diff --git a/.github/workflows/offline.yml b/.github/workflows/offline.yml
index 0df59627c..ecc9b3957 100644
--- a/.github/workflows/offline.yml
+++ b/.github/workflows/offline.yml
@@ -98,6 +98,7 @@ jobs:
         run: nix-env -f default.nix -iA env
 
       - name: Install terraform
+        id: install-terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "^1.3.7"
@@ -109,7 +110,8 @@ jobs:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
 
       - name: Clean up hetzner environment; just in case
-        if: always()
+        # Skip when terraform was never installed (earlier step failed): nothing was deployed.
+        if: always() && steps.install-terraform.outcome == 'success'
         run: (cd terraform/examples/wire-server-deploy-offline-hetzner ; terraform init && terraform destroy -auto-approve)
         env:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
@@ -138,6 +140,7 @@ jobs:
         run: nix-env -f default.nix -iA env
 
       - name: Install terraform
+        id: install-terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "^1.3.7"
@@ -149,7 +152,8 @@ jobs:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
 
       - name: Clean up hetzner wiab-staging environment; just in case
-        if: always()
+        # Skip when terraform was never installed (earlier step failed): nothing was deployed.
+        if: always() && steps.install-terraform.outcome == 'success'
         run: (cd terraform/examples/wiab-staging-hetzner ; terraform init && terraform destroy -auto-approve)
         env:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
@@ -221,6 +225,7 @@ jobs:
           AWS_REGION: "eu-west-1"
 
       - name: Install terraform
+        id: install-terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "^1.3.7"
@@ -232,7 +237,8 @@ jobs:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
 
       - name: Clean up hetzner wiab environment; just in case
-        if: always()
+        # Skip when terraform was never installed (earlier step failed): nothing was deployed.
+        if: always() && steps.install-terraform.outcome == 'success'
         run: (cd terraform/examples/wiab-demo-hetzner ; terraform init && terraform destroy -auto-approve)
         env:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
diff --git a/changelog.d/2-wire-builds/dump-version-info b/changelog.d/2-wire-builds/dump-version-info
deleted file mode 100644
index 562586784..000000000
--- a/changelog.d/2-wire-builds/dump-version-info
+++ /dev/null
@@ -1 +0,0 @@
-Added: Dump version information post creating the artifacts on the stdout
diff --git a/changelog.d/2-wire-builds/release-5.38 b/changelog.d/2-wire-builds/release-5.38
new file mode 100644
index 000000000..ca29608e1
--- /dev/null
+++ b/changelog.d/2-wire-builds/release-5.38
@@ -0,0 +1 @@
+Fixed: update reference for 5.38
\ No newline at end of file
diff --git a/changelog.d/5-bug-fixes/cd-default-wait-for-adminhost b/changelog.d/5-bug-fixes/cd-default-wait-for-adminhost
new file mode 100644
index 000000000..be225e21e
--- /dev/null
+++ b/changelog.d/5-bug-fixes/cd-default-wait-for-adminhost
@@ -0,0 +1 @@
+Fixed: wait for SSH on the adminhost private IP before running setup_nodes.yml in the default Hetzner CD environment (same as wiab-staging, #919)
diff --git a/changelog.d/5-bug-fixes/fix-minio-image b/changelog.d/5-bug-fixes/fix-minio-image
new file mode 100644
index 000000000..7cfb278d2
--- /dev/null
+++ b/changelog.d/5-bug-fixes/fix-minio-image
@@ -0,0 +1 @@
+Fixed: use mirror for fetching unavailable Minio images
diff --git a/changelog.d/5-bug-fixes/hetzner-datacenters-removed b/changelog.d/5-bug-fixes/hetzner-datacenters-removed
new file mode 100644
index 000000000..8e4167f79
--- /dev/null
+++ b/changelog.d/5-bug-fixes/hetzner-datacenters-removed
@@ -0,0 +1 @@
+Fixed: Replace removed Hetzner `hcloud_datacenters` data source (HTTP 410 since 2026-10-01) with `hcloud_locations` in the CD terraform modules and pin the hcloud provider to `~> 1.70`
diff --git a/offline/cd.sh b/offline/cd.sh
index 069566d94..a67e9f211 100755
--- a/offline/cd.sh
+++ b/offline/cd.sh
@@ -11,6 +11,8 @@ COMMIT_HASH="${GITHUB_SHA}"
 ARTIFACT="wire-server-deploy-static-${COMMIT_HASH}"
 
