diff --git a/.gitignore b/.gitignore
index 11aea80348..098213a079 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,4 +31,7 @@ source/plugins/go/src/*.h
 *.log
 *.byebug_history
 go.work.sum
-go.work
\ No newline at end of file
+go.work
+# generated helm chart files (created at build time from templates; see charts/azuremonitor-containerinsights/*-template.yaml)
+charts/azuremonitor-containerinsights/Chart.yaml
+charts/azuremonitor-containerinsights/values.yaml
\ No newline at end of file
diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml
index e1057a49f9..26dce08ed1 100644
--- a/.pipelines/azure_pipeline_mergedbranches.yaml
+++ b/.pipelines/azure_pipeline_mergedbranches.yaml
@@ -16,6 +16,10 @@ variables:
   subscription: '9b96ebbd-c57a-42d1-bbe9-b69296e4c7fb'
   containerRegistry: 'containerinsightsprod'
   repoImageName: '${{ variables.containerRegistry }}.azurecr.io/public/azuremonitor/containerinsights/cidev'
+  # Helm chart is pushed to a dedicated chart path, decoupled from the agent image path
+  # (repoImageName). The chart reuses the already-onboarded `preview` MCR repo instead of a
+  # new cidev chart repo; the prod release promotes it to the `helmchart/... /ciprod` path.
+  chartRepoName: '${{ variables.containerRegistry }}.azurecr.io/public/azuremonitor/containerinsights/preview'
   GOLANG_BASE_IMAGE: 'mcr.microsoft.com/oss/go/microsoft/golang:1.26.5'
   IS_PR: $[eq(variables['Build.Reason'], 'PullRequest')]
   IS_MAIN_BRANCH: $[eq(variables['Build.SourceBranchName'], 'ci_prod')]
@@ -66,10 +70,21 @@ extends:
         steps:
         - task: ComponentGovernanceComponentDetection@0
         - bash: |
-            commit=$(git describe)
-            datetime=$(date +%Y%m%d%H%M%S)
-            linuxImagetag="$commit"-"$datetime"
-            windowsImageTag=win-"$commit"-"$datetime"
+            # Derive SEMVER from the repo-root VERSION file instead of git tags.
+            # Format: <VERSION>-<branch>-<date>-<commit>
+            if [ "$(IS_PR)" == "True" ]; then
+              BRANCH_NAME=$(System.PullRequest.SourceBranch)
+            else
+              BRANCH_NAME=$(Build.SourceBranch)
+              BRANCH_NAME=${BRANCH_NAME#refs/heads/}
+            fi
+            BRANCH_NAME=$(echo "$BRANCH_NAME" | tr / - | tr . - | tr _ - | cut -c1-90)
+            COMMIT_SHA=$(echo "$(Build.SourceVersion)" | cut -b -8)
+            DATE=$(TZ=America/Los_Angeles date +%m-%d-%Y)
+            VERSION=$(cat $(Build.SourcesDirectory)/VERSION)
+            SEMVER=$VERSION-$BRANCH_NAME-$DATE-$COMMIT_SHA
+            linuxImagetag=$SEMVER
+            windowsImageTag=win-$SEMVER
             telemetryTag=$linuxImagetag
             if [ -z "$TELEMETRY_TAG" ]
               then
@@ -88,13 +103,33 @@ extends:
             echo "##vso[task.setvariable variable=windowsImageTag;isOutput=true]$windowsImageTag"
             echo "##vso[task.setvariable variable=linuxTelemetryTag;isOutput=true]$linuxTelemetryTag"
             echo "##vso[task.setvariable variable=windowsTelemetryTag;isOutput=true]$windowsTelemetryTag"
+            echo "SEMVER is $SEMVER"
+            echo "##vso[task.setvariable variable=SEMVER;isOutput=true]$SEMVER"
+            # Set the pipeline run number to SEMVER so downstream release pipelines
+            # can consume this exact build version via
+            # resources.pipeline.<alias>.runName (mirrors ama-metrics). A release then
+            # just picks a build run and uses whatever version is inside it, instead
+            # of hand-setting an image tag suffix. NOTE: the $(Build.BuildNumber)
+            # macros in the buildver.txt writes below are already expanded to the
+            # original unique run number at step start, so this override does not
+            # affect Ev2 artifact-version uniqueness.
+            echo "##vso[build.updatebuildnumber]$SEMVER"
             echo "appRegistrationClientId is $APP_REGISTRATION_CLIENT_ID"
             echo "appRegistrationTenantId is $APP_REGISTRATION_TENANT_ID"
             echo "authAKVName is $AUTH_AKV_NAME"
             echo "authCertName is $AUTH_CERT_NAME"
             echo "authSignCertName is $AUTH_SIGN_CERT_NAME"
+            # Generate Chart.yaml/values.yaml from the committed *-template.yaml files
+            # so the Ev2 source tar + CopyFiles below include the SEMVER-stamped chart
+            # for the downstream release pipeline. Only templates are committed.
