diff --git a/docker-compose.tmpl.yml b/docker-compose.tmpl.yml
index a00c34f..27bef7b 100644
--- a/docker-compose.tmpl.yml
+++ b/docker-compose.tmpl.yml
@@ -145,8 +145,8 @@ services:
         - plugin=./repos/bbb-etherpad-plugin
         - skin=./repos/bbb-etherpad-skin
       args:
-        TAG_ETHERPAD: "2.2.6"
-    image: alangecker/bbb-docker-etherpad:2.2.6-s{{ .Env.COMMIT_ETHERPAD_SKIN }}-p{{ .Env.COMMIT_ETHERPAD_PLUGIN }}
+        TAG_ETHERPAD: "2.2.7"
+    image: alangecker/bbb-docker-etherpad:2.2.7-s{{ .Env.COMMIT_ETHERPAD_SKIN }}-p{{ .Env.COMMIT_ETHERPAD_PLUGIN }}
     restart: unless-stopped
     depends_on:
       - redis
@@ -178,7 +178,7 @@ services:
       context: mod/bbb-export-annotations
       additional_contexts:
         bigbluebutton: ./repos/bigbluebutton
-    image: alangecker/bbb-docker-bbb-export-annotations:v2.7.0
+    image: alangecker/bbb-docker-bbb-export-annotations:{{ .Env.TAG_BBB }}
     restart: unless-stopped
     depends_on:
       - redis
@@ -288,7 +288,8 @@ services:
         - src=./repos/bigbluebutton/bbb-graphql-server
       args:
         BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
-        GRAPHQL_ENGINE_TAG: v2.44.0
+        GRAPHQL_ENGINE_TAG: v2.45.0
+    image: alangecker/bbb-docker-graphql-server:{{ .Env.TAG_BBB }}
     depends_on:
       - postgres
       - bbb-web
@@ -315,6 +316,7 @@ services:
       {{ end }}
       args:
         BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+    image: alangecker/bbb-docker-graphql-actions:{{ .Env.TAG_BBB }}
     restart: unless-stopped
     depends_on:
       - redis
@@ -339,6 +341,7 @@ services:
       {{ end }}
       args:
         BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+    image: alangecker/bbb-docker-graphql-middleware:{{ .Env.TAG_BBB }}
     restart: unless-stopped
     depends_on:
       - bbb-graphql-server
@@ -348,6 +351,8 @@ services:
     networks:
       bbb-net:
         ipv4_address: 10.7.7.32
+    extra_hosts:
+      - "nginx:10.7.7.1"
 
     {{ if isTrue .Env.DEV_MODE }}
     user: ${BBB_DEV_UID}:${BBB_DEV_GID}
@@ -374,7 +379,7 @@ services:
 
   periodic:
     build: mod/periodic
-    image: alangecker/bbb-docker-periodic:v2.7.0
+    image: alangecker/bbb-docker-periodic:v3.0.0
     restart: unless-stopped
 
     volumes:
@@ -494,7 +499,7 @@ services:
 {{ if isTrue .Env.ENABLE_GREENLIGHT }}
   # greenlight
   greenlight:
-    image: bigbluebutton/greenlight:v3.4.1
+    image: bigbluebutton/greenlight:v3.5.0
     restart: unless-stopped
     env_file: .env
     depends_on:
diff --git a/mod/apps-akka/bbb-apps-akka.conf b/mod/apps-akka/bbb-apps-akka.conf
index f145c72..e9e3954 100644
--- a/mod/apps-akka/bbb-apps-akka.conf
+++ b/mod/apps-akka/bbb-apps-akka.conf
@@ -8,6 +8,7 @@ redis {
 services {
   bbbWebAPI="https://DOMAIN/bigbluebutton/api"
   sharedSecret="SHARED_SECRET"
+  graphqlMiddlewareAPI = "http://10.7.7.32:8378"
 }
 http {
   interface = "0.0.0.0"
diff --git a/mod/bbb-graphql-middleware/config.yml b/mod/bbb-graphql-middleware/config.yml
index 3740d32..f323157 100644
--- a/mod/bbb-graphql-middleware/config.yml
+++ b/mod/bbb-graphql-middleware/config.yml
@@ -6,7 +6,7 @@ redis:
   port: 6379
   password: ""
 hasura:
-  url: ws://bbb-graphql-server:8085/v1/graphql
+  url: ws://nginx:8185/v1/graphql
 graphql-actions:
   url: http://bbb-graphql-actions:8093
 auth_hook:
diff --git a/mod/bbb-pads/Dockerfile b/mod/bbb-pads/Dockerfile
index 7498a10..fa6762c 100644
--- a/mod/bbb-pads/Dockerfile
+++ b/mod/bbb-pads/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:18-bookworm-slim AS builder
+FROM node:22-bookworm-slim AS builder
 