 # Retry matrix
+# Locations are tried in order and exhaust all server types before moving on.
+# Prefer hel1: German locations rarely have capacity.
 LOCATIONS=("hel1" "fsn1" "nbg1")
 SMALL_SERVER_TYPES=("cx23" "cx33" "cpx22")
 MEDIUM_SERVER_TYPES=("cx33" "cx43" "cpx32")
@@ -68,8 +70,8 @@ echo "Retry plan: ${location_count} locations x ${server_type_count} server type
 attempt=1
 deployment_succeeded=false
 
-for server_type_index in $(seq 0 $((server_type_count - 1))); do
-    for location_index in $(seq 0 $((location_count - 1))); do
+for location_index in $(seq 0 $((location_count - 1))); do
+    for server_type_index in $(seq 0 $((server_type_count - 1))); do
         attempt_location="${LOCATIONS[$location_index]}"
         attempt_small_server_type="${SMALL_SERVER_TYPES[$server_type_index]}"
         attempt_medium_server_type="${MEDIUM_SERVER_TYPES[$server_type_index]}"
diff --git a/offline/cd_demo.sh b/offline/cd_demo.sh
index d9b0ed932..2ce41674a 100755
--- a/offline/cd_demo.sh
+++ b/offline/cd_demo.sh
@@ -16,6 +16,8 @@ TEST_USER="demo"
 COMMIT_HASH="${GITHUB_SHA}"
 
 # Retry matrix
+# Locations are tried in order and exhaust all server types before moving on.
+# Prefer hel1: German locations rarely have capacity.
 LOCATIONS=("hel1" "fsn1" "nbg1")
 SERVER_TYPES=("cx53" "cpx62")
 
@@ -62,8 +64,8 @@ echo "Retry plan: ${location_count} locations x ${server_type_count} server type
 attempt=1
 deployment_succeeded=false
 
-for server_type_index in $(seq 0 $((server_type_count - 1))); do
-	for location_index in $(seq 0 $((location_count - 1))); do
+for location_index in $(seq 0 $((location_count - 1))); do
+	for server_type_index in $(seq 0 $((server_type_count - 1))); do
 		attempt_location="${LOCATIONS[$location_index]}"
 		attempt_server_type="${SERVER_TYPES[$server_type_index]}"
 
diff --git a/offline/cd_staging.sh b/offline/cd_staging.sh
index cd4d2ccbc..dc344a4db 100755
--- a/offline/cd_staging.sh
+++ b/offline/cd_staging.sh
@@ -10,6 +10,8 @@ COMMIT_HASH="${GITHUB_SHA}"
 ARTIFACT="wire-server-deploy-static-${COMMIT_HASH}"
 
 # Retry matrix
+# Locations are tried in order and exhaust all server types before moving on.
+# Prefer hel1: German locations rarely have capacity.
 LOCATIONS=("hel1" "nbg1" "fsn1")
 SMALL_SERVER_TYPES=("cpx22" "cpx32" "cpx42")
 MEDIUM_SERVER_TYPES=("cpx42" "cpx52" "cpx62")
@@ -67,8 +69,8 @@ echo "Starting deployment with automatic retry on resource unavailability..."
 attempt=1
 deployment_succeeded=false
 
-for server_type_index in $(seq 0 $((server_type_count - 1))); do
-    for location_index in $(seq 0 $((location_count - 1))); do
+for location_index in $(seq 0 $((location_count - 1))); do
+    for server_type_index in $(seq 0 $((server_type_count - 1))); do
         attempt_location="${LOCATIONS[$location_index]}"
         attempt_small_server_type="${SMALL_SERVER_TYPES[$server_type_index]}"
         attempt_medium_server_type="${MEDIUM_SERVER_TYPES[$server_type_index]}"
diff --git a/offline/default-build/build.sh b/offline/default-build/build.sh
index 239b5937c..93b4d14f0 100755
--- a/offline/default-build/build.sh
+++ b/offline/default-build/build.sh
@@ -26,7 +26,7 @@ TASKS_DIR="${SCRIPT_DIR}/../tasks"
 # --------------------------
 
