diff --git a/all-apps/docker-compose.yaml b/all-apps/docker-compose.yaml
index 6f09a1d..b122e0c 100644
--- a/all-apps/docker-compose.yaml
+++ b/all-apps/docker-compose.yaml
@@ -1,7 +1,7 @@
 version: '3'
 services:
   lb:
-    image: docker.io/caddy:2.10.2-alpine
+    image: docker.io/caddy:2.11.4-alpine
     volumes:
 #      - /app/lb:/etc/caddy
       - ./lb/:/etc/caddy
diff --git a/all-apps/ghost/docker-compose.yaml b/all-apps/ghost/docker-compose.yaml
index de0f16a..edb5a83 100644
--- a/all-apps/ghost/docker-compose.yaml
+++ b/all-apps/ghost/docker-compose.yaml
@@ -36,7 +36,7 @@ services:
       - lb
 
   ghost_db:
-    image: mysql:8.0.44@sha256:f37951fc3753a6a22d6c7bf6978c5e5fefcf6f31814d98c582524f98eae52b21
+    image: mysql:9.7
     restart: always
     expose:
       - "3306"
@@ -59,7 +59,7 @@ services:
       - ghost_network
 
   ghost_traffic-analytics:
-    image: ghost/traffic-analytics:1.0.20@sha256:a72573d89457e778b00e9061422516d2d266d79a72a0fc02005ba6466e391859
+    image: ghost/traffic-analytics:1.0
     restart: always
     expose:
       - "3000"
diff --git a/all-apps/nassella/docker-compose.yaml b/all-apps/nassella/docker-compose.yaml
index 09a547b..51b1476 100644
--- a/all-apps/nassella/docker-compose.yaml
+++ b/all-apps/nassella/docker-compose.yaml
@@ -26,7 +26,7 @@ secrets:
 
 services:
   nassella_lldap_db:
-    image: postgres:17.6-trixie
+    image: postgres:18-trixie
     environment:
       - POSTGRES_DB_FILE=/run/secrets/nassella_lldap_postgres_db
       - POSTGRES_USER_FILE=/run/secrets/nassella_lldap_postgres_user
@@ -34,7 +34,7 @@ services:
     shm_size: 128mb
     restart: always
     volumes:
-      - /nassella/nassella/lldap-var-lib-postgresql-data:/var/lib/postgresql/data
+      - /nassella/nassella/lldap-var-lib-postgresql:/var/lib/postgresql
     networks:
       - nassella_internal
     healthcheck:
@@ -64,7 +64,7 @@ services:
       - nassella_lldap_postgres_user
 
   nassella_authelia_db:
-    image: postgres:17.6-trixie
+    image: postgres:18-trixie
     environment:
       - POSTGRES_DB_FILE=/run/secrets/nassella_authelia_postgres_db
       - POSTGRES_USER_FILE=/run/secrets/nassella_authelia_postgres_user
@@ -72,7 +72,7 @@ services:
     shm_size: 128mb
     restart: always
     volumes:
-      - /nassella/nassella/authelia-var-lib-postgresql-data:/var/lib/postgresql/data
+      - /nassella/nassella/authelia-var-lib-postgresql:/var/lib/postgresql
     networks:
       - nassella_internal
     healthcheck:
@@ -104,13 +104,13 @@ services:
       disable: true
 
   nassella_db:
-    image: postgres:17.6-trixie
+    image: postgres:18-trixie
     env_file:
       - ./nassella/nassella.env
     shm_size: 128mb
     restart: always
     volumes:
-      - /nassella/nassella/var-lib-postgresql-data:/var/lib/postgresql/data
+      - /nassella/nassella/var-lib-postgresql:/var/lib/postgresql
     networks:
       - nassella_internal
     healthcheck:
diff --git a/all-apps/nextcloud/docker-compose.yaml b/all-apps/nextcloud/docker-compose.yaml
index eb03dae..ecb5155 100644
--- a/all-apps/nextcloud/docker-compose.yaml
+++ b/all-apps/nextcloud/docker-compose.yaml
@@ -12,13 +12,13 @@ secrets:
 
 services:
   nextcloud_db:
-    image: postgres:17.6-trixie
+    image: postgres:18-trixie
     env_file:
       - ./nextcloud/nextcloud.env
     shm_size: 128mb
     restart: always
     volumes:
-      - /nassella/nextcloud/var-lib-postgresql-data:/var/lib/postgresql/data
+      - /nassella/nextcloud/var-lib-postgresql:/var/lib/postgresql
     networks:
       - nextcloud_internal
     healthcheck:
@@ -32,7 +32,7 @@ services:
       - nextcloud_postgres_password
       - nextcloud_postgres_user
   nextcloud_redis:
-    image: redis:8.2.1-bookworm
+    image: redis:8-trixie
     env_file:
       - ./nextcloud/nextcloud.env
     command: bash -c 'redis-server --requirepass "$$(cat /run/secrets/nextcloud_redis_password)"'
@@ -48,7 +48,7 @@ services:
     networks:
       - nextcloud_internal
   nextcloud:
-    image: nextcloud:31.0.8-apache
+    image: nextcloud:34-apache
     depends_on:
       nextcloud_redis:
         condition: service_healthy
diff --git a/src/db-init.sql b/src/db-init.sql
index b897d28..f55b1eb 100644
--- a/src/db-init.sql
+++ b/src/db-init.sql
@@ -96,3 +96,7 @@ create table migrations(
        id bigserial primary key,
        migration_id integer not null unique,
        );
+
+insert into migrations(migration_id) values(0);
+insert into migrations(migration_id) values(1);
+insert into migrations(migration_id) values(2);
diff --git a/src/nassella.scm b/src/nassella.scm
index debd7e0..4a3f55e 100644
--- a/src/nassella.scm
+++ b/src/nassella.scm
@@ -1486,7 +1486,7 @@ chmod -R 777 /opt/keys")))
                    ("cluster_name" . "nassella")
                    ("datacenter" . ,(alist-ref 'digitalocean-region service-config))
                    ;; (source <(curl -sSfL https://stable.release.flatcar-linux.net/amd64-usr/current/version.txt); echo "${FLATCAR_VERSION_ID}")
-                   ("flatcar_stable_version" . "4593.2.2")))
+                   ("flatcar_stable_version" . "4593.2.3")))
             ;; remove the newline that generating the ssh key adds
             (display "ssh_keys=[\"") (display (string-drop-right ssh-pub-key 1)) (print "\"]"))))
       (let* ((instance-id (alist-ref "id" (current-params) equal?))
@@ -1518,7 +1518,6 @@ chmod -R 777 /opt/keys")))
              (version . 0))))
         (thread-start!
          (lambda ()
-           ;; TODO add a timeout and set status to failed and error if we hit the timeout
            (let ((start-time (time->seconds (current-time))))
              (let loop ()
                (thread-sleep! 1)
@@ -1790,7 +1789,7 @@ chmod -R 777 /opt/keys")))
                    ("cluster_name" . "nassella")
                    ("datacenter" . ,(alist-ref 'digitalocean-region service-config))
                    ;; (source <(curl -sSfL https://stable.release.flatcar-linux.net/amd64-usr/current/version.txt); echo "${FLATCAR_VERSION_ID}")
-                   ("Flatcar_stable_version" . "4593.2.2")))
+                   ("Flatcar_stable_version" . "4593.2.3")))
             ;; remove the newline that generating the ssh key adds
             (display "ssh_keys=[\"") (display (string-drop-right ssh-pub-key 1)) (print "\"]")))
          ;; TODO need a new table to track destroying?