 COPY --from=src / /bbb-pads
 RUN cd /bbb-pads && rm -r .git && npm install --production
@@ -7,7 +7,7 @@ RUN cd /bbb-pads && rm -r .git && npm install --production
 RUN chmod 777 /bbb-pads/config
 # ------------------------------
 
-FROM node:18-bookworm-slim
+FROM node:22-bookworm-slim
 
 RUN apt update && apt install -y jq moreutils \
     && useradd --uid 2003 --create-home --user-group bbb-pads
diff --git a/mod/bbb-webrtc-recorder/Dockerfile b/mod/bbb-webrtc-recorder/Dockerfile
index 07fd1c4..d7d7e4b 100644
--- a/mod/bbb-webrtc-recorder/Dockerfile
+++ b/mod/bbb-webrtc-recorder/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.21 as builder
+FROM golang:1.23 as builder
 
 ARG APP_VERSION=devel
 ARG GOMOD=github.com/bigbluebutton/bbb-webrtc-recorder
diff --git a/mod/etherpad/Dockerfile b/mod/etherpad/Dockerfile
index e421fc2..705867c 100644
--- a/mod/etherpad/Dockerfile
+++ b/mod/etherpad/Dockerfile
@@ -8,10 +8,10 @@ RUN apk add git curl
 USER etherpad
 
 RUN pnpm run plugins i \
-    ep_cursortrace@3.1.18 \
     ep_disable_chat@0.0.10 \
     ep_auth_session@1.1.1 \
     --github \
+        mconf/ep_cursortrace#56fb8c2b211cdda4fc8715ec99e1cb7b7d9eb851 \
         mconf/ep_pad_ttl#360136cd38493dd698435631f2373cbb7089082d \
         mconf/ep_redis_publisher#2b6e47c1c59362916a0b2961a29b259f2977b694
 
diff --git a/mod/haproxy/bootstrap.sh b/mod/haproxy/bootstrap.sh
index 35c045d..c17e9f9 100755
--- a/mod/haproxy/bootstrap.sh
+++ b/mod/haproxy/bootstrap.sh
@@ -7,6 +7,11 @@ set -e
 
 declare -p | grep -Ev '^declare -[[:alpha:]]*r' > /container.env
 
+# when used with an IP, we'll also disable certbot
+if [[ "$CERT1" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  IGNORE_TLS_CERT_ERRORS=true
+fi
+
 if [ "$IGNORE_TLS_CERT_ERRORS"  ] && [ "$IGNORE_TLS_CERT_ERRORS" != "false" ]; then
     # use self signed certificate
     if [ ! -f /etc/haproxy/certs/haproxy-10.7.7.1.pem ]; then
diff --git a/mod/nginx/Dockerfile b/mod/nginx/Dockerfile
index 692f88f..0bf0ab3 100644
--- a/mod/nginx/Dockerfile
+++ b/mod/nginx/Dockerfile
@@ -16,9 +16,12 @@ RUN find /source/dist -name '*.js' -exec gzip -k -f -9 '{}' \; \
     && find /source/dist -name '*.css' -exec gzip -k -f -9 '{}' \; \
     && find /source/dist -name '*.wasm' -exec gzip -k -f -9 '{}' \;
 
+RUN sed -i "s/VERSION/$BBB_BUILD_TAG/g" /source/dist/index.html && \
+    sed -i "s/VERSION/$BBB_BUILD_TAG/g" /source/dist/stylesheets/fonts.css
+
 # --------------------
 
-FROM nginx:1.25-alpine
+FROM nginx:1.27-alpine
 
 COPY --from=builder-learning-dashboard /bbb-learning-dashboard/build /www/learning-analytics-dashboard/
 COPY --from=builder-playback /bbb-playback/build /www/playback/presentation/2.3
diff --git a/mod/nginx/bbb-html5.dev.nginx b/mod/nginx/bbb-html5.dev.nginx
index 17f82bf..aa3a4a6 100644
--- a/mod/nginx/bbb-html5.dev.nginx
+++ b/mod/nginx/bbb-html5.dev.nginx
@@ -3,6 +3,11 @@ location = /html5client/locales/ {
   alias /usr/share/bigbluebutton/html5-client/locales/;
   autoindex on;
   autoindex_format json;
+
+  # Prevent browsers from caching
+  add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+  add_header Pragma "no-cache";
+  add_header Expires 0;
 }
 