+            export HELM_SEMVER="$SEMVER"
+            export IMAGE_TAG="$linuxImagetag"
+            export IMAGE_TAG_WINDOWS="$windowsImageTag"
+            CI_CHART_DIR="$(Build.SourcesDirectory)/charts/azuremonitor-containerinsights"
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/Chart-template.yaml" > "$CI_CHART_DIR/Chart.yaml"
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/values-template.yaml" > "$CI_CHART_DIR/values.yaml"
             cd $(Build.SourcesDirectory)/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts
-            tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh
+            tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh pushChartToAcr.sh
             cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension/ServiceGroupRoot/Scripts
             tar -czvf ../artifacts.tar.gz ../../../../charts/azuremonitor-containers/ ../../../../charts/azuremonitor-containerinsights/ pushChartToAcr.sh
             cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/Scripts
@@ -903,6 +938,74 @@ extends:
             DisableRemediation: false
             AcceptableOutdatedSignatureInHours: 72
 
+      - job: helm_chart
+        displayName: "Package and Publish Helm Chart"
+        dependsOn: common
+        pool:
+          name: Azure-Pipelines-CI-Test-EO
+          image: ci-1es-managed-ubuntu-2204
+          os: linux
+        variables:
+          HELM_SEMVER: $[ dependencies.common.outputs['setup.SEMVER'] ]
+          IMAGE_TAG: $[ dependencies.common.outputs['setup.linuxImagetag'] ]
+          IMAGE_TAG_WINDOWS: $[ dependencies.common.outputs['setup.windowsImageTag'] ]
+          skipComponentGovernanceDetection: true
+          Codeql.SkipTaskAutoInjection: true
+        templateContext:
+          outputs:
+          - output: pipelineArtifact
+            targetPath: '$(Build.ArtifactStagingDirectory)/helm-chart'
+            artifactName: helm-chart-drop
+            condition: and(succeeded(), eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true))
+        steps:
+        - task: HelmInstaller@1
+          displayName: "Install Helm"
+          inputs:
+            helmVersionToInstall: 'latest'
+        - bash: |
+            set -e
+            mkdir -p $(Build.ArtifactStagingDirectory)/helm-chart
+            # Generate the chart from the committed templates using the SEMVER-derived
+            # tags, then lint + package. The chart is pushed to the preview chart repo on
+            # every build (mirrors ama-metrics, whose chart push is ungated); only the ADO
+            # pipeline artifact publish is gated to non-PR ci_prod builds (see the gated
+            # output above).
+            export HELM_SEMVER="$(HELM_SEMVER)"
+            export IMAGE_TAG="$(IMAGE_TAG)"
+            export IMAGE_TAG_WINDOWS="$(IMAGE_TAG_WINDOWS)"
+            cd $(Build.SourcesDirectory)/charts/azuremonitor-containerinsights
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < Chart-template.yaml > Chart.yaml
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < values-template.yaml > values.yaml
+            echo "----- generated Chart.yaml -----"
+            cat Chart.yaml
+            helm lint .
+            helm package . --version "$(HELM_SEMVER)" --destination $(Build.ArtifactStagingDirectory)/helm-chart
+            # Package the same chart a second time under an -arc prerelease version so the
+            # build publishes both an AKS-extension tag (<SEMVER>) and an Arc tag
+            # (<SEMVER>-arc) to the preview chart repo, mirroring the ama-metrics build. The
+            # prod release promotes both tags to the ciprod chart repo.
+            helm package . --version "$(HELM_SEMVER)-arc" --destination $(Build.ArtifactStagingDirectory)/helm-chart
+            ls -l $(Build.ArtifactStagingDirectory)/helm-chart
+          displayName: "Generate, lint and package Helm chart"
+        - task: AzureCLI@2
+          displayName: "Push Helm chart to ACR"
+          inputs:
+            azureSubscription: ${{ variables.armServiceConnectionName }}
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -e
+              az account set -s ${{ variables.subscription }}
+              az acr login -n ${{ variables.containerRegistry }}
+              CHART_TGZ="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER).tgz"
+              CHART_TGZ_ARC="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER)-arc.tgz"
+              helm push "$CHART_TGZ" oci://${{ variables.chartRepoName }}
+              # Arc tag: same chart, pushed under <SEMVER>-arc for the Arc K8s extension path.
+              helm push "$CHART_TGZ_ARC" oci://${{ variables.chartRepoName }}
+              echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER)\",\"helmChartArcRef\":\"oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER)-arc\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json
+              cat $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json
+              echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER) and :$(HELM_SEMVER)-arc"
+
     - stage: Deploy_and_Test_Images_In_Dev_Clusters
       displayName: Deploy and Test Images in Dev Clusters
       lockBehavior: sequential
diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml
index 1cf9238e14..920fee12a1 100644
--- a/.pipelines/ci-aks-prod-release.yaml
+++ b/.pipelines/ci-aks-prod-release.yaml
@@ -3,8 +3,14 @@ name: $(Date:yyyyMMdd).$(Rev:r)
 variables:
 - name: ACRName
   value: $(VAR_ACR_NAME)
+# AgentImageTagSuffix is the image/chart tag promoted to ciprod MCR and used for
+# the helm deploys below. It now sources from the picked build run's runName
+# (= the build SEMVER, e.g. 3.6.0-ci-prod-<date>-<sha>) instead of a manually set
+# variable, so a release just picks a build run and uses whatever version is
+# inside it (mirrors ama-metrics resources.pipeline.<alias>.runName). The build
+# pipeline sets its run number to SEMVER via ##vso[build.updatebuildnumber].
