diff --git a/ansible/roles/tsg-cm/files/tsg-cm-chart-0.1.0.tgz b/ansible/roles/tsg-cm/files/tsg-cm-chart-0.1.0.tgz
new file mode 100644
index 00000000..f00fb122
Binary files /dev/null and b/ansible/roles/tsg-cm/files/tsg-cm-chart-0.1.0.tgz differ
diff --git a/ansible/roles/tsg-cm/tasks/main.yml b/ansible/roles/tsg-cm/tasks/main.yml
new file mode 100644
index 00000000..c3fd0656
--- /dev/null
+++ b/ansible/roles/tsg-cm/tasks/main.yml
@@ -0,0 +1,3 @@
+---
+- name: "testing tsg-cm role"
+  shell: echo "testing"
\ No newline at end of file
diff --git a/installer/app_bundle_install.sh b/installer/app_bundle_install.sh
index e0be8440..de56f5f7 100644
--- a/installer/app_bundle_install.sh
+++ b/installer/app_bundle_install.sh
@@ -6,6 +6,8 @@ INJECT_HELM_CHART_TAR="%%INJECT_HELM_CHART_TAR%%"
 MRZCPD_HELM_CHART_TAR="%%MRZCPD_HELM_CHART_TAR%%"
 TREX_HELM_CHART_TAR="%%TREX_HELM_CHART_TAR%%"
 DP_TRACE_HELM_CHART_TAR="%%DP_TRACE_HELM_CHART_TAR%%"
+TSG_CM_HELM_CHART_TAR="%%TSG_CM_HELM_CHART_TAR%%"
+TSG_CM_CONTAINER_IMAGE_TAR="%%TSG_CM_CONTAINER_IMAGE_TAR%%"
 
 charts_dest_dir="/var/lib/rancher/k3s/server/static/charts"
 images_dest_dir="/var/lib/rancher/k3s/agent/images"
@@ -90,6 +92,12 @@ function load_images()
 
 #function define end
 
+function install_tsg_cm()
+{
+    sed -ie "s/^tsg_cm_chart_name=.*/tsg_cm_chart_name=${TSG_CM_HELM_CHART_TAR}/g" ${clixon_conf_path}
+    cp -r ${src_dir}/${TSG_CM_HELM_CHART_TAR}      ${charts_dest_dir}
+    cp -r ${src_dir}/${TSG_CM_CONTAINER_IMAGE_TAR} ${images_dest_dir}
+}
 #function exec start
 read_charts_dest_dir_from_env
 read_images_dest_dir_from_env
@@ -99,5 +107,6 @@ read_load_images_switch_from_env
 copy_charts_to_dest
 copy_images_to_dest
 replace_clixon_chart_name
+install_tsg_cm
 load_images
 #function exec end
diff --git a/make/Makefile.x86_64_COTS_APP_BUNDLE b/make/Makefile.x86_64_COTS_APP_BUNDLE
index 3d83203d..e7a573d0 100644
--- a/make/Makefile.x86_64_COTS_APP_BUNDLE
+++ b/make/Makefile.x86_64_COTS_APP_BUNDLE
@@ -24,8 +24,11 @@ DP_TRACE_HELM_FILE_PATH         := /ansible/roles/dp-trace-telemetry/files/helm
 NIC_UIO_BINDER_FILE_PATH        := /ansible/roles/k3s-install/files/nic-uio-binder.yaml
 LOG_COLLECTOR_FILE_PATH        := /ansible/roles/k3s-install/files/log-collector.yaml
 
+TSG_CM_CONTAINER_IMAGE_TAR      := tsg-cm-${OS_RELEASE_VER}-docker.tar
+TSG_CM_HELM_CHART_TAR           := tsg-cm-chart-0.1.0.tgz
 
-.PHONY: all build_dir installer clean_installer_dir prebuild_container_images build_container_images build_helm_charts build_app_bundle_bin 
+
+.PHONY: all build_dir installer clean_installer_dir prebuild_container_images build_container_images build_helm_charts build_app_bundle_bin pull_tsg_cm
 
 all: build_app_bundle_bin
 
@@ -50,6 +53,8 @@ installer: build_dir
 	sed -i -e "s/%%HELM_CHART_TAR_GLOB%%/$(HELM_CHART_TAR_GLOB)/" $(TARGET_INSTALLER_DIR)/install.sh
 	sed -i -e "s/%%NIC_UIO_BINDER_IMAGE_TAR%%/$(NIC_UIO_BINDER_IMAGE_TAR)/" $(PROJECTDIR)/$(NIC_UIO_BINDER_FILE_PATH)
 	sed -i -e "s/%%LOG_COLLECTOR_IMAGE_TAR%%/$(LOG_COLLECTOR_IMAGE_TAR)/" $(PROJECTDIR)/$(LOG_COLLECTOR_FILE_PATH)
+	sed -i -e "s/%%TSG_CM_HELM_CHART_TAR%%/$(TSG_CM_HELM_CHART_TAR)/" $(TARGET_INSTALLER_DIR)/install.sh
+	sed -i -e "s/%%TSG_CM_CONTAINER_IMAGE_TAR%%/$(TSG_CM_CONTAINER_IMAGE_TAR)/" $(TARGET_INSTALLER_DIR)/install.sh
 
