diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index be3c06e1..655e1fe2 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -33,8 +33,11 @@ steps:
     command: |
       sg release run test --workdir=. --config-from-commit
 
+  # Promote jobs run only for the promote config commit. Creating the promote
+  # branch also builds its first commit, the internal config commit, which
+  # --config-from-commit would otherwise accept, running finalize twice.
   - label: "(promote) Release: test"
-    if: build.branch =~ /^promote\/release-.*/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
@@ -57,7 +60,7 @@ steps:
       sg release run internal finalize --workdir=. --config-from-commit
 
   - label: "(promote) Release: finalize"
-    if: build.branch =~ /^promote\/release-.*/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
diff --git a/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml b/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml
index 38da1e2d..774fee8e 100644
--- a/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml
+++ b/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml
@@ -26,7 +26,7 @@ spec:
       serviceAccountName: cadvisor
       containers:
         - name: cadvisor
-          image: index.docker.io/sourcegraph/cadvisor:6.2.1106@sha256:eaaec7063b5d692c77d7cb1e7e624b1ce2441db106b9ed4a478521406ae8d5bf
+          image: us-docker.pkg.dev/sourcegraph-images/internal/cadvisor:8.1.2687@sha256:a3fb6767d9640fe79af99540bd826fe631913696f9ade91ff750a34268b24921
           args:
             # Kubernetes-specific flags below (other flags are baked into the Docker image)
             #
diff --git a/base/monitoring/grafana/grafana.StatefulSet.yaml b/base/monitoring/grafana/grafana.StatefulSet.yaml
index dc2d154c..afeec195 100644
--- a/base/monitoring/grafana/grafana.StatefulSet.yaml
+++ b/base/monitoring/grafana/grafana.StatefulSet.yaml
@@ -26,7 +26,7 @@ spec:
     spec:
       containers:
         - name: grafana
-          image: index.docker.io/sourcegraph/grafana:6.2.1106@sha256:d0abf7879ffd0153394a1d5e2951ac23bc4138cabc0f0fd6ed2fd9eded7be215
+          image: us-docker.pkg.dev/sourcegraph-images/internal/grafana:8.1.2687@sha256:c24d2f1647dc59e499cface18fba62aff1bc0de152ea95036c8d876d35f5da74
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
             - containerPort: 3370
diff --git a/base/monitoring/jaeger/jaeger.Deployment.yaml b/base/monitoring/jaeger/jaeger.Deployment.yaml
index 5f83fbf1..c578b244 100644
--- a/base/monitoring/jaeger/jaeger.Deployment.yaml
+++ b/base/monitoring/jaeger/jaeger.Deployment.yaml
@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: jaeger
-          image: index.docker.io/sourcegraph/jaeger-all-in-one:6.2.1106@sha256:c1ee8d613be75032066a9da24f54ebae19eacb63e42338e920abd6383ce168a6
+          image: us-docker.pkg.dev/sourcegraph-images/internal/jaeger-all-in-one:8.1.2687@sha256:8e4ee70cfbb3e0c765536531b3002ff3eab32bf277f2507a1c81524ea96127c9
           args: ["--config=/etc/jaeger/jaeger-config.yaml"]
           ports:
             - containerPort: 5778
diff --git a/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml b/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml
index bafea319..8c85856c 100644
--- a/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml
+++ b/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml
@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: node-exporter
-          image: index.docker.io/sourcegraph/node-exporter:6.2.1106@sha256:70f3e52fa04ae84cb865a4db9c9eacd4139e6988cc9775c3fac1e65063947661