 - name: AgentImageTagSuffix
-  value: $(VAR_AGENT_IMAGE_TAG_SUFFIX)
+  value: $(resources.pipeline._ci-aks-prod-release.runName)
 - name: AgentRelease
   value: $(VAR_AGENT_RELEASE)
 - name: AKSEngineCluster
@@ -17,22 +23,6 @@ variables:
   value: $(VAR_AKS_SCALE_CLUSTER_REGION)
 - name: AKSScaleClusterResourceId
   value: $(VAR_AKS_SCALE_CLUSTER_RESOURCE_ID)
-- name: CDPXLinuxACR
-  value: $(VAR_CDPX_LINUX_ACR)
-- name: CDPXLinuxRegistry
-  value: $(VAR_CDPX_LINUX_REGISTRY)
-- name: CDPXLinuxRepoName
-  value: $(VAR_CDPX_LINUX_REPO_NAME)
-- name: CDPXLinuxTag
-  value: $(VAR_CDPX_LINUX_TAG)
-- name: CDPXWindowsACR
-  value: $(VAR_CDPX_WINDOWS_ACR)
-- name: CDPXWindowsRegistry
-  value: $(VAR_CDPX_WINDOWS_REGISTRY)
-- name: CDPXWindowsRepoName
-  value: $(VAR_CDPX_WINDOWS_REPO_NAME)
-- name: CDPXWindowsTag
-  value: $(VAR_CDPX_WINDOWS_TAG)
 - name: CIKV
   value: $(VAR_CIKV)
 - name: CIRelease
@@ -46,7 +36,7 @@ variables:
 - name: OverrideTag
   value: $(VAR_OVERRIDE_TAG)
 - name: configurationOverrides
-  value: '{"ConfigurationSpecification":{"Settings":{"agentImageTagSuffix":"$(AgentImageTagSuffix)","cdpxLinuxTag":"$(CDPXLinuxTag)","cdpxWindowsTag":"$(CDPXWindowsTag)","overrideTag":"$(OverrideTag)"}}}'
+  value: '{"ConfigurationSpecification":{"Settings":{"agentImageTagSuffix":"$(AgentImageTagSuffix)","overrideTag":"$(OverrideTag)"}}}'
 - name: ServiceTreeGuid
   value: $(VAR_SERVICE_TREE_GUID)
 - name: UserAssignedIdentityClientId
@@ -402,37 +392,6 @@ extends:
             repository: none
           target:
             container: host
-        - task: Bash@3
-          displayName: Set CDPX Linux Tag
-          inputs:
-            targetType: inline
-            script: |
-              # Write your commands here
-
-              LINUX_TAG=$(jq '."image.name"' metadata.json | tr -d '"' | cut -d':' -f2)
-              echo $LINUX_TAG
-
-              set +x
-              echo "##vso[task.setvariable variable=CDPXLinuxTag;]$LINUX_TAG"
-              set -x
-            workingDirectory: $(Pipeline.Workspace)/ev2Artifact/linux-drop/linux
-            failOnStderr: true
-        - task: Bash@3
-          displayName: Set CDPX Windows Tag
-          inputs:
-            targetType: inline
-            script: |+
-              # Write your commands here
-
-              WINDOWS_TAG=$(jq '."image.name"' metadata.json | tr -d '"' | cut -d':' -f2)
-              echo $WINDOWS_TAG
-
-              set +x
-              echo "##vso[task.setvariable variable=CDPXWindowsTag;]$WINDOWS_TAG"
-              set -x
-
-            workingDirectory: $(Pipeline.Workspace)/ev2Artifact/windows-drop/windows
-            failOnStderr: true
         - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2
           displayName: Ev2 Managed SDP - Deploy
           inputs:
@@ -496,7 +455,7 @@ extends:
       # (dependsOn: []) and gate the actual deploys on a job that polls MCR until the
       # new image tags are available. This mirrors the ama-metrics release pipeline.
       dependsOn: []
-      condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true), ne(variables.AgentImageTagSuffix, ''))
+      condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true))
       pool:
         name: Azure-Pipelines-CI-Test-EO
         image: ci-1es-managed-ubuntu-2204
@@ -524,7 +483,7 @@ extends:
         steps:
         - checkout: none
         - task: Bash@3
-          displayName: 'Check ama-logs images are published to MCR'
+          displayName: 'Check ama-logs images and Helm chart are published to MCR'
           target:
             container: host
           env:
@@ -532,6 +491,9 @@ extends:
             WINDOWS_TAG: 'win-$(AgentImageTagSuffix)'
             MCR_REGISTRY: 'mcr.microsoft.com'
             PROD_MCR_AGENT_REPO: '/azuremonitor/containerinsights/ciprod'
+            PROD_MCR_CHART_REPO: '/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers'
+            CHART_TAG: '$(AgentImageTagSuffix)'
+            CHART_TAG_ARC: '$(AgentImageTagSuffix)-arc'
             # 1440 attempts * 60s = up to 24h, covering the Stage_2 rollout window.
             MAX_RETRIES: 1440
             SLEEP_INTERVAL: 60
@@ -541,33 +503,38 @@ extends:
               set -uo pipefail
 
               # Returns the HTTP status code for a tag's manifest on MCR.
-              # A 200 means the image tag exists. Querying the manifest directly
-              # (instead of grepping /tags/list) avoids substring false positives
-              # and pagination issues on the large ciprod repo.