 prebuild_container_images:
 ifeq ($(ENABLE_LICENSE_PROTECTED),1)
@@ -73,7 +78,11 @@ build_helm_charts: build_dir
 	$(PROJECTDIR)/tools/build_helm_charts.sh $(PROJECTDIR) $(OS_RELEASE_VER) $(HELM_CHART_VER) $(TARGET_INSTALLER_DIR) $(TREX_HELM_FILE_PATH)
 	$(PROJECTDIR)/tools/build_helm_charts.sh $(PROJECTDIR) $(OS_RELEASE_VER) $(HELM_CHART_VER) $(TARGET_INSTALLER_DIR) $(DP_TRACE_HELM_FILE_PATH)
 
-build_app_bundle_bin: clean_installer_dir installer build_helm_charts build_container_images
+pull_tsg_cm: build_dir
+	chmod 0755 $(PROJECTDIR)/tools/build_helm_charts.sh; $(PROJECTDIR)/tools/pull_container_images.sh $(TARGET_INSTALLER_DIR) $(TSG_CM_CONTAINER_IMAGE_TAR)
+	cp -a $(PROJECTDIR)/ansible/roles/tsg-cm/files/$(TSG_CM_HELM_CHART_TAR) $(TARGET_INSTALLER_DIR)
+
+build_app_bundle_bin: clean_installer_dir installer build_helm_charts pull_tsg_cm build_container_images
 	mkdir -p $(TARGET_BUILD_DIR)/app-bundle-cook-bits
 	chmod 0755 $(TOOLSDIR)/app-bundle-cook-bits
 	$(TOOLSDIR)/app-bundle-cook-bits $(TARGET_BUILD_DIR) $(TARGET_BUILD_DIR)/app-bundle-cook-bits $(IMAGEDIR_BASE)/$(APP_BUNDLE_BIN)
diff --git a/tools/pull_container_images.sh b/tools/pull_container_images.sh
new file mode 100644
index 00000000..6324a829
--- /dev/null
+++ b/tools/pull_container_images.sh
@@ -0,0 +1,25 @@
+#!/bin/sh -e
+EXPORT_IMAGES_DIR=$1
+EXPORT_IMAGES_NAME=$2
+
+TSG_CM_REGISTRY_SERVER="ci1.bj.geedge.net"
+
+TSG_CM_REGISTRY="${TSG_CM_REGISTRY_SERVER}/tsg/cm/tsg-cm"
+TSG_CM_IMAGE_TAG="api_v24.09_2024083006"
+
+TSG_CM_MARIADB_REGISTRY="${TSG_CM_REGISTRY_SERVER}/common/mariadb"
+TSG_CM_MARIADB_IMAGE_TAG="10.11.8"
+
+TSG_CM_POLICY_VERIFY_REGISTRY="${TSG_CM_REGISTRY_SERVER}/tsg/cm/cm-verify"
+TSG_CM_POLICY_VERIFY_IMAGE_TAG="tsg_v24.09_2024082801"
+
+buildah login -u ${TSG_CM_IMAGE_REGISTRY_AUTH_USERNAME} -p ${TSG_CM_IMAGE_REGISTRY_AUTH_PASSWORD} ${TSG_CM_REGISTRY_SERVER}
+
+buildah pull ${TSG_CM_REGISTRY}:${TSG_CM_IMAGE_TAG}
+buildah pull ${TSG_CM_MARIADB_REGISTRY}:${TSG_CM_MARIADB_IMAGE_TAG}
+buildah pull ${TSG_CM_POLICY_VERIFY_REGISTRY}:${TSG_CM_POLICY_VERIFY_IMAGE_TAG}
+
+podman save -o ${EXPORT_IMAGES_DIR}/${EXPORT_IMAGES_NAME}  -m \
+        ${TSG_CM_REGISTRY}:${TSG_CM_IMAGE_TAG} \
+        ${TSG_CM_MARIADB_REGISTRY}:${TSG_CM_MARIADB_IMAGE_TAG} \
+        ${TSG_CM_POLICY_VERIFY_REGISTRY}:${TSG_CM_POLICY_VERIFY_IMAGE_TAG}