diff --git a/.github/workflows/jetbrains-update-backend-latest.yml b/.github/workflows/jetbrains-update-backend-latest.yml
index 1edd6c79067da3..3a649210e9f6d3 100644
--- a/.github/workflows/jetbrains-update-backend-latest.yml
+++ b/.github/workflows/jetbrains-update-backend-latest.yml
@@ -45,4 +45,4 @@ jobs:
       - run: |
           gcloud auth configure-docker --quiet
           export LEEWAY_WORKSPACE_ROOT=$(pwd)
-          leeway build -Dversion=latest -DimageRepoBase=eu.gcr.io/gitpod-core-dev/build components/ide/jetbrains/backend-plugin:latest --dont-retag
+          leeway build -Dversion=latest -DimageRepoBase=eu.gcr.io/gitpod-core-dev/build components/ide/jetbrains/backend-plugin:latest
diff --git a/.gitpod.yml b/.gitpod.yml
index 7e68a55012f551..80e088855955c1 100644
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -1,4 +1,4 @@
-image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
 workspaceLocation: gitpod/gitpod-ws.code-workspace
 checkoutLocation: gitpod
 ports:
diff --git a/.werft/aks-installer-tests.yaml b/.werft/aks-installer-tests.yaml
index b66042159dfac6..63a23248382f45 100644
--- a/.werft/aks-installer-tests.yaml
+++ b/.werft/aks-installer-tests.yaml
@@ -65,7 +65,7 @@ pod:
       secretName: self-hosted-github-oauth
   containers:
   - name: nightly-test
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
     workingDir: /workspace
     imagePullPolicy: Always
     volumeMounts:
diff --git a/.werft/build.yaml b/.werft/build.yaml
index 2cff0f413b6eb5..3326ab4fdc265b 100644
--- a/.werft/build.yaml
+++ b/.werft/build.yaml
@@ -70,7 +70,7 @@ pod:
     - name: MYSQL_TCP_PORT
       value: 23306
   - name: build
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     resources:
diff --git a/.werft/cleanup-installer-tests.yaml b/.werft/cleanup-installer-tests.yaml
index ae6cb2c1d5e909..42b622fb110e26 100644
--- a/.werft/cleanup-installer-tests.yaml
+++ b/.werft/cleanup-installer-tests.yaml
@@ -25,7 +25,7 @@ pod:
       secretName: aks-credentials
   containers:
   - name: nightly-test
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
     workingDir: /workspace
     imagePullPolicy: Always
     volumeMounts:
diff --git a/.werft/debug.yaml b/.werft/debug.yaml
index 2fb8e5477f115e..18cccf1185b2cf 100644
--- a/.werft/debug.yaml
+++ b/.werft/debug.yaml
@@ -54,7 +54,7 @@ pod:
     - name: MYSQL_TCP_PORT
       value: 23306
   - name: build
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     volumeMounts:
diff --git a/.werft/eks-installer-tests.yaml b/.werft/eks-installer-tests.yaml
index 6e904ca0ae3de5..05e26d047cd0ae 100644
--- a/.werft/eks-installer-tests.yaml
+++ b/.werft/eks-installer-tests.yaml
@@ -65,7 +65,7 @@ pod:
       secretName: self-hosted-github-oauth
   containers:
   - name: nightly-test
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
     workingDir: /workspace
     imagePullPolicy: Always
     volumeMounts:
diff --git a/.werft/gke-installer-tests.yaml b/.werft/gke-installer-tests.yaml
index 6ad53164c8e17f..07f7a7b3fe0fcd 100644
--- a/.werft/gke-installer-tests.yaml
+++ b/.werft/gke-installer-tests.yaml
@@ -65,7 +65,7 @@ pod:
         secretName: self-hosted-github-oauth
   containers:
     - name: nightly-test
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: Always
       volumeMounts:
diff --git a/.werft/ide-integration-tests-startup.yaml b/.werft/ide-integration-tests-startup.yaml
index 64661f1abb7be1..6cede908111134 100644
--- a/.werft/ide-integration-tests-startup.yaml
+++ b/.werft/ide-integration-tests-startup.yaml
@@ -17,7 +17,7 @@ pod:
         secretName: github-token-gitpod-bot
   containers:
     - name: gcloud
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       env:
diff --git a/.werft/jobs/build/build-and-publish.ts b/.werft/jobs/build/build-and-publish.ts
index 595b931c47a488..5239a70f8416b7 100644
--- a/.werft/jobs/build/build-and-publish.ts
+++ b/.werft/jobs/build/build-and-publish.ts
@@ -16,7 +16,6 @@ export async function buildAndPublish(werft: Werft, jobConfig: JobConfig) {
     const {
         publishRelease,
         dontTest,
-        retag,
         version,
         localAppVersion,
         publishToNpm,
@@ -38,7 +37,7 @@ export async function buildAndPublish(werft: Werft, jobConfig: JobConfig) {
     exec(
         `leeway build --docker-build-options network=host --werft=true -c remote ${
             dontTest ? "--dont-test" : ""
-        } --dont-retag --coverage-output-path=${coverageOutput} --save /tmp/dev.tar.gz -Dversion=${version} -DimageRepoBase=eu.gcr.io/gitpod-core-dev/dev dev:all`,
+        } --coverage-output-path=${coverageOutput} --save /tmp/dev.tar.gz -Dversion=${version} -DimageRepoBase=eu.gcr.io/gitpod-core-dev/dev dev:all`,
     );
 
     if (publishRelease) {
@@ -61,7 +60,6 @@ export async function buildAndPublish(werft: Werft, jobConfig: JobConfig) {
         "--werft=true",
         "-c remote",
         dontTest ? "--dont-test" : "",
-        retag,
         `--coverage-output-path=${coverageOutput}`,
     ].filter((value) => value).join(" ");
 
diff --git a/.werft/jobs/build/job-config.ts b/.werft/jobs/build/job-config.ts
index 8531ad60a87b28..64acc21f0f4296 100644
--- a/.werft/jobs/build/job-config.ts
+++ b/.werft/jobs/build/job-config.ts
@@ -23,7 +23,6 @@ export interface JobConfig {
     publishToJBMarketplace: boolean;
     publishToNpm: string;
     publishToKots: boolean;
-    retag: string;
     replicatedChannel: string;
     storage: string;
     version: string;
@@ -98,7 +97,6 @@ export function jobConfig(werft: Werft, context: any): JobConfig {
     const publishToKots = "publish-to-kots" in buildConfig || withSelfHostedPreview || mainBuild;
 
     const localAppVersion = mainBuild || "with-localapp-version" in buildConfig ? version : "unknown";
-    const retag = "with-retag" in buildConfig ? "" : "--dont-retag";
     const cleanSlateDeployment = mainBuild || "with-clean-slate-deployment" in buildConfig;
     const installEELicense = !("without-ee-license" in buildConfig) || mainBuild;
     const withObservability = "with-observability" in buildConfig && !mainBuild;
@@ -165,7 +163,6 @@ export function jobConfig(werft: Werft, context: any): JobConfig {
         replicatedChannel,
         replicatedVersion,
         repository,
-        retag,
         storage,
         version,
         withContrib,
diff --git a/.werft/jobs/build/prepare.ts b/.werft/jobs/build/prepare.ts
index 1718ec6b72793c..c0e58fc8d742dc 100644
--- a/.werft/jobs/build/prepare.ts
+++ b/.werft/jobs/build/prepare.ts
@@ -61,7 +61,7 @@ function configureDocker() {
 }
 
 function configureGlobalKubernetesContext() {
-    const rc = exec(`previewctl get-credentials --gcp-service-account=${GCLOUD_SERVICE_ACCOUNT_PATH} --kube-save-path=${GLOBAL_KUBECONFIG_PATH}`, { slice: prepareSlices.CONFIGURE_K8S }).code;
+    const rc = exec(`KUBECONFIG=${GLOBAL_KUBECONFIG_PATH} previewctl get-credentials --gcp-service-account=${GCLOUD_SERVICE_ACCOUNT_PATH}`, { slice: prepareSlices.CONFIGURE_K8S }).code;
 
     if (rc != 0) {
         throw new Error("Failed to configure global kubernetes context.");
diff --git a/.werft/k3s-installer-tests.yaml b/.werft/k3s-installer-tests.yaml
index f6db86efce5c59..d31e17e1e536bd 100644
--- a/.werft/k3s-installer-tests.yaml
+++ b/.werft/k3s-installer-tests.yaml
@@ -65,7 +65,7 @@ pod:
       secretName: self-hosted-github-oauth
   containers:
   - name: nightly-test
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
     workingDir: /workspace
     imagePullPolicy: Always
     volumeMounts:
diff --git a/.werft/platform-delete-preview-environment.ts b/.werft/platform-delete-preview-environment.ts
index 0af0fffbb2e37a..1e9a1eba2d5eec 100644
--- a/.werft/platform-delete-preview-environment.ts
+++ b/.werft/platform-delete-preview-environment.ts
@@ -94,7 +94,7 @@ async function deletePreviewEnvironment() {
 }
 
 function configureGlobalKubernetesContext() {
-    const rc = exec(`previewctl get-credentials --gcp-service-account=${GCLOUD_SERVICE_ACCOUNT_PATH} --kube-save-path=${GLOBAL_KUBECONFIG_PATH}`, { slice: SLICES.CONFIGURE_K8S }).code;
+    const rc = exec(`KUBECONFIG=${GLOBAL_KUBECONFIG_PATH} previewctl get-credentials --gcp-service-account=${GCLOUD_SERVICE_ACCOUNT_PATH}`, { slice: SLICES.CONFIGURE_K8S }).code;
 
     if (rc != 0) {
         throw new Error("Failed to configure global kubernetes context.");
diff --git a/.werft/platform-delete-preview-environment.yaml b/.werft/platform-delete-preview-environment.yaml
index 852a50d08ee479..0afbe365758325 100644
--- a/.werft/platform-delete-preview-environment.yaml
+++ b/.werft/platform-delete-preview-environment.yaml
@@ -25,7 +25,7 @@ pod:
         secretName: harvester-vm-ssh-keys
   containers:
     - name: build
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       volumeMounts:
diff --git a/.werft/platform-delete-preview-environments-cron.yaml b/.werft/platform-delete-preview-environments-cron.yaml
index 9faa90f3392309..d4c68c68fe0d8d 100644
--- a/.werft/platform-delete-preview-environments-cron.yaml
+++ b/.werft/platform-delete-preview-environments-cron.yaml
@@ -29,7 +29,7 @@ pod:
         secretName: github-token-gitpod-bot
   containers:
     - name: build
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       volumeMounts:
diff --git a/.werft/platform-trigger-artificial-job.yaml b/.werft/platform-trigger-artificial-job.yaml
index 652b2a1c50f108..8e9e9b584ea56e 100644
--- a/.werft/platform-trigger-artificial-job.yaml
+++ b/.werft/platform-trigger-artificial-job.yaml
@@ -24,7 +24,7 @@ pod:
         secretName: github-token-gitpod-bot
   containers:
     - name: build
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       volumeMounts:
diff --git a/.werft/platform-trigger-werft-cleanup.yaml b/.werft/platform-trigger-werft-cleanup.yaml
index 27ea60fa41ee39..91fe742e7577c5 100644
--- a/.werft/platform-trigger-werft-cleanup.yaml
+++ b/.werft/platform-trigger-werft-cleanup.yaml
@@ -22,7 +22,7 @@ pod:
         secretName: gcp-sa-gitpod-dev-deployer
   containers:
     - name: build
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       volumeMounts:
diff --git a/.werft/workspace-run-integration-tests.yaml b/.werft/workspace-run-integration-tests.yaml
index 96bc4ae1189728..ee9389688c042e 100644
--- a/.werft/workspace-run-integration-tests.yaml
+++ b/.werft/workspace-run-integration-tests.yaml
@@ -22,7 +22,7 @@ pod:
         secretName: github-token-gitpod-bot
   containers:
     - name: gcloud
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aa-fix-previewctl-get-name.0
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:aledbf-leeway.1
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       env:
diff --git a/components/supervisor/hot-deploy.sh b/components/supervisor/hot-deploy.sh
index ea9e21791df7f1..16a8ce78cea869 100755
--- a/components/supervisor/hot-deploy.sh
+++ b/components/supervisor/hot-deploy.sh
@@ -19,7 +19,7 @@ echo "Image Version: $version"
 bldfn="/tmp/build-$version.tar.gz"
 
 docker ps &> /dev/null || (echo "You need a working Docker daemon. Maybe set DOCKER_HOST?"; exit 1)
-leeway build -Dversion="$version" -DimageRepoBase=eu.gcr.io/gitpod-core-dev/build .:docker --save "$bldfn" --dont-retag
+leeway build -Dversion="$version" -DimageRepoBase=eu.gcr.io/gitpod-core-dev/build .:docker --save "$bldfn"
 dev_image="$(tar xfO "$bldfn" ./imgnames.txt | head -n1)"
 echo "Dev Image: $dev_image"
 
diff --git a/dev/image/Dockerfile b/dev/image/Dockerfile
index 7c0b614555dece..a128843dfd2ab6 100644
--- a/dev/image/Dockerfile
+++ b/dev/image/Dockerfile
@@ -2,7 +2,7 @@
 # Licensed under the GNU Affero General Public License (AGPL).
 # See License-AGPL.txt in the project root for license information.
 
-FROM gitpod/workspace-full:2022-10-15-02-50-27
+FROM gitpod/workspace-full:2022-11-09-13-54-49
 
 ENV TRIGGER_REBUILD 24
 
@@ -58,7 +58,7 @@ RUN cd /usr/bin && curl -fsSL https://github.com/praetorian-inc/gokart/releases/
 
 # leeway
 ENV LEEWAY_MAX_PROVENANCE_BUNDLE_SIZE=8388608
-RUN cd /usr/bin && curl -fsSL https://github.com/gitpod-io/leeway/releases/download/v0.3.1/leeway_0.3.1_Linux_x86_64.tar.gz | tar xz
+RUN cd /usr/bin && curl -fsSL https://github.com/gitpod-io/leeway/releases/download/v0.4.0/leeway_0.4.0_Linux_x86_64.tar.gz | tar xz
 
 # evans (gRPC client)
 RUN cd /usr/bin && curl -fsSL https://github.com/ktr0731/evans/releases/download/v0.10.6/evans_linux_amd64.tar.gz | tar xz evans
diff --git a/dev/preview/BUILD.yaml b/dev/preview/BUILD.yaml
index 9c7f65bac3cda7..18692ace01edc5 100644
--- a/dev/preview/BUILD.yaml
+++ b/dev/preview/BUILD.yaml
@@ -15,7 +15,7 @@ scripts:
   - name: get-credentials
     description: Provisions a new preview environment
     script: |
-      previewctl get-credentials --kube-save-path $HOME/.kube/config
+      KUBECONFIG=$HOME/.kube/config previewctl get-credentials
 
   - name: create-preview
     description: Provisions a new preview environment
diff --git a/dev/preview/workflow/preview/build.sh b/dev/preview/workflow/preview/build.sh
index 5dae9e9b9f14f9..6b896cd28eabac 100755
--- a/dev/preview/workflow/preview/build.sh
+++ b/dev/preview/workflow/preview/build.sh
@@ -67,6 +67,5 @@ leeway build \
     -DREPLICATED_API_TOKEN="$(kubectl --context=dev -n werft get secret replicated -o jsonpath='{.data.token}' | base64 -d)" \
     -DREPLICATED_APP="$(kubectl --context=dev -n werft get secret replicated -o jsonpath='{.data.app}' | base64 -d)" \
     -Dversion="${VERSION}" \
-    --dont-retag \
     --dont-test \
     dev/preview:deploy-dependencies