diff --git a/README.md b/README.md
index e93f0f6..f0d236f 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
 ![Go Version](https://img.shields.io/badge/go-1.24-00ADD8?logo=go&logoColor=white)
 [![Discord](https://img.shields.io/badge/Discord-Join%20us-5865F2?logo=discord&logoColor=white)](https://discord.gg/7WTUuFqyS6)
 
-Run GPU workloads on any NeoCloud or hyperscaler through one Kubernetes API.
+Run GPU workloads on any NeoCloud or hyperscaler or your own infrastructure through one Kubernetes API.
 
 </div>
 
@@ -22,6 +22,10 @@ per-cloud glue. The API follows a Karpenter-style split:
 - **NodeClaim** — one provisioned instance and its lifecycle, held by a finalizer
   so a paid instance is never leaked.
 
+<p align="center">
+  <img src="site/images/arch.png" alt="Nebula architecture: the operator's webhook, virtual kubelet and placement controller drive NodePools and NodeClaims onto hyperscalers, NeoClouds, Kubernetes clusters and on-prem servers" width="90%">
+</p>
+
 ## How it works
 
 1. **Opt in.** You label a Pod to request an accelerator.
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index 444da50..10c9841 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -65,6 +65,7 @@ spec:
           - --health-probe-bind-address=:8081
         image: controller:latest
         name: manager
+        imagePullPolicy: IfNotPresent
         env:
           # Point the price catalog at the mounted ConfigMap so prices can be
           # edited live (kubectl edit configmap nebula-catalog) without a
diff --git a/site/images/arch.png b/site/images/arch.png
new file mode 100644
index 0000000..abc58a0
Binary files /dev/null and b/site/images/arch.png differ