+              # A 200 means the manifest (container image or OCI Helm chart) exists.
+              # Querying the manifest directly (instead of grepping /tags/list) avoids
+              # substring false positives and pagination issues on the large ciprod repo.
               check_tag() {
-                local tag="$1"
+                local repo="$1"
+                local tag="$2"
                 curl -sSL -o /dev/null -w "%{http_code}" \
                   -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.v2+json" \
-                  "https://${MCR_REGISTRY}/v2${PROD_MCR_AGENT_REPO}/manifests/${tag}" || echo "000"
+                  "https://${MCR_REGISTRY}/v2${repo}/manifests/${tag}" || echo "000"
               }
 
-              echo "Waiting for ama-logs images to be published to MCR:"
-              echo "  Linux:   ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${LINUX_TAG}"
-              echo "  Windows: ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${WINDOWS_TAG}"
+              echo "Waiting for ama-logs images and Helm chart to be published to MCR:"
+              echo "  Linux:      ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${LINUX_TAG}"
+              echo "  Windows:    ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${WINDOWS_TAG}"
+              echo "  Chart:      ${MCR_REGISTRY}${PROD_MCR_CHART_REPO}:${CHART_TAG}"
+              echo "  Chart(arc): ${MCR_REGISTRY}${PROD_MCR_CHART_REPO}:${CHART_TAG_ARC}"
               echo "  MAX_RETRIES=${MAX_RETRIES} SLEEP_INTERVAL=${SLEEP_INTERVAL}s"
 
               for i in $(seq 1 "$MAX_RETRIES"); do
-                linux_code=$(check_tag "$LINUX_TAG")
-                windows_code=$(check_tag "$WINDOWS_TAG")
-                echo "Attempt ${i}/${MAX_RETRIES}: linux=${linux_code} windows=${windows_code}"
-                if [ "$linux_code" = "200" ] && [ "$windows_code" = "200" ]; then
-                  echo "Both ama-logs images are published to MCR."
+                linux_code=$(check_tag "$PROD_MCR_AGENT_REPO" "$LINUX_TAG")
+                windows_code=$(check_tag "$PROD_MCR_AGENT_REPO" "$WINDOWS_TAG")
+                chart_code=$(check_tag "$PROD_MCR_CHART_REPO" "$CHART_TAG")
+                chart_arc_code=$(check_tag "$PROD_MCR_CHART_REPO" "$CHART_TAG_ARC")
+                echo "Attempt ${i}/${MAX_RETRIES}: linux=${linux_code} windows=${windows_code} chart=${chart_code} chart-arc=${chart_arc_code}"
+                if [ "$linux_code" = "200" ] && [ "$windows_code" = "200" ] && [ "$chart_code" = "200" ] && [ "$chart_arc_code" = "200" ]; then
+                  echo "All ama-logs images and Helm chart tags are published to MCR."
                   exit 0
                 fi
                 sleep "$SLEEP_INTERVAL"
               done
 
-              echo "##[error]ama-logs images not published to MCR within $((MAX_RETRIES * SLEEP_INTERVAL / 60)) minutes."
+              echo "##[error]ama-logs images/chart not published to MCR within $((MAX_RETRIES * SLEEP_INTERVAL / 60)) minutes."
               exit 1
       # Monitoring-Model-Cluster-WCUS
       - template: .pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml@self
diff --git a/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml b/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml
index 09803c1670..9aa08befc4 100644
--- a/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml
+++ b/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml
@@ -90,6 +90,23 @@ jobs:
         steps:
         - checkout: self
           displayName: Checkout repository
+        - bash: |
+            set -euo pipefail
+            CHART_DIR="$(Build.SourcesDirectory)/charts/azuremonitor-containerinsights"
+            cd "$CHART_DIR"
+            # The committed chart is template-only (Chart.yaml/values.yaml are
+            # generated at build time from the *-template.yaml files, see
+            # azure_pipeline_mergedbranches.yaml). Regenerate them here so the
+            # FilePath Helm deploy below has a complete chart in this job's
+            # fresh checkout.
+            export HELM_SEMVER="${{ parameters.amalogsLinuxImage }}"
+            export IMAGE_TAG="${{ parameters.amalogsLinuxImage }}"
+            export IMAGE_TAG_WINDOWS="${{ parameters.amalogsWindowsImage }}"
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < Chart-template.yaml > Chart.yaml
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < values-template.yaml > values.yaml
+            echo "----- generated Chart.yaml -----"
+            cat Chart.yaml
+          displayName: 'Generate Chart.yaml and values.yaml from templates'
         - task: HelmInstaller@1
           displayName: Install Helm
           inputs:
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000000..1545d96657
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+3.5.0
diff --git a/charts/azuremonitor-containerinsights/.helmignore b/charts/azuremonitor-containerinsights/.helmignore
new file mode 100644
index 0000000000..9fd44b1ac5
--- /dev/null
+++ b/charts/azuremonitor-containerinsights/.helmignore
@@ -0,0 +1,20 @@
+# Patterns to ignore when building Helm packages.
+# Files here are excluded from the packaged .tgz (matched by basename unless
+# anchored with a leading /). Generation of Chart.yaml/values.yaml happens
+# before `helm package`, so ignoring the *-template sources is safe.