 # pulling the charts based on builds.json, charts to be skipped are passed as arguments HELM_CHART_EXCLUDE_LIST
-"${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit"
+"${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit,fake-aws-s3"
 
 # pulling the charts from helm-charts repo, charts to be included are passed as arguments HELM_CHART_INCLUDE_LIST
 # "${TASKS_DIR}"/proc_pull_ext_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_INCLUDE_LIST="postgresql-external"
diff --git a/offline/tasks/proc_pull_charts.sh b/offline/tasks/proc_pull_charts.sh
index fa3c60da9..577934f62 100755
--- a/offline/tasks/proc_pull_charts.sh
+++ b/offline/tasks/proc_pull_charts.sh
@@ -85,5 +85,5 @@ pull_charts() {
 
 }
 
-wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/refs/heads/pinned-offline-5.34.0/build.json"
+wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/223f0cad2211287f9ebaed38ae4df4c5fdc01eb9/build.json"
 wire_build_chart_release "$wire_build" | pull_charts
diff --git a/terraform/examples/wiab-demo-hetzner/main.tf b/terraform/examples/wiab-demo-hetzner/main.tf
index e667fecd1..1824c4652 100644
--- a/terraform/examples/wiab-demo-hetzner/main.tf
+++ b/terraform/examples/wiab-demo-hetzner/main.tf
@@ -15,11 +15,11 @@ variable "server_type" {
 
 # Get available server types and locations
 data "hcloud_server_types" "available" {}
-data "hcloud_datacenters" "available" {}
+data "hcloud_locations" "available" {}
 
 locals {
   available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name]
-  available_location_names    = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name]
+  available_location_names    = [for l in data.hcloud_locations.available.locations : l.name]
 }
 
 resource "null_resource" "location_validation" {
diff --git a/terraform/examples/wiab-demo-hetzner/versions.tf b/terraform/examples/wiab-demo-hetzner/versions.tf
index b047ba54e..9260675da 100644
--- a/terraform/examples/wiab-demo-hetzner/versions.tf
+++ b/terraform/examples/wiab-demo-hetzner/versions.tf
@@ -1,7 +1,8 @@
 terraform {
   required_providers {
     hcloud = {
-      source = "hetznercloud/hcloud"
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.70"
     }
   }
   required_version = "~> 1.1"
diff --git a/terraform/examples/wiab-staging-hetzner/main.tf b/terraform/examples/wiab-staging-hetzner/main.tf
index 5fb916526..65d7e5e54 100644
--- a/terraform/examples/wiab-staging-hetzner/main.tf
+++ b/terraform/examples/wiab-staging-hetzner/main.tf
@@ -25,12 +25,12 @@ variable "medium_server_type" {
 
 # Get available server types and locations
 data "hcloud_server_types" "available" {}
-data "hcloud_datacenters" "available" {}
+data "hcloud_locations" "available" {}
 
 # Validate the exact combination requested by the deployment script.
 locals {
   available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name]
-  available_location_names    = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name]
+  available_location_names    = [for l in data.hcloud_locations.available.locations : l.name]
 }
 
 resource "null_resource" "location_validation" {
diff --git a/terraform/examples/wiab-staging-hetzner/versions.tf b/terraform/examples/wiab-staging-hetzner/versions.tf
index b047ba54e..9260675da 100644
--- a/terraform/examples/wiab-staging-hetzner/versions.tf
+++ b/terraform/examples/wiab-staging-hetzner/versions.tf
@@ -1,7 +1,8 @@
 terraform {
   required_providers {
     hcloud = {
-      source = "hetznercloud/hcloud"
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.70"
     }
   }
   required_version = "~> 1.1"
diff --git a/terraform/examples/wire-server-deploy-offline-hetzner/main.tf b/terraform/examples/wire-server-deploy-offline-hetzner/main.tf
index 657f6ed0c..de792a0d0 100644
--- a/terraform/examples/wire-server-deploy-offline-hetzner/main.tf
+++ b/terraform/examples/wire-server-deploy-offline-hetzner/main.tf
@@ -29,12 +29,12 @@ variable "medium_server_type" {
 