 # running from source (npm start)
diff --git a/mod/nginx/bbb/graphql.nginx b/mod/nginx/bbb/graphql.nginx
index 91ca2ff..526ce5f 100644
--- a/mod/nginx/bbb/graphql.nginx
+++ b/mod/nginx/bbb/graphql.nginx
@@ -24,7 +24,7 @@ location /api/rest/clientSettings {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "Upgrade";
     proxy_set_header Host $host;
-    proxy_pass http://bbb-graphql-server:8085; #Hasura
+    proxy_pass http://127.0.0.1:8185; #Hasura
 }
 
 location /api/rest/userMetadata {
@@ -35,5 +35,5 @@ location /api/rest/userMetadata {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "Upgrade";
     proxy_set_header Host $host;
-    proxy_pass http://bbb-graphql-server:8085; #Hasura
+    proxy_pass http://127.0.0.1:8185; #Hasura
 }
diff --git a/mod/nginx/bbb/web.nginx b/mod/nginx/bbb/web.nginx
index b7c9e69..5849527 100755
--- a/mod/nginx/bbb/web.nginx
+++ b/mod/nginx/bbb/web.nginx
@@ -159,7 +159,7 @@
             proxy_set_header        X-Original-URI $request_uri;
         }
 
-        location /bigbluebutton/ping {
+        location /bigbluebutton/rtt-check {
             default_type text/plain;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
             add_header Pragma "no-cache";
diff --git a/mod/nginx/bigbluebutton b/mod/nginx/bigbluebutton
index 33b3f32..58c5b20 100644
--- a/mod/nginx/bigbluebutton
+++ b/mod/nginx/bigbluebutton
@@ -59,3 +59,28 @@ server {
     send_timeout        6h;
   }
 }
+
+upstream hasura {
+    least_conn;
+    server bbb-graphql-server:8085;
+    # you might want to add more bbb-graphql-server@ instances to balance the
+    # load to multiple bbb-graphql-server instances. Execute 
+    # `systemctl enable --now bbb-graphql-server@8086` and uncomment the
+    # following line:
+    # server 127.0.0.1:8086;
+}
+server {
+    listen 10.7.7.1:8185;
+    listen 127.0.0.1:8185;
+
+    root /var/www/html;
+
+    location / {
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $host;
+
+	    proxy_pass http://hasura;
+    }
+}
\ No newline at end of file
diff --git a/mod/recordings/Dockerfile b/mod/recordings/Dockerfile
index 56c7d9f..828aa1d 100644
--- a/mod/recordings/Dockerfile
+++ b/mod/recordings/Dockerfile
@@ -38,7 +38,7 @@ ENV LANGUAGE en_US.UTF-8
 
 # compile and install mkclean
 RUN cd /tmp \
-    && wget https://netcologne.dl.sourceforge.net/project/matroska/mkclean/mkclean-0.8.10.tar.bz2 \
+    && wget https://phoenixnap.dl.sourceforge.net/project/matroska/mkclean/mkclean-0.8.10.tar.bz2 \
     && tar -xf /tmp/mkclean-0.8.10.tar.bz2 \
     && cd /tmp/mkclean-0.8.10 \
     && sed -i 's/\r//g' ./mkclean/configure.compiled \
@@ -54,7 +54,7 @@ RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VE
     && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
 
 # add yq for bbb-record
-RUN  wget -q https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq \
+RUN  wget -q https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_amd64 -O /usr/bin/yq \
     && chmod +x /usr/bin/yq
 
 RUN mkdir -p \
diff --git a/mod/webhooks/Dockerfile b/mod/webhooks/Dockerfile
index 69272af..e4b7ce3 100644
--- a/mod/webhooks/Dockerfile
+++ b/mod/webhooks/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:18-bookworm-slim AS builder
+FROM node:22-bookworm-slim AS builder
 
 
 RUN apt-get update && apt-get install -y git wget
@@ -12,7 +12,7 @@ RUN cd /bbb-webhooks && npm ci --omit=dev && rm -rf /bbb-webhooks./.git
 RUN chmod 777 /bbb-webhooks/config
 # ------------------------------
 
-FROM node:18-bookworm-slim
+FROM node:22-bookworm-slim
 RUN useradd --uid 2004 --user-group bbb-webhooks
 
 COPY --from=builder /usr/bin/yq /usr/bin/yq
diff --git a/mod/webrtc-sfu/Dockerfile b/mod/webrtc-sfu/Dockerfile
index 086b4e9..cd2ee00 100644
--- a/mod/webrtc-sfu/Dockerfile
+++ b/mod/webrtc-sfu/Dockerfile
@@ -4,11 +4,17 @@ FROM bigbluebutton/bbb-build:$BBB_BUILD_TAG AS builder
 
 RUN useradd --uid 2004 --user-group webrtc-sfu 
 
+# cache packages
+COPY --from=source /package.json /cache/package.json
+RUN cd /cache && npm install --unsafe-perm
+
 COPY --from=source / /app
 