+
+# Common VCS / editor / OS cruft
+.git/
+.gitignore
+.DS_Store
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+
+# Chart source files — the build substitutes these into the real
+# Chart.yaml/values.yaml before packaging, so the templates must not
+# ship inside the chart.
+Chart-template.yaml
+values-template.yaml
diff --git a/charts/azuremonitor-containerinsights/Chart.yaml b/charts/azuremonitor-containerinsights/Chart-template.yaml
similarity index 95%
rename from charts/azuremonitor-containerinsights/Chart.yaml
rename to charts/azuremonitor-containerinsights/Chart-template.yaml
index b70e2f26ae..40a1a581ad 100644
--- a/charts/azuremonitor-containerinsights/Chart.yaml
+++ b/charts/azuremonitor-containerinsights/Chart-template.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 name: azuremonitor-containers
 description: Azure Monitor container monitoring agent Helm chart for Kubernetes (supports both AKS addon and Arc K8s extension)
-version: 3.4.1
-appVersion: 7.0.0-1
+version: ${HELM_SEMVER}
+appVersion: "${IMAGE_TAG}"
 kubeVersion: "^1.10.0-0"
 keywords:
   - monitoring
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml
index 41f359c3ee..afd213eb44 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml
@@ -30,7 +30,7 @@ metadata:
   namespace: kube-system
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml
index d5b169cf5c..a9548c98ec 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml
@@ -50,7 +50,7 @@ metadata:
   namespace: kube-system
   labels:
 {{- if $isArcExtension }}
-    chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" $.Chart.Name $.Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
 {{- else }}
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml
index 919521ec7d..2c0d537dee 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml
@@ -31,7 +31,7 @@ metadata:
   namespace: kube-system
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml
index 1713a84e2f..5d9c17d969 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml
@@ -16,7 +16,7 @@ metadata:
   name: ama-logs
   # Priority classes don't have labels :-)
   annotations:
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
     component: ama-logs-agent
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml
index d2549c0372..a7cf74d80a 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml
@@ -22,7 +22,7 @@ metadata:
   namespace: kube-system
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
@@ -46,7 +46,7 @@ metadata:
   name: ama-logs-reader
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
@@ -128,7 +128,7 @@ metadata:
   name: amalogsclusterrolebinding
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml
index 07cdc4a78d..6b280ba51b 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml
@@ -302,7 +302,7 @@ metadata:
   namespace: kube-system
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml
index 1b0fcf57db..81420e94e7 100644
--- a/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml
+++ b/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml
@@ -10,7 +10,7 @@ metadata:
   namespace: kube-system
   labels:
 {{- if $isArcExtension }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 {{- else }}
diff --git a/charts/azuremonitor-containerinsights/values.yaml b/charts/azuremonitor-containerinsights/values-template.yaml
similarity index 99%
rename from charts/azuremonitor-containerinsights/values.yaml
rename to charts/azuremonitor-containerinsights/values-template.yaml
index ab3570b5bd..e141cf7be7 100644
--- a/charts/azuremonitor-containerinsights/values.yaml
+++ b/charts/azuremonitor-containerinsights/values-template.yaml
@@ -41,8 +41,8 @@ OmsAgent:
   
   # Image configuration
   imageRepository: "/azuremonitor/containerinsights/ciprod"
-  imageTagLinux: "3.4.0"
-  imageTagWindows: "win-3.4.0"
+  imageTagLinux: "${IMAGE_TAG}"
+  imageTagWindows: "${IMAGE_TAG_WINDOWS}"
   isImagePullPolicyAlways: false
 
   # Resource ID and cluster information
@@ -214,8 +214,8 @@ OmsAgent:
 amalogs:
   image:
     repo: "mcr.microsoft.com/azuremonitor/containerinsights/ciprod"
-    tag: "3.4.0"
-    tagWindows: "win-3.4.0"
+    tag: "${IMAGE_TAG}"
+    tagWindows: "${IMAGE_TAG_WINDOWS}"
     pullPolicy: IfNotPresent
     dockerProviderVersion: "18.0.1-0"
     agentVersion: "azure-mdsd-1.40.3"
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json
index 0c5295c952..beeb9920b6 100644
--- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json
+++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json
@@ -7,8 +7,6 @@
     "managedIdentity": "/subscriptions/30c56c3a-54da-46ea-b004-06eb33432687/resourceGroups/containerinsightsprod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ev2-agent-release",
     "agentRelease": "ciprod",
     "agentImageTagSuffix": "",
-    "cdpxLinuxTag": "",
-    "cdpxWindowsTag": "",
     "overrideTag": "false"
   },
   "Geographies": [
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml
deleted file mode 100644
index 454191ebc4..0000000000
--- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml
+++ /dev/null
@@ -1,108 +0,0 @@
-trigger: none
-resources:
-  pipelines:
-  - pipeline: build-artifacts
-    source: CDPX\docker-provider\ContainerInsights-MultiArch-MergedBranches
-  repositories:
-  - repository: templates
-    type: git
-    name: OneBranch.Pipelines/GovernedTemplates
-    ref: refs/heads/main
-parameters:
-- name: rolloutType
-  displayName: Rollout Type
-  type: string
-  default: normal
-  values:
-  - normal
-  - emergency
-  - globaloutage
-- name: overrideManagedValidationDuration
-  displayName: Override standard SDP duration?
