diff --git a/deploy/k8s/templates/deployment.yaml b/deploy/k8s/templates/deployment.yaml
index f183177..71a45b7 100644
--- a/deploy/k8s/templates/deployment.yaml
+++ b/deploy/k8s/templates/deployment.yaml
@@ -65,6 +65,10 @@ spec:
               value: {{ .Values.sandbox.k8s.namespace | quote }}
             - name: SANDCASTLE_ROOK_URL
               value: {{ .Values.sandbox.k8s.rookUrl | default (printf "ws://%s.%s.svc.cluster.local:%d/rook/ws" (include "sandcastle.fullname" .) .Release.Namespace (.Values.port | int)) | quote }}
+            {{- if .Values.sandbox.k8s.image }}
+            - name: SANDCASTLE_K8S_IMAGE
+              value: {{ .Values.sandbox.k8s.image | quote }}
+            {{- end }}
             {{- end }}
             {{- if .Values.secretBackend.gcpProjectId }}
             - name: GCP_PROJECT_ID
diff --git a/deploy/k8s/values.yaml b/deploy/k8s/values.yaml
index d5879a4..82ceca1 100644
--- a/deploy/k8s/values.yaml
+++ b/deploy/k8s/values.yaml
@@ -54,6 +54,8 @@ sandbox:
     enabled: false
     # Namespace where sandbox pods are created.
     namespace: "sandcastle-sandboxes"
+    # Container image used for sandbox pods (SANDCASTLE_K8S_IMAGE). Defaults to sandcastle's built-in default when empty.
+    image: ""
     # URL that rook pods use to connect back to sandcastle. Leave empty to auto-compute
     # from the release name, namespace, and port (recommended for in-cluster deployments).
     rookUrl: ""