diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7cf83e611..825105899 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -76,8 +76,8 @@ workflows:
           context: &docker-hub-context
             - docker-hub
           filters: &filters-publish
-            branches:
-              ignore: /pull\/[0-9]+/
+            # publish everything `SHOULD_PUBLISH` variable will determine if
+            # images are tagged as latest or a helm chart published
             tags:
               only: /.*/
           requires:
@@ -141,7 +141,7 @@ workflows:
             - pre-commit
 
       - publish-helm-chart:
-          filters: &filters-publish
+          filters: &filters-publish-chart
             branches:
               only:
                 - main
@@ -438,11 +438,6 @@ jobs:
           at: /tmp/ci/workspace
       - run: cat workspace/env-vars >> $BASH_ENV
       - run: cat workspace/should-publish >> $BASH_ENV
-      - run:
-          name: 'Check if should proceed'
-          command: |
-            [[ "${SHOULD_PUBLISH}" != true ]] && echo "Should not publish, stopping" && circleci-agent step halt
-            echo 'Proceeding with publish'
       - setup_remote_docker:
           # a weird issue with yarn installing packages throwing EPERM errors
           # this fixes it
@@ -545,6 +540,11 @@ jobs:
       - add_ssh_keys:
           fingerprints:
             - '9a:57:23:d4:c9:5f:4d:83:d6:fa:b2:00:6b:8d:86:31'
+      - run:
+          name: 'Check if should proceed'
+          command: |
+            [[ "${SHOULD_PUBLISH}" != true ]] && echo "Should not publish, stopping" && circleci-agent step halt
+            echo 'Proceeding with publish'
       - run:
           name: Publish Helm Chart
           command: ./.circleci/publish_helm_chart.sh
diff --git a/.circleci/publish.sh b/.circleci/publish.sh
index b7a915db8..e2f327294 100755
--- a/.circleci/publish.sh
+++ b/.circleci/publish.sh
@@ -3,26 +3,23 @@ set -eo pipefail
 
 SHOULD_PUBLISH="${SHOULD_PUBLISH:-false}"
 
-if [[ "${SHOULD_PUBLISH}" != "true" ]]; then
-  echo "Not publishing as the SHOULD_PUBLISH environment variable is not 'true'."
-  exit 0
-fi
-
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 # shellcheck disable=SC1090,SC1091
 source "${SCRIPT_DIR}/common.sh"
 
-echo "Publishing: ${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}"
-
-echo "💾 Loading image"
+echo "💾 Loading image: ${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}"
 docker load --input "/tmp/ci/workspace/${DOCKER_FILE_NAME}"
 
-echo "🐳 Publishing image"
-docker tag "${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}" "${DOCKER_IMAGE_TAG}:latest"
+if [[ "${SHOULD_PUBLISH}" == "true" ]]; then
+  echo "🐳 Tagging image as '${DOCKER_IMAGE_TAG}:latest'"
+  docker tag "${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}" "${DOCKER_IMAGE_TAG}:latest"
 
-if [[ "${IMAGE_VERSION_TAG}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-  docker tag "${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}" "${DOCKER_IMAGE_TAG}:2"
+  if [[ "${IMAGE_VERSION_TAG}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "🐳 Tagging image as '${DOCKER_IMAGE_TAG}:2'"
+    docker tag "${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}" "${DOCKER_IMAGE_TAG}:2"
+  fi
 fi
 
+echo "Publishing all tags of: ${DOCKER_IMAGE_TAG}:${IMAGE_VERSION_TAG}"
 echo "${DOCKER_REG_PASS}" | docker login -u "${DOCKER_REG_USER}" --password-stdin "${DOCKER_REG_URL}"
 docker push --all-tags "${DOCKER_IMAGE_TAG}"
diff --git a/.circleci/publish_helm_chart.sh b/.circleci/publish_helm_chart.sh
index 1ddcde445..5438073a1 100755
--- a/.circleci/publish_helm_chart.sh
+++ b/.circleci/publish_helm_chart.sh
@@ -1,9 +1,15 @@
 #!/bin/bash
 