-  type: boolean
-  default: false
-  values:
-  - true
-  - false
-- name: managedValidationOverrideDurationInHours
-  displayName: Managed validation override duration in hours
-  type: number
-  default: 0
-  values: 
-- name: icmIncidentId
-  displayName: ICM Incident Id
-  type: number
-  default: 0
-  values: 
-- name: ServiceRootPath
-  displayName: Service Root Path
-  type: string
-  default: $(Pipeline.Workspace)/build-artifacts/drop/build/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot
-  values: 
-- name: RolloutSpecPath
-  displayName: Rollout Spec Path
-  type: string
-  default: $(Pipeline.Workspace)/build-artifacts/drop/build/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json
-  values: 
-- name: select
-  displayName: Select
-  type: string
-  default: regions(*)
-  values: 
-variables:
-- name: agentImageTagSuffixValue
-  value: $(VAR_AGENT_IMAGE_TAG_SUFFIX)
-- name: cdpxLinuxTagValue
-  value: $(VAR_CDPX_LINUX_TAG)
-- name: cdpxWindowsTagValue
-  value: $(VAR_CDPX_WINDOWS_TAG)
-- name: overrideTagValue
-  value: $(VAR_OVERRIDE_TAG)
-- name: configurationOverrides
-  value: |
-    {
-      "ConfigurationSpecification": {
-        "Settings": {
-          "agentImageTagSuffix": "$(agentImageTagSuffixValue)",
-          "cdpxLinuxTag": "$(cdpxLinuxTagValue)",
-          "cdpxWindowsTag": "$(cdpxWindowsTagValue)",
-          "overrideTag": "$(overrideTagValue)"
-        }
-      }
-    }
-extends:
-  template: v2/OneBranch.Official.CrossPlat.yml@templates
-  parameters:
-    stages:
-    - stage: PROD_Prod_Managed_SDP
-      displayName: 'Production: Managed SDP'
-      dependsOn: []
-      variables:
-        ob_release_environment: Production
-      jobs:
-      - job: PROD_Prod_Managed_SDP
-        displayName: PROD_Prod_Managed_SDP
-        pool:
-          type: release
-        condition: 
-        dependsOn: 
-        steps:
-        - download: build-artifacts
-        - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2
-          displayName: Ev2 Managed SDP Rollout
-          inputs:
-            EndpointProviderType: ApprovalService
-            TaskAction: RegisterAndRollout
-            SkipRegistrationIfExists: True
-            ForceRegistration: true
-            ServiceRootPath: ${{parameters.ServiceRootPath}}
-            RolloutSpecPath: ${{parameters.RolloutSpecPath}}
-            StageMapName: Microsoft.Azure.SDP.Standard
-            Select: ${{parameters.select}}
-            ApprovalServiceEnvironment: Production
-            ConfigurationOverrides: $(configurationOverrides)
-    ev2ManagedSdpRolloutConfig:
-      rolloutType: ${{parameters.rolloutType}}
-      overrideManagedValidationDuration: ${{parameters.overrideManagedValidationDuration}}
-      managedValidationOverrideDurationInHours: ${{parameters.managedValidationOverrideDurationInHours}}
-      icmIncidentId: ${{parameters.icmIncidentId}}
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json
index 5af4623a6b..05aec0ccf4 100644
--- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json
+++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json
@@ -37,13 +37,9 @@
             "name": "AGENT_IMAGE_FULL_PATH",
             "value": "public/azuremonitor/containerinsights/__AGENT_RELEASE__:__AGENT_IMAGE_TAG_SUFFIX__"
           },
-          {
-            "name": "CDPX_TAG",
-            "value": "__CDPX_LINUX_TAG__"
-          },
           {
             "name": "SOURCE_IMAGE_FULL_PATH",
-            "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:__CDPX_LINUX_TAG__"
+            "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:__AGENT_IMAGE_TAG_SUFFIX__"
           },
           {
             "name": "OVERRIDE_TAG",
@@ -94,12 +90,60 @@
             "value": "public/azuremonitor/containerinsights/__AGENT_RELEASE__:win-__AGENT_IMAGE_TAG_SUFFIX__"
           },
           {
-            "name": "CDPX_TAG",
-            "value": "__CDPX_WINDOWS_TAG__"
+            "name": "SOURCE_IMAGE_FULL_PATH",
+            "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:win-__AGENT_IMAGE_TAG_SUFFIX__"
           },
           {
-            "name": "SOURCE_IMAGE_FULL_PATH",
-            "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:__CDPX_WINDOWS_TAG__"
+            "name": "OVERRIDE_TAG",
+            "value": "__OVERRIDE_TAG__"
+          }
+        ],
+        "identity": {
+          "type": "userAssigned",
+          "userAssignedIdentities": [
+            "__MANAGED_IDENTITY__"
+          ]
+        }
+      }
+    },
+    {
+      "name": "PushChartToACR",
+      "type": "ShellExtensionType",
+      "properties": {
+        "maxExecutionTime": "PT1H",
+        "useFallBackLocations": false,
+        "skipDeleteAfterExecution": false
