diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
new file mode 100644
index 000000000000..67ce5d23f4fb
--- /dev/null
+++ b/.github/workflows/backport.yml
@@ -0,0 +1,26 @@
+name: Backport
+on:
+  pull_request_target:
+    types:
+      - closed
+      - labeled
+
+jobs:
+  backport:
+    name: Backport
+    runs-on: ubuntu-latest
+    # Only react to merged PRs for security reasons.
+    # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
+    if: >
+      github.event.pull_request.merged
+      && (
+        github.event.action == 'closed'
+        || (
+          github.event.action == 'labeled'
+          && contains(github.event.label.name, 'backport')
+        )
+      )
+    steps:
+      - uses: sourcegraph/backport@v2
+        with:
+          github_token: ${{ secrets.BACKPORT_GITHUB_TOKEN }}
diff --git a/base/redis/redis-cache.Deployment.yaml b/base/redis/redis-cache.Deployment.yaml
index ce0adac607ba..b1598dc52d4d 100644
--- a/base/redis/redis-cache.Deployment.yaml
+++ b/base/redis/redis-cache.Deployment.yaml
@@ -26,7 +26,11 @@ spec:
     spec:
       containers:
       - name: redis-cache
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/redis-cache:5.9.1590@sha256:aca0a5616ef20c955aeca2e71034e0d4dd65e899716cdc08d72ef1ce1fa9564f
+=======
+        image: index.docker.io/sourcegraph/redis-cache:5.9.347@sha256:a9ff1251eb3c4e8934516bb7266eb131b8ef2a8cc715a1841baea4bedce75341
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         livenessProbe:
           initialDelaySeconds: 30
@@ -66,7 +70,11 @@ spec:
         - mountPath: /redis-data
           name: redis-data
       - name: redis-exporter
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/redis_exporter:5.9.1590@sha256:8b05fb7f8ff16aa68d05ef6750672fe2a4a9c2358d9b91a10db1327bd5d0cac1
+=======
+        image: index.docker.io/sourcegraph/redis_exporter:5.9.347@sha256:f5f1b1e78c6812b91185418c38497930eed16fd5d0633518ef5c73d6a98c1f1f
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         ports:
         - containerPort: 9121
diff --git a/base/redis/redis-store.Deployment.yaml b/base/redis/redis-store.Deployment.yaml
index 664211d5f822..bea893a2cfeb 100644
--- a/base/redis/redis-store.Deployment.yaml
+++ b/base/redis/redis-store.Deployment.yaml
@@ -25,7 +25,11 @@ spec:
     spec:
       containers:
       - name: redis-store
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/redis-store:5.9.1590@sha256:d7d8b5cd4d784b6f8025941701f6db95e0d3ea263e165b611295d30bdc0e6e60
+=======
+        image: index.docker.io/sourcegraph/redis-store:5.9.347@sha256:2364359b9fdeb53e25831e0ff3783867a74333c6cc4df4f5d272e3eb87356cd1
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         livenessProbe:
           initialDelaySeconds: 30
@@ -65,7 +69,11 @@ spec:
         - mountPath: /redis-data
           name: redis-data
       - name: redis-exporter
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/redis_exporter:5.9.1590@sha256:8b05fb7f8ff16aa68d05ef6750672fe2a4a9c2358d9b91a10db1327bd5d0cac1
+=======
+        image: index.docker.io/sourcegraph/redis_exporter:5.9.347@sha256:f5f1b1e78c6812b91185418c38497930eed16fd5d0633518ef5c73d6a98c1f1f
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         ports:
         - containerPort: 9121
diff --git a/base/repo-updater/repo-updater.Deployment.yaml b/base/repo-updater/repo-updater.Deployment.yaml
index 2903ebde0145..434336e76779 100644
--- a/base/repo-updater/repo-updater.Deployment.yaml
+++ b/base/repo-updater/repo-updater.Deployment.yaml
@@ -29,7 +29,11 @@ spec:
     spec:
       containers:
       - name: repo-updater
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/repo-updater:5.9.1590@sha256:d8ec1e1487ed803d07f9fb0dfa2db0a4a637871fa7ba778378749a398de724d9
+=======
