diff --git a/charts/backstage/values.schema.json b/charts/backstage/values.schema.json
index c7af3cb4..81034718 100644
--- a/charts/backstage/values.schema.json
+++ b/charts/backstage/values.schema.json
@@ -4632,7 +4632,7 @@
                                     "type": "string"
                                 },
                                 "tag": {
-                                    "default": "next",
+                                    "default": "next-1.9",
                                     "description": "Immutable tags are recommended.",
                                     "title": "Backstage image tag",
                                     "type": "string"
diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml
index 18a1cb91..9a2df323 100644
--- a/charts/backstage/values.yaml
+++ b/charts/backstage/values.yaml
@@ -1,5 +1,4 @@
 nameOverride: developer-hub
-
 global:
   dynamic:
     # -- Array of YAML files listing dynamic plugins to include with those listed in the `plugins` field.
@@ -8,13 +7,11 @@ global:
       # -- List of dynamic plugins included inside the `rhdh` container image, some of which are disabled by default.
       # This file ONLY works with the `rhdh` container image.
       - "dynamic-plugins.default.yaml"
-
     # -- List of dynamic plugins, possibly overriding the plugins listed in `includes` files.
     # Every item defines the plugin `package` as a [NPM package spec](https://docs.npmjs.com/cli/v10/using-npm/package-spec),
     # an optional `pluginConfig` with plugin-specific backstage configuration, and an optional `disabled` flag to disable/enable a plugin
     # listed in `includes` files. It also includes an `integrity` field that is used to verify the plugin package [integrity](https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description).
     plugins: []
-
   # -- Shorthand for users who do not want to specify a custom HOSTNAME. Used ONLY with the DEFAULT upstream.backstage.appConfig value and with OCP Route enabled.
   clusterRouterBase: "apps.example.com"
   # -- Custom hostname shorthand, overrides `global.clusterRouterBase`, `upstream.ingress.host`, `route.host`, and url values in `upstream.backstage.appConfig`.
@@ -30,7 +27,6 @@ global:
       existingSecret: ""
       # -- Instead of generating a secret value, use the following value
       value: ""
-
   # -- Catalog index configuration for automatic plugin discovery.
   # The `install-dynamic-plugins.py` script pulls this image if the `CATALOG_INDEX_IMAGE` environment variable is set.
   # The `dynamic-plugins.default.yaml` file will be extracted and written to `dynamic-plugins-root` volume mount.
@@ -39,7 +35,6 @@ global:
       registry: quay.io
       repository: rhdh/plugin-catalog-index
       tag: "1.9"
-
 # -- Upstream Backstage [chart configuration](https://github.com/backstage/charts/blob/main/charts/backstage/values.yaml)
 # @default -- Use Openshift compatible settings
 upstream:
@@ -48,7 +43,7 @@ upstream:
     image:
       registry: quay.io
       repository: rhdh-community/rhdh
-      tag: next
+      tag: next-1.9
       pullPolicy: ""
     command: []
     # FIXME (tumido): USE POSTGRES_PASSWORD and POSTGRES_USER instead of POSTGRES_ADMIN_PASSWORD
@@ -258,8 +253,7 @@ upstream:
     installDir: /opt/app-root/src
     podAnnotations:
       checksum/dynamic-plugins: >-
-        {{- include "common.tplvalues.render" ( dict "value"
-        .Values.global.dynamic "context" $) | sha256sum }}
+        {{- include "common.tplvalues.render" ( dict "value" .Values.global.dynamic "context" $) | sha256sum }}
   ingress:
     host: "{{ .Values.global.host }}"
   metrics:
@@ -313,71 +307,53 @@ upstream:
       - name: http-metrics
         port: 9464
         targetPort: 9464
-
 # -- OpenShift Route parameters
 route:
   # -- Route specific annotations
   annotations: {}
-
   # -- Enable the creation of the route resource
   enabled: true
-
   # -- Set the host attribute to a custom value. If not set, OpenShift will generate it, please make sure to match your baseUrl
   host: "{{ .Values.global.host }}"
-
   # -- Path that the router watches for, to route traffic for to the service.
   path: "/"
-
   # -- Wildcard policy if any for the route. Currently only 'Subdomain' or 'None' is allowed.
   wildcardPolicy: None
-
   # -- Route TLS parameters
   # <br /> Ref: https://docs.openshift.com/container-platform/4.9/networking/routes/secured-routes.html
   tls:
     # -- Enable TLS configuration for the host defined at `route.host` parameter
     enabled: true
-
     # -- Specify TLS termination.
     termination: "edge"
-
     # -- Certificate contents
     certificate: ""
-
     # -- Key file contents
     key: ""
-
     # -- Cert authority certificate contents. Optional
     caCertificate: ""
-
     # -- Contents of the ca certificate of the final destination.
     # <br /> When using reencrypt termination this file should be provided in order to have routers use it for health checks on the secure connection. If this field is not specified, the router may provide its own destination CA and perform hostname validation using the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically verify.
     destinationCACertificate: ""
-
     # --  Indicates the desired behavior for insecure connections to a route.
     # <br /> While each router may make its own decisions on which ports to expose, this is normally port 80. The only valid values are None, Redirect, or empty for disabled.
     insecureEdgeTerminationPolicy: "Redirect"
-
 # -- Test pod parameters
 test:
   # -- Whether to enable the test-connection pod used for testing the Release using `helm test`.
   enabled: true
-
   image:
     # -- Test connection pod image registry
     registry: quay.io
-
     # -- Test connection pod image repository. Note that the image needs to have both the `sh` and `curl` binaries in it.
     repository: curl/curl
-
     # -- Test connection pod image tag. Note that the image needs to have both the `sh` and `curl` binaries in it.
     tag: latest
-
   # -- Whether to inject a fake dynamic plugins npmrc secret.
   # <br />See RHDHBUGS-1893 and RHDHBUGS-1464 for the motivation behind this.
   # <br />This is only used for testing purposes and should not be used in production.
   # <br />Only relevant when `test.enabled` field is set to `true`.
   injectTestNpmrcSecret: false
-
 orchestrator:
   enabled: false
   #  Disable Serverless Logic Operator if it already exists on the cluster
@@ -402,28 +378,20 @@ orchestrator:
         cpu: "500m"
     # -- Secret name for the user-created secret to connect an external DB
     externalDBsecretRef: ""
-
     # -- Name for the user-configured external Database
     externalDBName: ""
-
     # -- Host for the user-configured external Database
     externalDBHost: ""
-
     # -- Port for the user-configured external Database
     externalDBPort: ""
-
     # -- Image for the init container used by the create-db job
     initContainerImage: "{{ .Values.upstream.postgresql.image.registry }}/{{ .Values.upstream.postgresql.image.repository }}:{{ .Values.upstream.postgresql.image.tag }}"
-
     # -- Image for the container used by the create-db job
     createDBJobImage: "{{ .Values.upstream.postgresql.image.registry }}/{{ .Values.upstream.postgresql.image.repository }}:{{ .Values.upstream.postgresql.image.tag }}"
-
     # -- Image for the container used by the sonataflow jobs service, optional and used for disconnected environments
     jobServiceImage: ""
-
     # -- Image for the container used by the sonataflow data index, optional and used for disconnected environments
     dataIndexImage: ""
-
   # -- Orchestrator plugins and their configuration
   plugins:
     # RHDHBUGS-1464: Note that the plugins here fetch the packages from their direct HTTP download URLs from the (official) Red Hat NPM Registry.