 ENV NODE_ENV production
 
+
 RUN cd /app \
+  && rm -rf /app/node_modules && cp -a /cache/node_modules /app/node_modules \
  && cp config/default.example.yml config/production.yml \
  && npm install --unsafe-perm \
  && npm cache clear --force \
@@ -18,7 +24,7 @@ RUN cd /app \
 
 
 # =============================
-FROM node:18-bookworm-slim
+FROM node:22-bookworm-slim
 RUN useradd --uid 2004 --user-group webrtc-sfu 
 ENV NODE_ENV production
 
diff --git a/repos/bbb-etherpad-plugin b/repos/bbb-etherpad-plugin
index 927747e..88f3f6b 160000
--- a/repos/bbb-etherpad-plugin
+++ b/repos/bbb-etherpad-plugin
@@ -1 +1 @@
-Subproject commit 927747e0e18500f027a91bea2742e6061d388e28
+Subproject commit 88f3f6b06a1988436cb2edde5dc7e26e014e3a08
diff --git a/repos/bbb-playback b/repos/bbb-playback
index 4e11f93..4c8e316 160000
--- a/repos/bbb-playback
+++ b/repos/bbb-playback
@@ -1 +1 @@
-Subproject commit 4e11f9337cecb36400f8c41caa12431b2667d8bb
+Subproject commit 4c8e3166a9c059f9b553c4038ec4db99f85834d6
diff --git a/repos/bbb-webrtc-sfu b/repos/bbb-webrtc-sfu
index 6fbde34..0bda4b0 160000
--- a/repos/bbb-webrtc-sfu
+++ b/repos/bbb-webrtc-sfu
@@ -1 +1 @@
-Subproject commit 6fbde34c357ba656741842048e936611faf45a09
+Subproject commit 0bda4b00a2f680b2c1264591736512ac846e7914
diff --git a/repos/bigbluebutton b/repos/bigbluebutton
index c36e394..bf162e8 160000
--- a/repos/bigbluebutton
+++ b/repos/bigbluebutton
@@ -1 +1 @@
-Subproject commit c36e394e4aaa6be6c429222b7c9a86a8945b5563
+Subproject commit bf162e81fb427e8b2dfb9dbd1f9c120e3ac369d9
diff --git a/repos/tags b/repos/tags
index 1857b3b..065296c 100644
--- a/repos/tags
+++ b/repos/tags
@@ -3,11 +3,12 @@
 # used to determine submodule tags without the need for
 # checking out the whole submodule
 
-repos/bbb-etherpad-plugin 068ded5
+repos/bbb-etherpad-plugin 88f3f6b
 repos/bbb-etherpad-skin 8328b77
 repos/bbb-pads v1.5.3
-repos/bbb-playback v5.1.3
+repos/bbb-playback v5.2.1
 repos/bbb-webhooks v3.3.0
-repos/bbb-webrtc-sfu v2.17.0-alpha.1
-repos/bigbluebutton v3.0.0-beta.5
+repos/bbb-webrtc-recorder v0.7.0
+repos/bbb-webrtc-sfu v2.17.0-beta.4
+repos/bigbluebutton v3.0.0
 repos/freeswitch v1.10.12
diff --git a/scripts/bbb-record b/scripts/bbb-record
index 31071bd..5038a77 100755
--- a/scripts/bbb-record
+++ b/scripts/bbb-record
@@ -4,7 +4,7 @@ set -e
 cd $(dirname $0)/..
 
 # load .env
-. functions.sh
+. scripts/functions.sh
 load_env
 
 if [ ! "$ENABLE_RECORDING" == true ]; then
diff --git a/scripts/functions.sh b/scripts/functions.sh
index b2a71a0..5edb57a 100644
--- a/scripts/functions.sh
+++ b/scripts/functions.sh
@@ -16,6 +16,8 @@ function ensure_submodules {
     
 }
 
+# this file should exist, otherwise it is created by docker
+# with the wrong permissions
 function ensure_bbbhtml5yml {
     if [ ! -f conf/bbb-html5.yml ]; then
 
diff --git a/scripts/generate-compose b/scripts/generate-compose
index 5f61bab..81a546f 100755
--- a/scripts/generate-compose
+++ b/scripts/generate-compose
@@ -36,7 +36,7 @@ function get_tag {
 }
 
 # https://hub.docker.com/r/bigbluebutton/bbb-build
-BBB_BUILD_TAG=v3.0.x-release--2024-08-30-014114
+BBB_BUILD_TAG=v3.0.x-release--2025-02-06-143818
 
 docker run  \
     --rm  \