+      },
+      "package": {
+        "reference": {
+          "path": "artifacts.tar.gz"
+        }
+      },
+      "launch": {
+        "command": [
+          "/bin/bash",
+          "pushChartToAcr.sh"
+        ],
+        "environmentVariables": [
+          {
+            "name": "ACR_NAME",
+            "value": "__ACR_NAME__"
+          },
+          {
+            "name": "AGENT_RELEASE",
+            "value": "__AGENT_RELEASE__"
+          },
+          {
+            "name": "AGENT_IMAGE_TAG_SUFFIX",
+            "value": "__AGENT_IMAGE_TAG_SUFFIX__"
+          },
+          {
+            "name": "SOURCE_CHART_FULL_PATH",
+            "value": "mcr.microsoft.com/azuremonitor/containerinsights/preview/azuremonitor-containers:__AGENT_IMAGE_TAG_SUFFIX__"
+          },
+          {
+            "name": "DEST_CHART_REPO",
+            "value": "public/azuremonitor/helmchart/containerinsights/__AGENT_RELEASE__/azuremonitor-containers"
           },
           {
             "name": "OVERRIDE_TAG",
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json
index 46feb4dd50..cba71d89fe 100644
--- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json
+++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json
@@ -34,7 +34,8 @@
       "targetName": "ShellExtension",
       "actions": [
         "shell/PushAgentToACR",
-        "shell/PushAgentToACR-1"
+        "shell/PushAgentToACR-1",
+        "shell/PushChartToACR"
       ],
       "dependsOn": []
     }
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json
index b6d8506b62..42f743229e 100644
--- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json
+++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json
@@ -21,14 +21,6 @@
           "find": "__MANAGED_IDENTITY__",
           "replaceWith": "$config(managedIdentity)"
         },
-        {
-          "find": "__CDPX_LINUX_TAG__",
-          "replaceWith": "$config(cdpxLinuxTag)"
-        },
-        {
-          "find": "__CDPX_WINDOWS_TAG__",
-          "replaceWith": "$config(cdpxWindowsTag)"
-        },
         {
           "find": "__OVERRIDE_TAG__",
           "replaceWith": "$config(overrideTag)"
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh
index 78047f55fe..95cc77e07c 100644
--- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh
+++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh
@@ -44,11 +44,6 @@ if [ -z $AGENT_IMAGE_FULL_PATH ]; then
   exit 1
 fi
 
-if [ -z $CDPX_TAG ]; then
-  echo "-e error value of CDPX_TAG shouldn't be empty. check release variables"
-  exit 1
-fi
-
 if [ -z $ACR_NAME ]; then
   echo "-e error value of ACR_NAME shouldn't be empty. check release variables"
   exit 1
diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh
new file mode 100644
index 0000000000..1e1758da77
--- /dev/null
+++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh
@@ -0,0 +1,110 @@
+#!/bin/bash
+set -e
+
+# Note - This script used in the pipeline as inline script
+#
+# Promotes the ama-logs Helm chart from cidev to the ciprod OCI registry, mirroring
+# pushAgentToAcr.sh (which promotes the agent container image). The build packages the
+# same chart and pushes it to cidev under two tags: <AGENT_IMAGE_TAG_SUFFIX> and
+# <AGENT_IMAGE_TAG_SUFFIX>-arc. This script copies both to ciprod under the same tag:
+#   cidev azuremonitor-containers:<AGENT_IMAGE_TAG_SUFFIX>      -> ciprod azuremonitor-containers:<AGENT_IMAGE_TAG_SUFFIX>       (AKS extension)
+#   cidev azuremonitor-containers:<AGENT_IMAGE_TAG_SUFFIX>-arc  -> ciprod azuremonitor-containers:<AGENT_IMAGE_TAG_SUFFIX>-arc   (Arc K8s extension)
+
+if [ -z $AGENT_IMAGE_TAG_SUFFIX ]; then
+  echo "-e error value of AGENT_IMAGE_TAG_SUFFIX variable shouldnt be empty. check release variables"
+  exit 1
+fi
+
+if [ -z $AGENT_RELEASE ]; then
+  echo "-e error AGENT_RELEASE shouldnt be empty. check release variables"
+  exit 1
+fi
+
+if [ -z $ACR_NAME ]; then
+  echo "-e error value of ACR_NAME shouldn't be empty. check release variables"
+  exit 1
+fi
+
+if [ -z $SOURCE_CHART_FULL_PATH ]; then
+  echo "-e error value of SOURCE_CHART_FULL_PATH shouldn't be empty. check release variables"
+  exit 1
+fi
+
+if [ -z $DEST_CHART_REPO ]; then
+  echo "-e error value of DEST_CHART_REPO shouldn't be empty. check release variables"
+  exit 1
+fi
+
+# MCR repo (without the ACR host / public prefix) used only for the overwrite check below.
+CHART_MCR_REPO="azuremonitor/helmchart/containerinsights/${AGENT_RELEASE}/azuremonitor-containers"
+
+# Make sure the chart tag being pushed will not overwrite an existing tag in mcr.
+# Unlike the agent image repo, the chart repo may not exist yet on the first ever
+# promotion, so tolerate a missing repo / failed lookup (treat as "tag not present").