+          image: us-docker.pkg.dev/sourcegraph-images/internal/node-exporter:8.1.2687@sha256:acddf959e6545a8b1952aa4272a3c4e2bea8090038c59c9aa9bb03e68419afeb
           imagePullPolicy: IfNotPresent
           resources:
             limits:
diff --git a/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml b/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml
index 0c99ce1c..905d67b9 100644
--- a/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml
+++ b/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml
@@ -26,7 +26,7 @@ spec:
     spec:
       containers:
         - name: otel-agent
-          image: index.docker.io/sourcegraph/opentelemetry-collector:6.2.1106@sha256:7c748a36a25b165477f5633c2f92378c951d1f2310202b54da8725e97b4b77e4
+          image: us-docker.pkg.dev/sourcegraph-images/internal/opentelemetry-collector:8.1.2687@sha256:beb7d1bb58a7fda06952975f1f7c9351bffded72de358db50e810e3c13260d40
           command:
             - "/bin/otelcol-sourcegraph"
             - "--config=/etc/otel-agent/config.yaml"
diff --git a/base/monitoring/otel-collector/otel-collector.Deployment.yaml b/base/monitoring/otel-collector/otel-collector.Deployment.yaml
index eb79f849..06bc0c0f 100644
--- a/base/monitoring/otel-collector/otel-collector.Deployment.yaml
+++ b/base/monitoring/otel-collector/otel-collector.Deployment.yaml
@@ -26,7 +26,7 @@ spec:
     spec:
       containers:
         - name: otel-collector
-          image: index.docker.io/sourcegraph/opentelemetry-collector:6.2.1106@sha256:7c748a36a25b165477f5633c2f92378c951d1f2310202b54da8725e97b4b77e4
+          image: us-docker.pkg.dev/sourcegraph-images/internal/opentelemetry-collector:8.1.2687@sha256:beb7d1bb58a7fda06952975f1f7c9351bffded72de358db50e810e3c13260d40
           command:
             - "/bin/otelcol-sourcegraph"
             # To use a custom configuration, edit otel-collector.ConfigMap.yaml
diff --git a/base/monitoring/prometheus/prometheus.Deployment.yaml b/base/monitoring/prometheus/prometheus.Deployment.yaml
index f56bc83a..f73b9cdc 100644
--- a/base/monitoring/prometheus/prometheus.Deployment.yaml
+++ b/base/monitoring/prometheus/prometheus.Deployment.yaml
@@ -25,7 +25,7 @@ spec:
     spec:
       containers:
         - name: prometheus
-          image: index.docker.io/sourcegraph/prometheus:6.2.1106@sha256:9c0f2ad131654b2264736f34e7a291f69bfdf38c07bdc7e739ff58288d5898f7
+          image: us-docker.pkg.dev/sourcegraph-images/internal/prometheus:8.1.2687@sha256:6e52e5c1b47f21b31384a52155553be4d625fa410e07ab45a8f6faed7172a907
           terminationMessagePolicy: FallbackToLogsOnError
           env:
             - name: SG_NAMESPACE
diff --git a/base/sourcegraph/blobstore/blobstore.Deployment.yaml b/base/sourcegraph/blobstore/blobstore.Deployment.yaml
index 134d301c..03063d96 100644
--- a/base/sourcegraph/blobstore/blobstore.Deployment.yaml
+++ b/base/sourcegraph/blobstore/blobstore.Deployment.yaml
@@ -26,7 +26,7 @@ spec:
     spec:
       containers:
         - name: blobstore
-          image: index.docker.io/sourcegraph/blobstore:6.2.1106@sha256:65cbbc111884633406d0917e772924adaa53e122f4d67354179b51812beabbec
+          image: us-docker.pkg.dev/sourcegraph-images/internal/blobstore:8.1.2687@sha256:7407a048bdfbd6e635874963b9f075f9e514d5b10ddd26cda76597a0bcd59ab2
           livenessProbe:
             httpGet:
               path: /
diff --git a/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml b/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml
index a5b41669..e390b7c8 100644
--- a/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml
+++ b/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml
@@ -26,7 +26,7 @@ spec:
     spec:
       initContainers:
