diff --git a/controllers/envoy_gateway_extension_reconciler.go b/controllers/envoy_gateway_extension_reconciler.go
index c3b5d5992..a40d2a27a 100644
--- a/controllers/envoy_gateway_extension_reconciler.go
+++ b/controllers/envoy_gateway_extension_reconciler.go
@@ -55,7 +55,7 @@ func (r *EnvoyGatewayExtensionReconciler) Subscription() controller.Subscription
 func (r *EnvoyGatewayExtensionReconciler) Reconcile(ctx context.Context, _ []controller.ResourceEvent, topology *machinery.Topology, _ error, state *sync.Map) error {
 	logger := controller.LoggerFromContext(ctx).WithName("EnvoyGatewayExtensionReconciler")
 
-	logger.V(1).Info("building envoy gateway extension")
+	logger.V(1).Info("building envoy gateway extension", "image url", WASMFilterImageURL)
 	defer logger.V(1).Info("finished building envoy gateway extension")
 
 	// build wasm plugin configs for each gateway
@@ -304,7 +304,7 @@ func equalEnvoyExtensionPolicies(a, b *envoygatewayv1alpha1.EnvoyExtensionPolicy
 
 	return len(aWasms) == len(bWasms) && lo.EveryBy(aWasms, func(aWasm envoygatewayv1alpha1.Wasm) bool {
 		return lo.SomeBy(bWasms, func(bWasm envoygatewayv1alpha1.Wasm) bool {
-			if ptr.Deref(aWasm.Name, "") != ptr.Deref(bWasm.Name, "") || ptr.Deref(aWasm.RootID, "") != ptr.Deref(bWasm.RootID, "") || ptr.Deref(aWasm.FailOpen, false) != ptr.Deref(bWasm.FailOpen, false) || aWasm.Code.Type != bWasm.Code.Type || aWasm.Code.Image.URL != bWasm.Code.Image.URL {
+			if ptr.Deref(aWasm.Name, "") != ptr.Deref(bWasm.Name, "") || ptr.Deref(aWasm.RootID, "") != ptr.Deref(bWasm.RootID, "") || ptr.Deref(aWasm.FailOpen, false) != ptr.Deref(bWasm.FailOpen, false) || aWasm.Code.Type != bWasm.Code.Type || aWasm.Code.Image.URL != bWasm.Code.Image.URL || ptr.Deref(aWasm.Code.Image.PullSecretRef, gwapiv1b1.SecretObjectReference{}) != ptr.Deref(aWasm.Code.Image.PullSecretRef, gwapiv1b1.SecretObjectReference{}) {
 				return false
 			}
 			aConfig, err := wasm.ConfigFromJSON(aWasm.Config)
diff --git a/controllers/istio_extension_reconciler.go b/controllers/istio_extension_reconciler.go
index 23710b9d4..8bc1943e7 100644
--- a/controllers/istio_extension_reconciler.go
+++ b/controllers/istio_extension_reconciler.go
@@ -54,7 +54,7 @@ func (r *IstioExtensionReconciler) Subscription() controller.Subscription {
 func (r *IstioExtensionReconciler) Reconcile(ctx context.Context, _ []controller.ResourceEvent, topology *machinery.Topology, _ error, state *sync.Map) error {
 	logger := controller.LoggerFromContext(ctx).WithName("IstioExtensionReconciler")
 
-	logger.V(1).Info("building istio extension")
+	logger.V(1).Info("building istio extension ", "image url", WASMFilterImageURL)
 	defer logger.V(1).Info("finished building istio extension")
 
 	// build wasm plugin configs for each gateway
@@ -115,7 +115,7 @@ func (r *IstioExtensionReconciler) Reconcile(ctx context.Context, _ []controller
 			}
 			continue
 		}
-
+		logger.V(1).Info("wasmplugin object ", "desired", desiredWasmPlugin)
 		if equalWasmPlugins(existingWasmPlugin, desiredWasmPlugin) {
 			logger.V(1).Info("wasmplugin object is up to date, nothing to do")
 			continue
@@ -126,6 +126,7 @@ func (r *IstioExtensionReconciler) Reconcile(ctx context.Context, _ []controller
 		existingWasmPlugin.Spec.Phase = desiredWasmPlugin.Spec.Phase
 		existingWasmPlugin.Spec.TargetRefs = desiredWasmPlugin.Spec.TargetRefs
 		existingWasmPlugin.Spec.PluginConfig = desiredWasmPlugin.Spec.PluginConfig
+		existingWasmPlugin.Spec.ImagePullSecret = desiredWasmPlugin.Spec.ImagePullSecret
 
 		existingWasmPluginUnstructured, err := controller.Destruct(existingWasmPlugin)
 		if err != nil {
@@ -284,7 +285,7 @@ func buildIstioWasmPluginForGateway(gateway *machinery.Gateway, wasmConfig wasm.
 }
 
 func equalWasmPlugins(a, b *istioclientgoextensionv1alpha1.WasmPlugin) bool {
-	if a.Spec.Url != b.Spec.Url || a.Spec.Phase != b.Spec.Phase || !kuadrantistio.EqualTargetRefs(a.Spec.TargetRefs, b.Spec.TargetRefs) {
+	if a.Spec.ImagePullSecret != b.Spec.ImagePullSecret || a.Spec.Url != b.Spec.Url || a.Spec.Phase != b.Spec.Phase || !kuadrantistio.EqualTargetRefs(a.Spec.TargetRefs, b.Spec.TargetRefs) {
 		return false
 	}