-set -e
+set -eo pipefail
 
+SHOULD_PUBLISH="${SHOULD_PUBLISH:-false}"
 RELEASE_VERSION=${IMAGE_VERSION_TAG}
 
+if [[ "${SHOULD_PUBLISH}" != "true" ]]; then
+  echo "🚪 We should not publish the helm chart. Exiting"
+  exit 1
+fi
+
 echo "Releasing Helm Chart version $RELEASE_VERSION"
 
 git config --global user.email "devops+circleci@speckle.systems"
@@ -20,7 +26,7 @@ echo "${CURRENT_VERSION}"
 .circleci/check_version.py "${CURRENT_VERSION}" "${RELEASE_VERSION}"
 if [ $? -eq 1 ] 
 then 
-  echo "The current helm chart version is newer than the currently built. Exiting" 
+  echo "The current helm chart version is newer than the currently built. Exiting"
   exit 1
 fi
 
diff --git a/packages/fileimport-service/Dockerfile b/packages/fileimport-service/Dockerfile
index 3eba977c2..3660d2e95 100644
--- a/packages/fileimport-service/Dockerfile
+++ b/packages/fileimport-service/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:16.15-bullseye-slim as node
+FROM node:16.18.0-bullseye-slim as node
 
 RUN apt-get update && \
   DEBIAN_FRONTEND=noninteractive apt-get install -y \
diff --git a/packages/frontend/Dockerfile b/packages/frontend/Dockerfile
index a5ff250d8..a51bd3623 100644
--- a/packages/frontend/Dockerfile
+++ b/packages/frontend/Dockerfile
@@ -1,7 +1,7 @@
 # NOTE: Docker context should be set to git root directory, to include the viewer
 
 # build stage
-FROM node:16.15-bullseye-slim as build-stage
+FROM node:16.18.0-bullseye-slim as build-stage
 ARG SPECKLE_SERVER_VERSION=custom
  
 
@@ -29,7 +29,8 @@ RUN yarn workspaces foreach run build
 
 # production stage
 
-FROM openresty/openresty:1.21.4.1-bullseye as production-stage
+
+FROM openresty/openresty:1.21.4.1-3-jammy-amd64 as production-stage
 ENV FILE_SIZE_LIMIT_MB=100
 COPY --from=build-stage /speckle-server/packages/frontend/dist /usr/share/nginx/html
 RUN rm /etc/nginx/conf.d/default.conf
diff --git a/packages/preview-service/Dockerfile b/packages/preview-service/Dockerfile
index 23d676df4..aa83d9f00 100644
--- a/packages/preview-service/Dockerfile
+++ b/packages/preview-service/Dockerfile
@@ -2,7 +2,7 @@
 
 
 # build stage
-FROM node:16.15-buster-slim as build-stage
+FROM node:16.18.0-bullseye-slim as build-stage
 
 ARG NODE_ENV=production
 ENV NODE_ENV=${NODE_ENV}
@@ -32,7 +32,7 @@ RUN yarn workspaces foreach -pt run build
 
 
 
-FROM node:16.15-bullseye-slim as node
+FROM node:16.18.0-bullseye-slim as node
 
 RUN apt-get update && \
   DEBIAN_FRONTEND=noninteractive apt-get install -y \
diff --git a/packages/server/Dockerfile b/packages/server/Dockerfile
index 09d4d8377..3e1b7cb34 100644
--- a/packages/server/Dockerfile
+++ b/packages/server/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:16.15-bullseye-slim as build-stage
+FROM node:16.18.0-bullseye-slim as build-stage
 ARG NODE_ENV=production
 ARG SPECKLE_SERVER_VERSION=custom
 
@@ -32,7 +32,7 @@ RUN yarn workspaces foreach run build
 WORKDIR /speckle-server/packages/server
 RUN yarn workspaces focus --production
 
-FROM node:16.15-bullseye-slim as production-stage
+FROM node:16.18.0-bullseye-slim as production-stage
 ARG NODE_ENV=production
 ENV NODE_ENV=${NODE_ENV}
 ARG SPECKLE_SERVER_VERSION=custom
diff --git a/packages/webhook-service/Dockerfile b/packages/webhook-service/Dockerfile
index f7149f544..acac81781 100644
--- a/packages/webhook-service/Dockerfile
+++ b/packages/webhook-service/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:16.15-bullseye-slim as node
+FROM node:16.18.0-bullseye-slim as node
 
 RUN apt-get update && \
   DEBIAN_FRONTEND=noninteractive apt-get install -y \