 # Get available server types and locations
 data "hcloud_server_types" "available" {}
-data "hcloud_datacenters" "available" {}
+data "hcloud_locations" "available" {}
 
 # Validate the exact combination requested by the deployment script.
 locals {
   available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name]
-  available_location_names    = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name]
+  available_location_names    = [for l in data.hcloud_locations.available.locations : l.name]
 }
 
 resource "null_resource" "location_validation" {
diff --git a/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml b/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml
index 316e2d97d..f7c2d9be7 100644
--- a/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml
+++ b/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml
@@ -1,4 +1,20 @@
 ---
+- name: Wait for adminhost private SSH
+  hosts: adminhost
+  gather_facts: no
+  tasks:
+    - name: Wait for SSH on public adminhost
+      wait_for_connection:
+        timeout: 300
+        delay: 5
+
+    - name: Wait until adminhost private IP is reachable from public adminhost
+      wait_for:
+        host: "{{ hostvars['adminhost_local'].ansible_host }}"
+        port: 22
+        timeout: 300
+        delay: 5
+
 - name: Setup adminhost with dnsmasq and Docker
   hosts: adminhost_local
   become: yes
diff --git a/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf b/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf
index b047ba54e..9260675da 100644
--- a/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf
+++ b/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf
@@ -1,7 +1,8 @@
 terraform {
   required_providers {
     hcloud = {
-      source = "hetznercloud/hcloud"
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.70"
     }
   }
   required_version = "~> 1.1"
diff --git a/values/fake-aws-s3/demo-secrets.example.yaml b/values/fake-aws-s3/demo-secrets.example.yaml
new file mode 100644
index 000000000..654cf13fa
--- /dev/null
+++ b/values/fake-aws-s3/demo-secrets.example.yaml
@@ -0,0 +1,6 @@
+# Disable since prod should use an externally provided minio
+minio:
+  users:
+    - accessKey: dummykey
+      secretKey: dummysecret
+      policy: consoleAdmin
diff --git a/values/fake-aws-s3/demo-values.example.yaml b/values/fake-aws-s3/demo-values.example.yaml
new file mode 100644
index 000000000..a6f24ad0a
--- /dev/null
+++ b/values/fake-aws-s3/demo-values.example.yaml
@@ -0,0 +1,8 @@
+enabled: true
+minio:
+  image:
+    repository: quay.io/wire/mirror-images/minio/minio
+    tag: RELEASE.2023-07-07T07-13-57Z
+  mcImage:
+    repository: quay.io/wire/mirror-images/minio/mc
+    tag: RELEASE.2023-06-28T21-54-17Z
diff --git a/values/fake-aws-s3/prod-values.example.yaml b/values/fake-aws-s3/prod-values.example.yaml
new file mode 100644
index 000000000..c03722b48
--- /dev/null
+++ b/values/fake-aws-s3/prod-values.example.yaml
@@ -0,0 +1,9 @@
+# Disable since prod should use an externally provided minio
+enabled: false
+minio:
+  image:
+    repository: quay.io/wire/mirror-images/minio/minio
+    tag: RELEASE.2023-07-07T07-13-57Z
+  mcImage:
+    repository: quay.io/wire/mirror-images/minio/mc
+    tag: RELEASE.2023-06-28T21-54-17Z
diff --git a/values/fake-aws/demo-secrets.example.yaml b/values/fake-aws/demo-secrets.example.yaml
index 2f475508e..a27832bd5 100644