         - name: correct-data-dir-permissions
-          image: index.docker.io/sourcegraph/alpine-3.14:6.2.1106@sha256:9c9fef5b66e706103a6972feab18183f52c0efc8f1e2e32d8f4ffca196ef04fc
+          image: us-docker.pkg.dev/sourcegraph-images/internal/alpine-3.14:8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963
           command: ["sh", "-c", "if [ -d /var/lib/postgresql/data/pgdata ]; then chmod 750 /var/lib/postgresql/data/pgdata; fi"]
           volumeMounts:
             - mountPath: /var/lib/postgresql/data/
@@ -45,7 +45,7 @@ spec:
             runAsUser: 70
       containers:
         - name: codeinsights
-          image: index.docker.io/sourcegraph/postgresql-16-codeinsights:6.2.1106@sha256:5946147e89c36775a1b03a005db4cdd6b557fd01efca70a90ad8f28eaf6f6749
+          image: us-docker.pkg.dev/sourcegraph-images/internal/postgresql-16-codeinsights:8.1.2687@sha256:b7e2df5a6a63e323987eeaca23fe9f05278d4c97f96f1994b89dac3c60dedcd3
           env:
             - name: POSTGRES_DB
               value: postgres
@@ -82,7 +82,7 @@ spec:
               value: postgres://postgres:@localhost:5432/?sslmode=disable
             - name: PG_EXPORTER_EXTEND_QUERY_PATH
               value: /config/code_insights_queries.yaml
-          image: index.docker.io/sourcegraph/postgres_exporter:6.2.1106@sha256:8b289f196018c54ead72552a02c3a29f14bf1e5e199065129f303db5d41aa653
+          image: us-docker.pkg.dev/sourcegraph-images/internal/postgres_exporter:8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d
           terminationMessagePolicy: FallbackToLogsOnError
           name: pgsql-exporter
           ports:
diff --git a/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml b/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml
index 488dcdda..3a3cb3dd 100644
--- a/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml
+++ b/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml
@@ -27,7 +27,7 @@ spec:
     spec:
       initContainers:
         - name: correct-data-dir-permissions
-          image: index.docker.io/sourcegraph/alpine-3.14:6.2.1106@sha256:9c9fef5b66e706103a6972feab18183f52c0efc8f1e2e32d8f4ffca196ef04fc
+          image: us-docker.pkg.dev/sourcegraph-images/internal/alpine-3.14:8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963
           command: ["sh", "-c", "if [ -d /data/pgdata-12 ]; then chmod 750 /data/pgdata-12; fi"]
           volumeMounts:
             - mountPath: /data
@@ -45,7 +45,7 @@ spec:
               memory: "50Mi"
       containers:
         - name: pgsql
-          image: index.docker.io/sourcegraph/postgresql-16:6.2.1106@sha256:83bab9e63d9eaa7a9052e095af64983aab2c87fb11e6157f4f05fe95d8c22c32
+          image: us-docker.pkg.dev/sourcegraph-images/internal/postgresql-16:8.1.2687@sha256:cc810cd21f1df7776aa270f49bdd50a4ec3375623ffae1f0238c20dec054bf03
           terminationMessagePolicy: FallbackToLogsOnError
           readinessProbe:
             exec:
@@ -87,7 +87,7 @@ spec:
               value: postgres://sg:@localhost:5432/?sslmode=disable
             - name: PG_EXPORTER_EXTEND_QUERY_PATH
               value: /config/code_intel_queries.yaml
-          image: index.docker.io/sourcegraph/postgres_exporter:6.2.1106@sha256:8b289f196018c54ead72552a02c3a29f14bf1e5e199065129f303db5d41aa653
+          image: us-docker.pkg.dev/sourcegraph-images/internal/postgres_exporter:8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d
           terminationMessagePolicy: FallbackToLogsOnError
           name: pgsql-exporter
           ports:
diff --git a/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml b/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml
index ca67e558..5923fcb2 100644
--- a/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml
+++ b/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml
@@ -29,7 +29,7 @@ spec:
     spec:
       initContainers:
         - name: migrator
-          image: index.docker.io/sourcegraph/migrator:6.2.1106@sha256:ece1a5718e04ed24c08d6729bf3a017e395fa961a232bbcb1193104914e0c476
+          image: us-docker.pkg.dev/sourcegraph-images/internal/migrator:8.1.2687@sha256:c5bf0f81f3b07f7769f694525bef0a2d547a554f99113115a33b0925a16ef5ea
           args: ["up"]
           resources:
             limits:
@@ -48,7 +48,7 @@ spec:
                 name: sourcegraph-frontend-env
       containers:
         - name: frontend
-          image: index.docker.io/sourcegraph/frontend:6.2.1106@sha256:025a8f66d15cc33cc155dbb995d111a29e65d5fe338a62df8fe4cf012db06788
+          image: us-docker.pkg.dev/sourcegraph-images/internal/frontend:8.1.2687@sha256:192083e614e002fc18d3a80372c6b8d706d8a389086566510ba6fbced651a2eb
           args:
             - serve
           envFrom:
diff --git a/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml b/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml
index 25ac3ae7..489f27d0 100644
--- a/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml
+++ b/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml
@@ -38,7 +38,7 @@ spec:
                   fieldPath: status.hostIP
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
               value: http://$(OTEL_AGENT_HOST):4317
-          image: index.docker.io/sourcegraph/gitserver:6.2.1106@sha256:386d08fa31656d91eda243211b8f3765e86891ba4c59b8d8f8c9675dc0154fee
+          image: us-docker.pkg.dev/sourcegraph-images/internal/gitserver:8.1.2687@sha256:03c984acc6e69ed015ecf01402cf22f7b8b90582a0791a48adf695df8b97bd39
           terminationMessagePolicy: FallbackToLogsOnError
           # Temporary: when migrating from repo names to repo IDs on disk,
           # gitserver can take a little while to start up. To avoid killing the
diff --git a/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml b/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml
index 8e1b17ce..e6427fb8 100644
--- a/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml
+++ b/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml
@@ -33,7 +33,7 @@ spec:
               value: http://$(OTEL_AGENT_HOST):4317
             - name: OPENTELEMETRY_DISABLED
               value: "false"
-          image: index.docker.io/sourcegraph/indexed-searcher:6.2.1106@sha256:8d65ad2ea2a5d96de2b97a1a44dba440c4ba86af8db23c347b9e2866a7e67f38
+          image: us-docker.pkg.dev/sourcegraph-images/internal/indexed-searcher:8.1.2687@sha256:4f9b1d38da5f6168ee91ed5e2d9c42f851148b12e1a71ee5040f566b6d663837
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
             - containerPort: 6070
@@ -72,7 +72,7 @@ spec:
               value: http://$(OTEL_AGENT_HOST):4317
             - name: OPENTELEMETRY_DISABLED
               value: "false"
-          image: index.docker.io/sourcegraph/search-indexer:6.2.1106@sha256:5fa8876a85928f4df48c9d86cd010d5a7d14df2c7fe3d48e49b7f9ca5f7e54a0
+          image: us-docker.pkg.dev/sourcegraph-images/internal/search-indexer:8.1.2687@sha256:1a53fc78048963cf2badc8e8b43fc606d62a2323d36bd631eb01e33910dd22cd
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
             - containerPort: 6072
diff --git a/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml b/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml
index 0e28ed1f..caef8e5b 100644
--- a/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml
+++ b/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml
@@ -27,7 +27,7 @@ spec:
     spec:
       initContainers:
         - name: correct-data-dir-permissions
-          image: index.docker.io/sourcegraph/alpine-3.14:6.2.1106@sha256:9c9fef5b66e706103a6972feab18183f52c0efc8f1e2e32d8f4ffca196ef04fc
+          image: us-docker.pkg.dev/sourcegraph-images/internal/alpine-3.14:8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963
           command: ["sh", "-c", "if [ -d /data/pgdata-12 ]; then chmod 750 /data/pgdata-12; fi"]
           volumeMounts:
             - mountPath: /data
@@ -46,7 +46,7 @@ spec:
               memory: "50Mi"
       containers:
         - name: pgsql
-          image: index.docker.io/sourcegraph/postgresql-16:6.2.1106@sha256:83bab9e63d9eaa7a9052e095af64983aab2c87fb11e6157f4f05fe95d8c22c32
+          image: us-docker.pkg.dev/sourcegraph-images/internal/postgresql-16:8.1.2687@sha256:cc810cd21f1df7776aa270f49bdd50a4ec3375623ffae1f0238c20dec054bf03
           terminationMessagePolicy: FallbackToLogsOnError
           readinessProbe:
             exec:
@@ -90,7 +90,7 @@ spec:
               value: postgres://sg:@localhost:5432/?sslmode=disable
             - name: PG_EXPORTER_EXTEND_QUERY_PATH
               value: /config/queries.yaml
-          image: index.docker.io/sourcegraph/postgres_exporter:6.2.1106@sha256:8b289f196018c54ead72552a02c3a29f14bf1e5e199065129f303db5d41aa653
+          image: us-docker.pkg.dev/sourcegraph-images/internal/postgres_exporter:8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d
           terminationMessagePolicy: FallbackToLogsOnError
           name: pgsql-exporter
           ports:
diff --git a/base/sourcegraph/precise-code-intel/worker.Deployment.yaml b/base/sourcegraph/precise-code-intel/worker.Deployment.yaml
index 51933f3e..f3b66acb 100644
--- a/base/sourcegraph/precise-code-intel/worker.Deployment.yaml
+++ b/base/sourcegraph/precise-code-intel/worker.Deployment.yaml
@@ -49,7 +49,7 @@ spec:
                   fieldPath: status.hostIP
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
               value: http://$(OTEL_AGENT_HOST):4317
-          image: index.docker.io/sourcegraph/precise-code-intel-worker:6.2.1106@sha256:f43dad61709c87c02bc0d3b43f1419529d76d0035362b5859b79a284191fcbe6
+          image: us-docker.pkg.dev/sourcegraph-images/internal/precise-code-intel-worker:8.1.2687@sha256:560ef1edc769959af11f24d220b0dbd5c5c798be1d635e6e4fe06ff560b7835c
           terminationMessagePolicy: FallbackToLogsOnError
           livenessProbe:
             httpGet:
diff --git a/base/sourcegraph/redis/redis-cache.Deployment.yaml b/base/sourcegraph/redis/redis-cache.Deployment.yaml
index a1bb201a..f5bd9bee 100644
--- a/base/sourcegraph/redis/redis-cache.Deployment.yaml
+++ b/base/sourcegraph/redis/redis-cache.Deployment.yaml
@@ -26,7 +26,7 @@ spec:
     spec:
       containers:
         - name: redis-cache
-          image: index.docker.io/sourcegraph/redis-cache:6.2.1106@sha256:57b3318d4587f66582bf9c02756c67460e6c3d809aa0763f30cac18609cdbecc
+          image: us-docker.pkg.dev/sourcegraph-images/internal/redis-cache:8.1.2687@sha256:41035baa91623dff4275a5d496eb916c46bee260301d9991bbd1914c09c217f8
           terminationMessagePolicy: FallbackToLogsOnError
           livenessProbe:
             initialDelaySeconds: 30
@@ -70,7 +70,7 @@ spec:
             - mountPath: /redis-data
               name: redis-data
         - name: redis-exporter
-          image: index.docker.io/sourcegraph/redis_exporter:6.2.1106@sha256:5974c85aae470ecd7c565862a16592887f4d111a28ef0e3bb1e400323540a397
