a/examples/render/contour-deployment.yaml b/examples/render/contour-deployment.yaml
index 5085f15db8c..26132c3c239 100644
--- a/examples/render/contour-deployment.yaml
+++ b/examples/render/contour-deployment.yaml
@@ -8789,10 +8789,9 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-main
+  name: contour-certgen-v1-28-0-rc-1
   namespace: projectcontour
 spec:
-  ttlSecondsAfterFinished: 0
   template:
     metadata:
       labels:
@@ -8800,8 +8799,8 @@ spec:
     spec:
       containers:
       - name: contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         command:
         - contour
         - certgen
@@ -9062,8 +9061,8 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: contour
         ports:
         - containerPort: 8001
@@ -9163,8 +9162,8 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:main
-          imagePullPolicy: Always
+          image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+          imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
               exec:
@@ -9241,8 +9240,8 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:main
-          imagePullPolicy: Always
+          image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+          imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
             - name: envoy-config
diff --git a/examples/render/contour-gateway-provisioner.yaml b/examples/render/contour-gateway-provisioner.yaml
index 9d6a8e51877..0a9fa887e57 100644
--- a/examples/render/contour-gateway-provisioner.yaml
+++ b/examples/render/contour-gateway-provisioner.yaml
@@ -20587,8 +20587,8 @@ spec:
         - --metrics-addr=127.0.0.1:8080
         - --enable-leader-election
         command: ["contour"]
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: contour-gateway-provisioner
         resources:
           requests:
diff --git a/examples/render/contour-gateway.yaml b/examples/render/contour-gateway.yaml
index 9bc2b73bdcc..03e2e531455 100644
--- a/examples/render/contour-gateway.yaml
+++ b/examples/render/contour-gateway.yaml
@@ -8792,10 +8792,9 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-main
+  name: contour-certgen-v1-28-0-rc-1
   namespace: projectcontour
 spec:
-  ttlSecondsAfterFinished: 0
   template:
     metadata:
       labels:
@@ -8803,8 +8802,8 @@ spec:
     spec:
       containers:
       - name: contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         command:
         - contour
         - certgen
@@ -9065,8 +9064,8 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: contour
         ports:
         - containerPort: 8001
@@ -9153,8 +9152,8 @@ spec:
         args:
           - envoy
           - shutdown-manager
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
@@ -9231,8 +9230,8 @@ spec:
         - --envoy-key-file=/certs/tls.key
         command:
         - contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: envoy-initconfig
         volumeMounts:
         - name: envoy-config
diff --git a/examples/render/contour.yaml b/examples/render/contour.yaml
index 4b8212d47e4..dbcf2a05d44 100644
--- a/examples/render/contour.yaml
+++ b/examples/render/contour.yaml
@@ -8789,10 +8789,9 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-main
+  name: contour-certgen-v1-28-0-rc-1
   namespace: projectcontour
 spec:
-  ttlSecondsAfterFinished: 0
   template:
     metadata:
       labels:
@@ -8800,8 +8799,8 @@ spec:
     spec:
       containers:
       - name: contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         command:
         - contour
         - certgen
@@ -9062,8 +9061,8 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: contour
         ports:
         - containerPort: 8001
@@ -9150,8 +9149,8 @@ spec:
         args:
           - envoy
           - shutdown-manager
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
@@ -9228,8 +9227,8 @@ spec:
         - --envoy-key-file=/certs/tls.key
         command:
         - contour
-        image: ghcr.io/projectcontour/contour:main
-        imagePullPolicy: Always
+        image: ghcr.io/projectcontour/contour:v1.28.0-rc.1
+        imagePullPolicy: IfNotPresent
         name: envoy-initconfig
         volumeMounts:
         - name: envoy-config