+MCR_TAG_RESULT="$(wget -qO- https://mcr.microsoft.com/v2/${CHART_MCR_REPO}/tags/list || echo '')"
+
+TAG_EXISTS_STATUS=1 # Default: tag does not exist (safe to push)
+if [ -n "$MCR_TAG_RESULT" ]; then
+  if echo "$MCR_TAG_RESULT" | jq -e --arg t "$AGENT_IMAGE_TAG_SUFFIX" '.tags | index($t)' > /dev/null 2>&1; then
+    TAG_EXISTS_STATUS=0
+  fi
+fi
+
+echo "TAG_EXISTS_STATUS = $TAG_EXISTS_STATUS; OVERRIDE_TAG = $OVERRIDE_TAG"
+
+if [[ "$OVERRIDE_TAG" == "true" ]]; then
+  echo "OverrideTag set to true. Will override ${AGENT_IMAGE_TAG_SUFFIX} chart"
+elif [ "$TAG_EXISTS_STATUS" -eq 0 ]; then
+  echo "-e error chart ${AGENT_IMAGE_TAG_SUFFIX} already exists in mcr. make sure the chart tag is unique"
+  exit 1
+fi
+
+# Login to az cli and authenticate to acr
+echo "Login cli using managed identity"
+az login --identity
+if [ $? -eq 0 ]; then
+  echo "az logged in successfully"
+else
+  echo "-e error failed to login to az with managed identity credentials"
+  exit 1
+fi
+
+TOKEN=$(az acr login --name $ACR_NAME --expose-token --output tsv --query accessToken)
+if [ $? -eq 0 ]; then
+  echo "az acr logged in successfully with token"
+else
+  echo "-e error failed to login to az acr with managed identity credentials for containerinsights"
+  exit 1
+fi
+
+if [ "$OVERRIDE_TAG" == "true" ] || [ "$TAG_EXISTS_STATUS" -ne 0 ]; then
+  echo $TOKEN | oras login --password-stdin $ACR_NAME
+  if [ $? -eq 0 ]; then
+    echo "oras logged in successfully"
+  else
+    echo "-e error failed to login to oras with managed identity credentials for containerinsights"
+    exit 1
+  fi
+
+  SOURCE_CHART_ARC_FULL_PATH="${SOURCE_CHART_FULL_PATH}-arc"
+  DEST_CHART_FULL_PATH="${ACR_NAME}/${DEST_CHART_REPO}:${AGENT_IMAGE_TAG_SUFFIX}"
+  DEST_CHART_ARC_FULL_PATH="${ACR_NAME}/${DEST_CHART_REPO}:${AGENT_IMAGE_TAG_SUFFIX}-arc"
+
+  echo "Copying ${SOURCE_CHART_FULL_PATH} to ${DEST_CHART_FULL_PATH}"
+  oras copy -r $SOURCE_CHART_FULL_PATH $DEST_CHART_FULL_PATH
+  if [ $? -eq 0 ]; then
+    echo "Retagged and pushed AKS chart successfully"
+  else
+    echo "-e error failed to retag and push AKS chart to destination ACR"
+    exit 1
+  fi
+
+  echo "Copying ${SOURCE_CHART_ARC_FULL_PATH} to ${DEST_CHART_ARC_FULL_PATH}"
+  oras copy -r $SOURCE_CHART_ARC_FULL_PATH $DEST_CHART_ARC_FULL_PATH
+  if [ $? -eq 0 ]; then
+    echo "Retagged and pushed Arc chart successfully"
+  else
+    echo "-e error failed to retag and push Arc chart to destination ACR"
+    exit 1
+  fi
+fi
diff --git a/kubernetes/linux/Dockerfile.multiarch b/kubernetes/linux/Dockerfile.multiarch
index 45e8105463..d67d59f373 100644
--- a/kubernetes/linux/Dockerfile.multiarch
+++ b/kubernetes/linux/Dockerfile.multiarch
@@ -75,8 +75,9 @@ ENV KUBE_CLIENT_BACKOFF_BASE 1
 ENV KUBE_CLIENT_BACKOFF_DURATION 0
 ENV RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR 1.0
 
-# default value will be overwritten by pipeline
-ARG IMAGE_TAG=3.4.0
+# default value is a non-release placeholder; the real version is injected by the
+# build pipeline via --build-arg IMAGE_TAG=<SEMVER>
+ARG IMAGE_TAG=0.0.0-dev
 ENV AGENT_VERSION ${IMAGE_TAG}
 
 WORKDIR ${tmpdir}
diff --git a/kubernetes/windows/Dockerfile b/kubernetes/windows/Dockerfile
index 4ac70a81a7..4360e6d93c 100644
--- a/kubernetes/windows/Dockerfile
+++ b/kubernetes/windows/Dockerfile
@@ -103,8 +103,9 @@ COPY ./amalogswindows/installer/scripts/rubyKeepCertificateAlive/*.rb /etc/fluen
 #Copy fluentd ruby plugins
 COPY ./amalogswindows/ruby/ /etc/fluent/plugin/
 
-# default value will be overwritten by pipeline
-ARG IMAGE_TAG=win-3.4.0
+# default value is a non-release placeholder; the real version is injected by the
+# build pipeline via --build-arg IMAGE_TAG=win-<SEMVER>
+ARG IMAGE_TAG=win-0.0.0-dev
 ENV AGENT_VERSION ${IMAGE_TAG}
 
 ENV OS_TYPE "windows"