+        image: index.docker.io/sourcegraph/repo-updater:5.9.347@sha256:093e0e0e9f717bd26b3309a59d69238e5ae8caf60b84f11c4d49a4ffb5437db5
+>>>>>>> main
         env:
         # OTEL_AGENT_HOST must be defined before OTEL_EXPORTER_OTLP_ENDPOINT to substitute the node IP on which the DaemonSet pod instance runs in the latter variable
         - name: OTEL_AGENT_HOST
diff --git a/base/searcher/searcher.Deployment.yaml b/base/searcher/searcher.Deployment.yaml
index 59b5aeecf109..b269d7614c94 100644
--- a/base/searcher/searcher.Deployment.yaml
+++ b/base/searcher/searcher.Deployment.yaml
@@ -49,7 +49,11 @@ spec:
               fieldPath: status.hostIP
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: http://$(OTEL_AGENT_HOST):4317
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/searcher:5.9.1590@sha256:76173ca0542622c390c5ae2af2cf8e40a9b175f01dc4a9c931285ac2cfd88854
+=======
+        image: index.docker.io/sourcegraph/searcher:5.9.347@sha256:6ef2e798c158a8129f1a6a4206ec4eff31b6f4bbf2a52ef22ecdd6e64fa013b7
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         ports:
         - containerPort: 3181
diff --git a/base/symbols/symbols.Deployment.yaml b/base/symbols/symbols.Deployment.yaml
index 46e9c19308a5..1f990fc93393 100644
--- a/base/symbols/symbols.Deployment.yaml
+++ b/base/symbols/symbols.Deployment.yaml
@@ -49,7 +49,11 @@ spec:
               fieldPath: status.hostIP
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: http://$(OTEL_AGENT_HOST):4317
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/symbols:5.9.1590@sha256:f4c570b42fbdedc132010c94f1d20fa286c09b255b4bc57e51885b41dd4ea886
+=======
+        image: index.docker.io/sourcegraph/symbols:5.9.347@sha256:ed5f4c5db70dd0f256f332f30a93b91c0d32de0686b531c7b377f1da33d3bc42
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         livenessProbe:
           httpGet:
diff --git a/base/syntect-server/syntect-server.Deployment.yaml b/base/syntect-server/syntect-server.Deployment.yaml
index 51d17108797f..93f6fbd4e041 100644
--- a/base/syntect-server/syntect-server.Deployment.yaml
+++ b/base/syntect-server/syntect-server.Deployment.yaml
@@ -29,7 +29,11 @@ spec:
       containers:
       - name: syntect-server
         env:
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/syntax-highlighter:5.9.1590@sha256:7a15d6fd63d0d6a39f9066209f3c406674b41cf1d365e172cc30cd877e7c0885
+=======
+        image: index.docker.io/sourcegraph/syntax-highlighter:5.9.347@sha256:068144989c8afa62db3dcb45bc86697f6da84e376ac42d4c25b794c2b8b3c97c
+>>>>>>> main
         terminationMessagePolicy: FallbackToLogsOnError
         livenessProbe:
           httpGet:
diff --git a/base/worker/worker.Deployment.yaml b/base/worker/worker.Deployment.yaml
index 493436c4de48..ba02f2907b8b 100644
--- a/base/worker/worker.Deployment.yaml
+++ b/base/worker/worker.Deployment.yaml
@@ -44,7 +44,11 @@ spec:
               fieldPath: status.hostIP
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: http://$(OTEL_AGENT_HOST):4317
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/worker:5.9.1590@sha256:b258021d297a7a562982a5606507d4e4ddb27ebe010f3fdbbda20ab7f0a9f4fc
+=======
+        image: index.docker.io/sourcegraph/worker:5.9.347@sha256:b4b01b6ee35420743ac2c7492d19e0479d151be84b850c96bc96a52a88e2f1dd
+>>>>>>> main
         envFrom:
         - configMapRef:
             name: embeddings-backend
diff --git a/configure/executors/dind/executor.Deployment.yaml b/configure/executors/dind/executor.Deployment.yaml
index 703ac250198c..0a60f4019c05 100644
--- a/configure/executors/dind/executor.Deployment.yaml
+++ b/configure/executors/dind/executor.Deployment.yaml
@@ -28,7 +28,11 @@ spec:
     spec:
       containers:
         - name: executor