+          image: us-docker.pkg.dev/sourcegraph-images/internal/redis_exporter:8.1.2687@sha256:898666a0c7fc28b6b90f1f01893cb35668a97dbcc4f18056ca5f8d2ac89b2292
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
             - containerPort: 9121
diff --git a/base/sourcegraph/redis/redis-store.Deployment.yaml b/base/sourcegraph/redis/redis-store.Deployment.yaml
index fc7d2281..3669e5d0 100644
--- a/base/sourcegraph/redis/redis-store.Deployment.yaml
+++ b/base/sourcegraph/redis/redis-store.Deployment.yaml
@@ -25,7 +25,7 @@ spec:
     spec:
       containers:
         - name: redis-store
-          image: index.docker.io/sourcegraph/redis-store:6.2.1106@sha256:74ce6130fa0e11e4c853129f24bcba6a4044def3d18f86e389b3064ec2193175
+          image: us-docker.pkg.dev/sourcegraph-images/internal/redis-store:8.1.2687@sha256:b733fceadfa1863671ab11704e354573241217c4aa604aba64533c7bae101127
           terminationMessagePolicy: FallbackToLogsOnError
           livenessProbe:
             initialDelaySeconds: 30
@@ -69,7 +69,7 @@ spec:
             - mountPath: /redis-data
               name: redis-data
         - name: redis-exporter
-          image: index.docker.io/sourcegraph/redis_exporter:6.2.1106@sha256:5974c85aae470ecd7c565862a16592887f4d111a28ef0e3bb1e400323540a397
+          image: us-docker.pkg.dev/sourcegraph-images/internal/redis_exporter:8.1.2687@sha256:898666a0c7fc28b6b90f1f01893cb35668a97dbcc4f18056ca5f8d2ac89b2292
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
             - containerPort: 9121
diff --git a/base/sourcegraph/searcher/searcher.StatefulSet.yaml b/base/sourcegraph/searcher/searcher.StatefulSet.yaml
index 5659d5a0..4d117dbf 100644
--- a/base/sourcegraph/searcher/searcher.StatefulSet.yaml
+++ b/base/sourcegraph/searcher/searcher.StatefulSet.yaml
@@ -49,7 +49,7 @@ spec:
                   fieldPath: status.hostIP
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
               value: http://$(OTEL_AGENT_HOST):4317
-          image: index.docker.io/sourcegraph/searcher:6.2.1106@sha256:026fca70bfe2f2a91e867877a01f962adf3948a1cc5512c216ec45a5e41f164b
+          image: us-docker.pkg.dev/sourcegraph-images/internal/searcher:8.1.2687@sha256:acfbc9c127ebdbd4053ac835bcf90093f9d8bf4834a6275a549384db4eacd66f
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
             - containerPort: 3181
diff --git a/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml b/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml
index 66003da9..e6c10d17 100644
--- a/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml
+++ b/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml
@@ -40,7 +40,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
-          image: index.docker.io/sourcegraph/syntactic-code-intel-worker:6.0.0@sha256:50bdeb38b196f0fc21404969016bf8263f78144292e905867e93480f66c8251c
+          image: us-docker.pkg.dev/sourcegraph-images/internal/syntactic-code-intel-worker:8.1.2687@sha256:702609626636fd06c204a8a7e18941eb13df096784cea732d1c036069866cc40
           terminationMessagePath: FallbackToLogsOnError
           livenessProbe:
             httpGet:
diff --git a/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml b/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml
index d4aada4f..e7420f11 100644
--- a/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml
+++ b/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml
@@ -32,7 +32,7 @@ spec:
             allowPrivilegeEscalation: false
             runAsGroup: 101
             runAsUser: 100
-          image: index.docker.io/sourcegraph/syntax-highlighter:6.2.1106@sha256:d44d14de2484019ee2a4f0c31d4000613fb299fc9447ec71f0e164224c176cd5
