diff --git a/deploy_carvel/.gitignore b/deploy_carvel/.gitignore
index 6e5e67eb..393a4d4c 100644
--- a/deploy_carvel/.gitignore
+++ b/deploy_carvel/.gitignore
@@ -1 +1,14 @@
+# package_repository/packages/{pkg}/ contains specific SHAs of images
+# we are using 0.0.0- to indicate dev versions of images
 *0.0.0*
+
+# pkginstall.yml files contain specific SHAs of images
+concierge-pkginstall.yml
+local-user-authenticator-pkginstall.yml
+supervisor-pkginstall.yml
+
+# images.yml files contain specific SHAs of images
+concierge/.imgpkg/images.yml
+supervisor/.imgpkg/images.yml
+local-user-authenticator/.imgpkg/images.yml
+package_repository/.imgpkg/images.yml
diff --git a/deploy_carvel/concierge-pkginstall.yml b/deploy_carvel/concierge-pkginstall.yml
deleted file mode 100644
index 1da4bf1c..00000000
--- a/deploy_carvel/concierge-pkginstall.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-apiVersion: packaging.carvel.dev/v1alpha1
-kind: PackageInstall
-metadata:
-    # name, does not have to be versioned, versionSelection.constraints below will handle
-    name: "concierge-package-install"
-    namespace: "concierge-install-ns"
-spec:
-  serviceAccountName: "pinniped-package-rbac-concierge-sa-superadmin-dangerous"
-  packageRef:
-    refName: "concierge.pinniped.dev"
-    versionSelection:
-      constraints: "0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D"
-  values:
-  - secretRef:
-      name: "concierge-package-install-secret"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "concierge-package-install-secret"
-  namespace: "concierge-install-ns"
-stringData:
-  values.yml: |
-    ---
-    app_name: pinniped-concierge
-    namespace: concierge
-    api_group_suffix: pinniped.dev
-    log_level: debug
-
-    image_repo: kind-registry.local:5000/test/build
-    image_tag: 0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
diff --git a/deploy_carvel/local-user-authenticator-pkginstall.yml b/deploy_carvel/local-user-authenticator-pkginstall.yml
deleted file mode 100644
index 2de09a06..00000000
--- a/deploy_carvel/local-user-authenticator-pkginstall.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-apiVersion: packaging.carvel.dev/v1alpha1
-kind: PackageInstall
-metadata:
-    # name, does not have to be versioned, versionSelection.constraints below will handle
-    name: "local-user-authenticator-package-install"
-    namespace: "local-user-authenticator-install-ns"
-spec:
-  serviceAccountName: "pinniped-package-rbac-local-user-authenticator-sa-superadmin-dangerous"
-  packageRef:
-    refName: "local-user-authenticator.pinniped.dev"
-    versionSelection:
-      constraints: "0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D"
-  values:
-  - secretRef:
-      name: "local-user-authenticator-package-install-secret"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "local-user-authenticator-package-install-secret"
-  namespace: "local-user-authenticator-install-ns"
-stringData:
-  values.yml: |
-    ---
-    image_repo: kind-registry.local:5000/test/build
-    image_tag: 0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
diff --git a/deploy_carvel/package_repository/.imgpkg/images.yml b/deploy_carvel/package_repository/.imgpkg/images.yml
deleted file mode 100644
index bc04629b..00000000
--- a/deploy_carvel/package_repository/.imgpkg/images.yml
+++ /dev/null
@@ -1,25 +0,0 @@
----
-apiVersion: imgpkg.carvel.dev/v1alpha1
-images:
-- annotations:
-    kbld.carvel.dev/id: kind-registry.local:5000/test/build/test/build-package-concierge:0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-    kbld.carvel.dev/origins: |
-      - resolved:
-          tag: 0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-          url: kind-registry.local:5000/test/build/test/build-package-concierge:0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-  image: kind-registry.local:5000/test/build/test/build-package-concierge@sha256:ffc8371ff94e939233af0643476a597c025adb5609cc35c5ded6bd67ce13fdec
-- annotations:
-    kbld.carvel.dev/id: kind-registry.local:5000/test/build/test/build-package-local-user-authenticator:0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-    kbld.carvel.dev/origins: |
-      - resolved:
-          tag: 0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-          url: kind-registry.local:5000/test/build/test/build-package-local-user-authenticator:0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-  image: kind-registry.local:5000/test/build/test/build-package-local-user-authenticator@sha256:4f111f27ecf38622e4cbb29ce1d88589b488d8eb57d9b29cb577d64a417a2c4c
-- annotations:
-    kbld.carvel.dev/id: kind-registry.local:5000/test/build/test/build-package-supervisor:0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-    kbld.carvel.dev/origins: |
-      - resolved:
-          tag: 0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-          url: kind-registry.local:5000/test/build/test/build-package-supervisor:0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-  image: kind-registry.local:5000/test/build/test/build-package-supervisor@sha256:f3ceb23f0202c83955f4ad1a7836325340da25ebb6d2e14f02a66e915b4e09f5
-kind: ImagesLock
diff --git a/deploy_carvel/supervisor-pkginstall.yml b/deploy_carvel/supervisor-pkginstall.yml
deleted file mode 100644
index 9de43f13..00000000
--- a/deploy_carvel/supervisor-pkginstall.yml
+++ /dev/null
@@ -1,35 +0,0 @@
----
-apiVersion: packaging.carvel.dev/v1alpha1
-kind: PackageInstall
-metadata:
-    # name, does not have to be versioned, versionSelection.constraints below will handle
-    name: "supervisor-package-install"
-    namespace: "supervisor-install-ns"
-spec:
-  serviceAccountName: "pinniped-package-rbac-supervisor-sa-superadmin-dangerous"
-  packageRef:
-    refName: "supervisor.pinniped.dev"
-    versionSelection:
-      constraints: "0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D"
-  values:
-  - secretRef:
-      name: "supervisor-package-install-secret"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "supervisor-package-install-secret"
-  namespace: "supervisor-install-ns"
-stringData:
-  values.yml: |
-    ---
-    app_name: pinniped-supervisor
-    namespace: supervisor
-    api_group_suffix: pinniped.dev
-    image_repo: kind-registry.local:5000/test/build
-    image_tag: 0.0.0-B0EC99E6-F598-42A9-8976-DFCE049C768D
-    log_level: debug
-
-    service_https_nodeport_port: 443
-    service_https_nodeport_nodeport: 31243
-    service_https_clusterip_port: 443