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/executor:5.9.1590@sha256:131141c304cceadcfe7afbe73f909d1202c39140225e3e9476963ffbd9eb3214
+=======
+          image: index.docker.io/sourcegraph/executor:5.9.347@sha256:1fd0a18a6ee868f683f7307489c872650f21fb0894a83aef203702ad68d959fc
+>>>>>>> main
           imagePullPolicy: Always
           livenessProbe:
             exec:
@@ -67,7 +71,11 @@ spec:
             - mountPath: /scratch
               name: executor-scratch
         - name: dind
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/dind:5.9.1590@sha256:c62ec47598121a42d0fd58ed03b38e564616db19b2bbb205d55e2d604e3b9a67
+=======
+          image: index.docker.io/sourcegraph/dind:5.9.347@sha256:767c8e7b60ab71957a500745155ca0a3c6f5e96083e101c6497526413314d07f
+>>>>>>> main
           imagePullPolicy: Always
           securityContext:
             privileged: true
diff --git a/configure/executors/k8s/executor.Deployment.yaml b/configure/executors/k8s/executor.Deployment.yaml
index 2435df9ed060..2f98510c0db0 100644
--- a/configure/executors/k8s/executor.Deployment.yaml
+++ b/configure/executors/k8s/executor.Deployment.yaml
@@ -29,7 +29,11 @@ spec:
       serviceAccountName: executor
       containers:
         - name: executor
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/executor-kubernetes:5.9.1590@sha256:0100406b8647f1f1f7959168871ab78ed6cfbf1d7df62bf201de0bd58bf835f9
+=======
+          image: index.docker.io/sourcegraph/executor-kubernetes:5.9.347@sha256:f393592d65e5058fb265e281ca8acb8e9f2bddc8d91b48d28d78490515505797
+>>>>>>> main
           imagePullPolicy: Always
           livenessProbe:
             exec:
diff --git a/configure/migrator/migrator.Job.yaml b/configure/migrator/migrator.Job.yaml
index 0e82e765db78..8a1dbe13c614 100644
--- a/configure/migrator/migrator.Job.yaml
+++ b/configure/migrator/migrator.Job.yaml
@@ -12,7 +12,11 @@ spec:
     spec:
       containers:
       - name: migrator
+<<<<<<< HEAD
         image: "index.docker.io/sourcegraph/migrator:5.9.1590@sha256:7031d742e1eeb7843aa9a9af4165c96b59776da0d630742b77fb805f12864ac6"
+=======
+        image: "index.docker.io/sourcegraph/migrator:5.9.347@sha256:a2a90a003c12643e40256dc4a3a80cd6a1854b67d487b5f8ef7a3cfb6b5a0c93"
+>>>>>>> main
         args: ["up"]
         env:
         - name: PGHOST
diff --git a/overlays/jaeger/jaeger.Deployment.yaml b/overlays/jaeger/jaeger.Deployment.yaml
index 74d068b90d8c..7a4bf6f4ac7a 100644
--- a/overlays/jaeger/jaeger.Deployment.yaml
+++ b/overlays/jaeger/jaeger.Deployment.yaml
@@ -30,7 +30,11 @@ spec:
     spec:
       containers:
       - name: jaeger
+<<<<<<< HEAD
         image: index.docker.io/sourcegraph/jaeger-all-in-one:5.9.1590@sha256:58bf91017d27e766374cfe4c4d526138fad5ca93944ae46aca1760fdbc7edf75
+=======
+        image: index.docker.io/sourcegraph/jaeger-all-in-one:5.9.347@sha256:5ab8468ff65c055abb7aaba15a8bca44f40835efa59117c734517779f4f8863c
+>>>>>>> main
         args: ["--memory.max-traces=20000", "--sampling.strategies-file=/etc/jaeger/sampling_strategies.json", "--collector.otlp.enabled"]
         ports:
         - containerPort: 5775
diff --git a/overlays/migrate-to-nonprivileged/blobstore/blobstore.Deployment.yaml b/overlays/migrate-to-nonprivileged/blobstore/blobstore.Deployment.yaml
index 33c603fa84f9..4797b5101f85 100644
--- a/overlays/migrate-to-nonprivileged/blobstore/blobstore.Deployment.yaml
+++ b/overlays/migrate-to-nonprivileged/blobstore/blobstore.Deployment.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "chown -R 100:101 /data"]
           volumeMounts:
             - mountPath: /data
diff --git a/overlays/migrate-to-nonprivileged/gitserver/gitserver.StatefulSet.yaml b/overlays/migrate-to-nonprivileged/gitserver/gitserver.StatefulSet.yaml
index b48200adb7b7..3258ba5019ee 100644
--- a/overlays/migrate-to-nonprivileged/gitserver/gitserver.StatefulSet.yaml