--- a/values/fake-aws/demo-secrets.example.yaml
+++ b/values/fake-aws/demo-secrets.example.yaml
@@ -1,4 +1,3 @@
-# Disable since prod should use an externally provided minio
 fake-aws-s3:
   enabled: true
   minio:
diff --git a/values/fake-aws/demo-values.example.yaml b/values/fake-aws/demo-values.example.yaml
index ad09d557a..21509f24c 100644
--- a/values/fake-aws/demo-values.example.yaml
+++ b/values/fake-aws/demo-values.example.yaml
@@ -1,3 +1,9 @@
-# Disable since prod should use an externally provided minio
 fake-aws-s3:
   enabled: true
+  minio:
+    image:
+      repository: quay.io/wire/mirror-images/minio/minio
+      tag: RELEASE.2023-07-07T07-13-57Z
+    mcImage:
+      repository: quay.io/wire/mirror-images/minio/mc
+      tag: RELEASE.2023-06-28T21-54-17Z
diff --git a/values/fake-aws/prod-values.example.yaml b/values/fake-aws/prod-values.example.yaml
index 594c756af..998eeba6e 100644
--- a/values/fake-aws/prod-values.example.yaml
+++ b/values/fake-aws/prod-values.example.yaml
@@ -1,3 +1,10 @@
 # Disable since prod should use an externally provided minio
 fake-aws-s3:
   enabled: false
+  minio:
+    image:
+      repository: quay.io/wire/mirror-images/minio/minio
+      tag: RELEASE.2023-07-07T07-13-57Z
+    mcImage:
+      repository: quay.io/wire/mirror-images/minio/mc
+      tag: RELEASE.2023-06-28T21-54-17Z
diff --git a/values/reaper/demo-values.example.yaml b/values/reaper/demo-values.example.yaml
index 79e1a22a3..9f1db84ea 100644
--- a/values/reaper/demo-values.example.yaml
+++ b/values/reaper/demo-values.example.yaml
@@ -1,6 +1,4 @@
 image:
   registry: docker.io
-  # Override kubectl image to use available version in bitnamilegacy
-  # Using the last available version in 1.32.x series
-  repository: bitnamilegacy/kubectl
-  tag: 1.32.4
+  repository: alpine/kubectl
+  tag: 1.36.3
diff --git a/values/reaper/prod-values.example.yaml b/values/reaper/prod-values.example.yaml
index 79e1a22a3..9f1db84ea 100644
--- a/values/reaper/prod-values.example.yaml
+++ b/values/reaper/prod-values.example.yaml
@@ -1,6 +1,4 @@
 image:
   registry: docker.io
-  # Override kubectl image to use available version in bitnamilegacy
-  # Using the last available version in 1.32.x series
-  repository: bitnamilegacy/kubectl
-  tag: 1.32.4
+  repository: alpine/kubectl
+  tag: 1.36.3
diff --git a/values/sftd/demo-values.example.yaml b/values/sftd/demo-values.example.yaml
index 91dc2c885..d7841479d 100644
--- a/values/sftd/demo-values.example.yaml
+++ b/values/sftd/demo-values.example.yaml
@@ -4,9 +4,9 @@ replicaCount: 1
 joinCall:
   replicaCount: 1
   image:
-    repository: docker.io/bitnamilegacy/nginx
+    repository: nginxinc/nginx-unprivileged
     pullPolicy: IfNotPresent
-    tag: "1.27.3-debian-12-r5"
+    tag: "1.29.5-alpine3.23-perl"
 tls:
   issuerRef:
     name: letsencrypt-http01
diff --git a/values/sftd/prod-values.example.yaml b/values/sftd/prod-values.example.yaml
index 1c2374f9e..9a2445459 100644
--- a/values/sftd/prod-values.example.yaml
+++ b/values/sftd/prod-values.example.yaml
@@ -15,9 +15,9 @@ joinCall:
 # replicaCount = 1 is to support the simple wiab-staging solution
   replicaCount: 1
   image:
-    repository: docker.io/bitnamilegacy/nginx
+    repository: nginxinc/nginx-unprivileged
     pullPolicy: IfNotPresent
-    tag: "1.27.3-debian-12-r5"
+    tag: "1.29.5-alpine3.23-perl"
 
 # Uncomment to enable SFT to SFT communication for federated calls
 # multiSFT: