diff --git a/framework/app-service/.olares/config/cluster/deploy/appservice_deploy.yaml b/framework/app-service/.olares/config/cluster/deploy/appservice_deploy.yaml
index f6bf77ebc..96fb2699c 100644
--- a/framework/app-service/.olares/config/cluster/deploy/appservice_deploy.yaml
+++ b/framework/app-service/.olares/config/cluster/deploy/appservice_deploy.yaml
@@ -163,7 +163,7 @@ spec:
       priorityClassName: "system-cluster-critical"
       containers:
       - name: app-service
-        image: beclab/app-service:0.3.52
+        image: beclab/app-service:0.3.53
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsUser: 0
diff --git a/framework/authelia/.olares/config/cluster/deploy/auth_backend_deploy.yaml b/framework/authelia/.olares/config/cluster/deploy/auth_backend_deploy.yaml
index ccc0c7a28..1ee5f6675 100644
--- a/framework/authelia/.olares/config/cluster/deploy/auth_backend_deploy.yaml
+++ b/framework/authelia/.olares/config/cluster/deploy/auth_backend_deploy.yaml
@@ -367,7 +367,7 @@ spec:
           privileged: true
       containers:      
       - name: authelia
-        image: beclab/auth:0.2.15
+        image: beclab/auth:0.2.16
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9091
diff --git a/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml b/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml
index cc1dba496..1c61483c8 100644
--- a/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml
+++ b/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml
@@ -266,7 +266,7 @@ spec:
 
       containers:
       - name: api
-        image: beclab/bfl:v0.4.18
+        image: beclab/bfl:v0.4.19
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsUser: 1000
@@ -310,7 +310,7 @@ spec:
         - name: BACKUP_SERVER
           value: backup-server.os-framework:8082
         - name: L4_PROXY_IMAGE_VERSION
-          value: v0.3.0
+          value: v0.3.1
         - name: L4_PROXY_SERVICE_ACCOUNT
           value: os-network-internal
         - name: L4_PROXY_NAMESPACE
diff --git a/framework/headscale/.olares/config/user/helm-charts/headscale/templates/headscale_deploy.yaml b/framework/headscale/.olares/config/user/helm-charts/headscale/templates/headscale_deploy.yaml
index 4cbb373ab..0d27bf630 100644
--- a/framework/headscale/.olares/config/user/helm-charts/headscale/templates/headscale_deploy.yaml
+++ b/framework/headscale/.olares/config/user/helm-charts/headscale/templates/headscale_deploy.yaml
@@ -301,7 +301,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        {{- if eq $role "platform-admin" }}
+        {{- if or (eq $role "owner") (eq $role "admin") }}
         - name: TS_DEBUG_FIREWALL_MODE
           value: nftables
         {{- end }}
@@ -315,13 +315,13 @@ spec:
           value: >-
             --no-logs-no-support
             --verbose=1
-            --tun=tailscale0{{ if ne $role "platform-admin" }}$(USER_INDEX){{ end }}
+            --tun=tailscale0{{ if and .Values.tailscaleUserIndex (ne .Values.tailscaleUserIndex  "0") }}$(USER_INDEX){{ end }}
         - name: TS_ROUTES
           value: $(COREDNS_SVC)/32
         - name: TS_EXTRA_ARGS
           value: >-
             --login-server http://headscale-server-svc:8080
-            --netfilter-mode {{ if eq $role "platform-admin" }}on{{ else }}off{{ end }}
+            --netfilter-mode {{ if or (eq $role "owner") (eq $role "admin") }}on{{ else }}off{{ end }}
         - name: TS_USERSPACE
           value: "false"
 
diff --git a/framework/l4-bfl-proxy/.olares/Olares.yaml b/framework/l4-bfl-proxy/.olares/Olares.yaml
index 06387e723..b3f29ef98 100644
--- a/framework/l4-bfl-proxy/.olares/Olares.yaml
+++ b/framework/l4-bfl-proxy/.olares/Olares.yaml
@@ -3,5 +3,5 @@ target: prebuilt
 output:
   containers:
     - 
-      name: beclab/l4-bfl-proxy:v0.3.0
+      name: beclab/l4-bfl-proxy:v0.3.1
 # must have blank new line            
\ No newline at end of file
diff --git a/framework/studio/.olares/config/cluster/deploy/studio_deploy.yaml b/framework/studio/.olares/config/cluster/deploy/studio_deploy.yaml
index b090224ce..8411fc550 100644
--- a/framework/studio/.olares/config/cluster/deploy/studio_deploy.yaml
+++ b/framework/studio/.olares/config/cluster/deploy/studio_deploy.yaml
@@ -190,7 +190,7 @@ spec:
 
       containers:
         - name: studio
-          image: beclab/studio-server:v0.1.53
+          image: beclab/studio-server:v0.1.54
           imagePullPolicy: IfNotPresent
           args:
             - server
diff --git a/platform/tapr/.olares/config/cluster/deploy/middleware_deploy.yaml b/platform/tapr/.olares/config/cluster/deploy/middleware_deploy.yaml
index 900354a94..6f38a0486 100644
--- a/platform/tapr/.olares/config/cluster/deploy/middleware_deploy.yaml
+++ b/platform/tapr/.olares/config/cluster/deploy/middleware_deploy.yaml
@@ -99,7 +99,7 @@ spec:
         - name: DISABLE_TELEMETRY
           value: "false"
       - name: operator-api
-        image: beclab/middleware-operator:0.2.12
+        image: beclab/middleware-operator:0.2.13
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9080
diff --git a/platform/tapr/.olares/config/cluster/deploy/sys_event_deploy.yaml b/platform/tapr/.olares/config/cluster/deploy/sys_event_deploy.yaml
index 084a29d2c..78f39e33e 100644
--- a/platform/tapr/.olares/config/cluster/deploy/sys_event_deploy.yaml
+++ b/platform/tapr/.olares/config/cluster/deploy/sys_event_deploy.yaml
@@ -76,7 +76,7 @@ spec:
         runAsUser: 0
       containers:
       - name: tapr-sysevent
-        image: beclab/sys-event:0.2.7
+        image: beclab/sys-event:0.2.8
         imagePullPolicy: IfNotPresent
         env:
         - name: APP_RANDOM_KEY