+          image: us-docker.pkg.dev/sourcegraph-images/internal/syntax-highlighter:8.1.2687@sha256:9bbe53c18c2d864358ba95e4c89d000df60759e5d9fc0814b30d576efde55d95
           terminationMessagePolicy: FallbackToLogsOnError
           livenessProbe:
             httpGet:
diff --git a/base/sourcegraph/worker/worker.Deployment.yaml b/base/sourcegraph/worker/worker.Deployment.yaml
index 19ceb147..44b46f20 100644
--- a/base/sourcegraph/worker/worker.Deployment.yaml
+++ b/base/sourcegraph/worker/worker.Deployment.yaml
@@ -51,7 +51,7 @@ spec:
                   fieldPath: status.hostIP
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
               value: http://$(OTEL_AGENT_HOST):4317
-          image: index.docker.io/sourcegraph/worker:6.2.1106@sha256:fd6be67ea22f842246dbe81f64a60db027e5202f0ce863a0be4a82b12f908620
+          image: us-docker.pkg.dev/sourcegraph-images/internal/worker:8.1.2687@sha256:5aa40853fc6a8223c373f291ce940f7258d2e882e8ffca7e31af04ec2f2f7922
           terminationMessagePolicy: FallbackToLogsOnError
           livenessProbe:
             httpGet:
diff --git a/components/executors/dind/executor.Deployment.yaml b/components/executors/dind/executor.Deployment.yaml
index 624c6938..87e43963 100644
--- a/components/executors/dind/executor.Deployment.yaml
+++ b/components/executors/dind/executor.Deployment.yaml
@@ -28,7 +28,7 @@ spec:
     spec:
       containers:
         - name: executor
-          image: index.docker.io/sourcegraph/executor:6.2.1106@sha256:1363cce32f2002594cad461380b223670e17de1f4466edee956a3404c7bbd172
+          image: us-docker.pkg.dev/sourcegraph-images/internal/executor:8.1.2687@sha256:e9d0d598c1a7ab346fb7e9ccb341036fa71cce15e96b84a453e16a7831987e87
           imagePullPolicy: Always
           livenessProbe:
             exec:
@@ -60,7 +60,7 @@ spec:
             - mountPath: /scratch
               name: executor-scratch
         - name: dind
-          image: index.docker.io/sourcegraph/dind:6.2.1106@sha256:c64b5efff14ccd82cd6957283b116ef195d374ec911ea7fe56787b93143810fd
+          image: us-docker.pkg.dev/sourcegraph-images/internal/dind:8.1.2687@sha256:5145a833a7c0afbb9c2681ea7d49c997ba4a7bd75fe29f79fea42a43718356ee
           imagePullPolicy: Always
           securityContext:
             privileged: true
diff --git a/components/executors/k8s/executor.Deployment.yaml b/components/executors/k8s/executor.Deployment.yaml
index 1fc0277b..b8c9718f 100644
--- a/components/executors/k8s/executor.Deployment.yaml
+++ b/components/executors/k8s/executor.Deployment.yaml
@@ -29,7 +29,7 @@ spec:
       serviceAccountName: executor
       containers:
         - name: executor
-          image: index.docker.io/sourcegraph/executor-kubernetes:6.2.1106@sha256:6b9967ae0a57ccd54bb85347929692f709f921880e1ee4366f5114d8d6f0b59c
+          image: us-docker.pkg.dev/sourcegraph-images/internal/executor-kubernetes:8.1.2687@sha256:59168747fea24f4636c581d1731c06e80d9e0de9c396cb925959c7450c4ab514
           imagePullPolicy: Always
           livenessProbe:
             exec:
diff --git a/components/utils/migrator/resources/migrator.Job.yaml b/components/utils/migrator/resources/migrator.Job.yaml
index 2f01a9d6..5c7fdcf1 100644
--- a/components/utils/migrator/resources/migrator.Job.yaml
+++ b/components/utils/migrator/resources/migrator.Job.yaml
@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
         - name: migrator
-          image: index.docker.io/sourcegraph/migrator:5.1.6@sha256:76facd38029ee611e5bee723736e42eedb633b2c31d4494711c55f59906a5f93
+          image: us-docker.pkg.dev/sourcegraph-images/internal/migrator:8.1.2687@sha256:c5bf0f81f3b07f7769f694525bef0a2d547a554f99113115a33b0925a16ef5ea