+++ b/overlays/migrate-to-nonprivileged/gitserver/gitserver.StatefulSet.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "if [[ \"$(stat -c '%u' /data/repos)\" -ne 100 ]]; then chown -R 100:101 /data/repos; fi"]
           volumeMounts:
             - mountPath: /data/repos
diff --git a/overlays/migrate-to-nonprivileged/grafana/grafana.StatefulSet.yaml b/overlays/migrate-to-nonprivileged/grafana/grafana.StatefulSet.yaml
index e6d49bd7567f..34af3f8f1df1 100644
--- a/overlays/migrate-to-nonprivileged/grafana/grafana.StatefulSet.yaml
+++ b/overlays/migrate-to-nonprivileged/grafana/grafana.StatefulSet.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "chown -R 472:472 /var/lib/grafana"]
           volumeMounts:
             - mountPath: /var/lib/grafana
diff --git a/overlays/migrate-to-nonprivileged/indexed-search/indexed-search.StatefulSet.yaml b/overlays/migrate-to-nonprivileged/indexed-search/indexed-search.StatefulSet.yaml
index cc94ba12749f..39cefc548609 100644
--- a/overlays/migrate-to-nonprivileged/indexed-search/indexed-search.StatefulSet.yaml
+++ b/overlays/migrate-to-nonprivileged/indexed-search/indexed-search.StatefulSet.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "chown -R 100:101 /data"]
           volumeMounts:
             - mountPath: /data
diff --git a/overlays/migrate-to-nonprivileged/prometheus/prometheus.Deployment.yaml b/overlays/migrate-to-nonprivileged/prometheus/prometheus.Deployment.yaml
index d5eb1f43c6d6..67ea4b2a96ac 100644
--- a/overlays/migrate-to-nonprivileged/prometheus/prometheus.Deployment.yaml
+++ b/overlays/migrate-to-nonprivileged/prometheus/prometheus.Deployment.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "chown -R 100:100 /prometheus"]
           volumeMounts:
             - mountPath: /prometheus
diff --git a/overlays/migrate-to-nonprivileged/redis/redis-cache.Deployment.yaml b/overlays/migrate-to-nonprivileged/redis/redis-cache.Deployment.yaml
index 79e43a79fcb3..c42fdb9ba2c0 100644
--- a/overlays/migrate-to-nonprivileged/redis/redis-cache.Deployment.yaml
+++ b/overlays/migrate-to-nonprivileged/redis/redis-cache.Deployment.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "chown -R 999:1000 /redis-data"]
           volumeMounts:
             - mountPath: /redis-data
diff --git a/overlays/migrate-to-nonprivileged/redis/redis-store.Deployment.yaml b/overlays/migrate-to-nonprivileged/redis/redis-store.Deployment.yaml
index 99e3cb3cce5c..f0d70976ad2e 100644
--- a/overlays/migrate-to-nonprivileged/redis/redis-store.Deployment.yaml
+++ b/overlays/migrate-to-nonprivileged/redis/redis-store.Deployment.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-file-ownership
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "chown -R 999:1000 /redis-data"]
           volumeMounts:
             - mountPath: /redis-data
diff --git a/overlays/migrate-to-nonprivileged/searcher/searcher.Deployment.yaml b/overlays/migrate-to-nonprivileged/searcher/searcher.Deployment.yaml
index 2ed8270322f6..4b3fd94c012c 100644
--- a/overlays/migrate-to-nonprivileged/searcher/searcher.Deployment.yaml
+++ b/overlays/migrate-to-nonprivileged/searcher/searcher.Deployment.yaml
@@ -7,7 +7,11 @@ spec:
     spec:
       initContainers:
         - name: transfer-cache
+<<<<<<< HEAD
           image: index.docker.io/sourcegraph/alpine-3.14:5.9.1590@sha256:542e92925d9aa6d62f1f741e8422ef22f29a13b8cf96c2fce118af06eb882742
+=======
+          image: index.docker.io/sourcegraph/alpine-3.14:5.9.347@sha256:b4d78b475c4eb1fa4e592338bf619939d574b0ac7056df4d96533748c5c06560
+>>>>>>> main
           command: ["sh", "-c", "if [[ \"$(stat -c '%u' /mnt/cache)\" -ne 100 ]]; then chown -R 100:101 /mnt/cache; fi"]
           volumeMounts:
             - mountPath: /mnt/cache