diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 86d7c4e5f7..2e8fb65300 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -108,6 +108,23 @@ jobs:
             ${{ steps.meta-ee-public.outputs.labels }}
             org.opencontainers.image.licenses=Windmill-Enterprise-License
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to ECR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.ECR_REGISTRY }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Push image to ECR
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest
+
   # disabled until we make it 100% reliable and add more meaningful tests
   # playwright:
   #   runs-on: [self-hosted, new]
@@ -217,45 +234,3 @@ jobs:
           cache-to:
             type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME
             }}-heavy:buildcache,mode=max
-
-  publish_privately_helm:
-    runs-on: [self-hosted, new]
-    needs: [build_ee]
-    if: github.event_name != 'pull_request'
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to registry
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Login to ECR
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.ECR_REGISTRY }}
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
-      - name: Build and push privately
-        uses: docker/build-push-action@v4
-        if: github.event_name != 'pull_request'
-        with:
-          context: .
-          push: true
-          file: ./docker/DockerfileHelm
-          tags: |
-            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:helm
-          cache-from:
-            type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME
-            }}-helm:buildcache
-          cache-to:
-            type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME
-            }}-helm:buildcache,mode=max
diff --git a/.github/workflows/pypi_on_release.yml b/.github/workflows/pypi_on_release.yml
index 17b80bd063..44758ff231 100644
--- a/.github/workflows/pypi_on_release.yml
+++ b/.github/workflows/pypi_on_release.yml
@@ -30,7 +30,6 @@ jobs:
           cd python-client
           ./publish.sh
 
-
   publish_lsp:
     runs-on: ubuntu-latest
     steps:
@@ -38,7 +37,7 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/v')
         run: sleep 300
         shell: bash
-        
+
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
@@ -75,7 +74,6 @@ jobs:
             ${{ steps.meta.outputs.labels }}
             org.opencontainers.image.licenses=AGPLv3
 
-
   publish_lsp_private:
     needs: [publish_lsp]
     runs-on: ubuntu-latest
@@ -93,9 +91,8 @@ jobs:
           username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
-
       - name: Push image to ECR
         run: |
           docker buildx imagetools create \
             --tag ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
\ No newline at end of file
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
diff --git a/Dockerfile b/Dockerfile
index 4011b043de..6dd8c9f64f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -95,6 +95,36 @@ RUN apt-get update \
     && apt-get install -y ca-certificates wget curl git jq libprotobuf-dev libnl-route-3-dev unzip build-essential \
     && rm -rf /var/lib/apt/lists/*
 
+
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+    wget https://get.helm.sh/helm-v3.12.0-linux-$arch.tar.gz && \
+    tar -zxvf helm-v3.10.1-linux-amd64.tar.gz  && \
+    mv linux-amd64/helm /usr/local/bin/helm &&\
+    chmod +x /usr/local/bin/helm
+
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+    curl -LO "https://dl.k8s.io/release/v1.27.2/bin/linux/$arch/kubectl" && \
+    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
+
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+    curl -LO "https://dl.k8s.io/release/v1.27.2/bin/linux/$arch/kubectl" && \
+    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
+
+RUN set -eux; \
+    arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+    case "$arch" in \
+    'amd64') \
+    zip='awscli-exe-linux-x86_64.zip'; \
+    ;; \
+    'arm64') \
+    zip='awscli-exe-linux-aarch64.zip'; \
+    ;; \
+    *) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
+    esac; \
+    apt-get update && apt install unzip && curl "https://awscli.amazonaws.com/$zip" -o "awscliv2.zip" && \
+    unzip awscliv2.zip && \
+    ./aws/install && rm $zip
+
 RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
     curl -o rclone.zip "https://downloads.rclone.org/v1.60.1/rclone-v1.60.1-linux-$arch.zip"; \
     unzip -p rclone.zip rclone-v1.60.1-linux-$arch/rclone > /usr/bin/rclone; rm rclone.zip; \
@@ -102,7 +132,6 @@ RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
 
 RUN set -eux; \
     arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
-    url=; \
     case "$arch" in \
     'amd64') \
     targz='go1.19.3.linux-amd64.tar.gz'; \
diff --git a/docker/DockerfileHelm b/docker/DockerfileHelm
deleted file mode 100644
index 94e24b77aa..0000000000
--- a/docker/DockerfileHelm
+++ /dev/null
@@ -1,15 +0,0 @@
-FROM ghcr.io/windmill-labs/windmill:main
-
-RUN wget https://get.helm.sh/helm-v3.10.1-linux-amd64.tar.gz && \
-    tar -zxvf helm-v3.10.1-linux-amd64.tar.gz  && \
-    mv linux-amd64/helm /usr/local/bin/helm &&\
-    chmod +x /usr/local/bin/helm
-
-RUN curl -LO "https://dl.k8s.io/release/v1.23.6/bin/linux/amd64/kubectl" && \
-    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
-    
-RUN apt-get update && apt install unzip && curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
-    unzip awscliv2.zip && \
-    ./aws/install 
-
-CMD ["windmill"]