           args: ["up"]
           envFrom:
             - configMapRef:
diff --git a/release.yaml b/release.yaml
index ae50d7c6..ded54771 100644
--- a/release.yaml
+++ b/release.yaml
@@ -349,7 +349,16 @@ promoteToPublic:
           # Create the final branch holding the tagged commit
           git checkout "${promote_branch}"
           git switch -c "${release_branch}"
-          git tag {{version}}
+          # A retried finalize finds its own tag; only a tag elsewhere is an error
+          if tagged=$(git rev-parse -q --verify "refs/tags/{{version}}^{commit}"); then
+            if [ "${tagged}" != "$(git rev-parse HEAD)" ]; then
+              echo "Tag {{version}} already exists at ${tagged}, not at ${promote_branch} ($(git rev-parse HEAD))" >&2
+              exit 1
+            fi
+            echo "Tag {{version}} already points at ${promote_branch}, not recreating it"
+          else
+            git tag {{version}}
+          fi
           git push origin ${release_branch} --tags
 
           # Web URL to the tag
@@ -389,72 +398,3 @@ promoteToPublic:
             echo "Build created, see:"
             echo $body | jq .web_url
           fi
-
-      - name: "update main with latest version"
-        cmd: |
-          set -eu
-          branch="promote/release-{{version}}-update-main"
-          echo "Checking out origin/main"
-          git fetch origin main
-          git switch main
-          echo "Creating branch origin/${branch}"
-          git switch -c "${branch}"
-
-      - name: "sg ops"
-        cmd: |
-          set -eu
-          sg ops update-images \
-            --kind k8s \
-            --registry index.docker.io/sourcegraph \
-            --docker-username=$DOCKER_USERNAME \
-            --docker-password=$DOCKER_PASSWORD \
-            --pin-tag {{inputs.server.tag}} \
-            base/
-
-      - name: "sg ops (executors)"
-        cmd: |
-          set -eu
-          sg ops update-images \
-            --kind k8s \
-            --registry index.docker.io/sourcegraph \
-            --docker-username=$DOCKER_USERNAME \
-            --docker-password=$DOCKER_PASSWORD \
-            --pin-tag {{inputs.server.tag}} \
-            components/executors/
-
-      - name: "sg ops (migrator)"
-        cmd: |
-          set -eu
-          sg ops update-images \
-            --kind k8s \
-            --registry index.docker.io/sourcegraph \
-            --docker-username=$DOCKER_USERNAME \
-            --docker-password=$DOCKER_PASSWORD \
-            --pin-tag {{inputs.server.tag}} \
-            components/utils/migrator/
-
-      - name: "git:commit"
-        cmd: |
-          set -eu
-          branch="promote/release-{{version}}-update-main"
-          find . -name "*.yaml" | xargs git add
-          find . -name "*.yml" | xargs git add
-
-          # Careful with the quoting for the config, using double quotes will lead
-          # to the shell dropping out all quotes from the json, leading to failed
-          # parsing.
-          git commit -am 'update-main: {{version}}' -m 'update main with latest release'
-          git push origin "${branch}"
-          
-      - name: "github:pr"
-        cmd: |
-          set -eu
-          # Create PR to merge release updates into main branch
-          gh pr create \
-            --fill \
-            --draft \
-            --base main \
-            --title "Update main: build {{version}}" \
-            --body "Test plan: automated release PR, CI will perform additional checks"
-          echo "🚢 Please check the associated CI build to ensure the process completed".
-