diff --git a/.env b/.env
index cae3f775a6..c17453c64b 100644
--- a/.env
+++ b/.env
@@ -1,4 +1,7 @@
 COMPOSE_PROJECT_NAME=sentry-self-hosted
+# Set COMPOSE_PROFILES to "feature-complete" to enable all features
+# To enable errors monitoring only, set COMPOSE_PROFILES=errors-only
+# See https://develop.sentry.dev/self-hosted/experimental/errors-only/
 COMPOSE_PROFILES=feature-complete
 SENTRY_EVENT_RETENTION_DAYS=90
 # You can either use a port number or an IP:PORT combo for SENTRY_BIND
@@ -6,11 +9,11 @@ SENTRY_EVENT_RETENTION_DAYS=90
 SENTRY_BIND=9000
 # Set SENTRY_MAIL_HOST to a valid FQDN (host/domain name) to be able to send emails!
 # SENTRY_MAIL_HOST=example.com
-SENTRY_IMAGE=getsentry/sentry:24.11.2
-SNUBA_IMAGE=getsentry/snuba:24.11.2
-RELAY_IMAGE=getsentry/relay:24.11.2
-SYMBOLICATOR_IMAGE=getsentry/symbolicator:24.11.2
-VROOM_IMAGE=getsentry/vroom:24.11.2
+SENTRY_IMAGE=getsentry/sentry:24.12.1
+SNUBA_IMAGE=getsentry/snuba:24.12.1
+RELAY_IMAGE=getsentry/relay:24.12.1
+SYMBOLICATOR_IMAGE=getsentry/symbolicator:24.12.1
+VROOM_IMAGE=getsentry/vroom:24.12.1
 HEALTHCHECK_INTERVAL=30s
 HEALTHCHECK_TIMEOUT=1m30s
 HEALTHCHECK_RETRIES=10
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index fc668d3105..af8c929394 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -40,7 +40,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae
+        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169
         with:
           sarif_file: '${{ matrix.image-name }}-trivy-results.sarif'
 
@@ -53,6 +53,6 @@ jobs:
           severity-cutoff: critical
 
       - name: Upload vulnerability report
-        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae
+        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169
         with:
           sarif_file: '${{ steps.scan.outputs.sarif }}'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7679ba12e9..56d9cfebee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## 24.12.1
+
+### Various fixes & improvements
+
+- chore: clearer message for errors-only mode (#3487) by @aldy505
+- chore(relay): provide opt-in max_memory_percent config as workaround for failing healthcheck (#3486) by @aldy505
+- fix(nginx): _assets should rewrite to _static/sentry/dist (#3483) by @BYK
+
+## 24.12.0
+
+- No documented changes.
+
 ## 24.11.2
 
 ### Various fixes & improvements
diff --git a/_integration-test/test_run.py b/_integration-test/test_run.py
index 2b5774832b..d1c8f4547c 100644
--- a/_integration-test/test_run.py
+++ b/_integration-test/test_run.py
@@ -80,6 +80,14 @@ def test_initial_redirect():
     assert initial_auth_redirect.url == f"{SENTRY_TEST_HOST}/auth/login/sentry/"
 
 
+def test_asset_internal_rewrite():
+    """Tests whether we correctly map `/_assets/*` to `/_static/dist/sentry` as
+    we don't have a CDN setup in self-hosted."""
+    response = httpx.get(f"{SENTRY_TEST_HOST}/_assets/entrypoints/app.js")
+    assert response.status_code == 200
+    assert response.headers["Content-Type"] == "text/javascript"
+
+
 def test_login(client_login):
     client, login_response = client_login
     parser = BeautifulSoup(login_response.text, "html.parser")
diff --git a/docker/Dockerfile.relay b/docker/Dockerfile.relay
index 7b949e03a4..ec664012b4 100644
--- a/docker/Dockerfile.relay
+++ b/docker/Dockerfile.relay
@@ -1,4 +1,4 @@
-ARG SENTRY_VERSION=24.11.2
+ARG SENTRY_VERSION=24.12.1
 ARG RELAY_IMAGE=getsentry/relay:${SENTRY_VERSION}
-ARG APPLICATION=relay-hh=24.11.2-4-3-1-7-1
+ARG APPLICATION=relay-hh=24.11.2
 FROM ${RELAY_IMAGE}
diff --git a/docker/Dockerfile.sentry b/docker/Dockerfile.sentry
index d43ea331ac..746d93649b 100644
--- a/docker/Dockerfile.sentry
+++ b/docker/Dockerfile.sentry
@@ -1,6 +1,6 @@
-ARG SENTRY_VERSION=24.11.2
+ARG SENTRY_VERSION=24.12.1
 ARG SENTRY_IMAGE=getsentry/sentry:${SENTRY_VERSION}
-ARG APPLICATION=sentry-hh=24.11.2-4-3-1-7-1
+ARG APPLICATION=sentry-hh=24.11.2
 FROM ${SENTRY_IMAGE}
 
 COPY docker/requirements-extra.txt /tmp/
diff --git a/docker/Dockerfile.snuba b/docker/Dockerfile.snuba
index a210cd1eeb..d9391b1312 100644
--- a/docker/Dockerfile.snuba
+++ b/docker/Dockerfile.snuba
@@ -1,4 +1,4 @@
-ARG SENTRY_VERSION=24.11.2
+ARG SENTRY_VERSION=24.12.1
 ARG SNUBA_IMAGE=getsentry/snuba:${SENTRY_VERSION}
-ARG APPLICATION=snuba-hh=24.11.2-4-3-1-7-1
+ARG APPLICATION=snuba-hh=24.11.2
 FROM ${SNUBA_IMAGE}
diff --git a/docker/Dockerfile.symbolicator b/docker/Dockerfile.symbolicator
index 36fad26c13..634f70f48e 100644
--- a/docker/Dockerfile.symbolicator
+++ b/docker/Dockerfile.symbolicator
@@ -1,4 +1,4 @@
-ARG SENTRY_VERSION=24.11.2
+ARG SENTRY_VERSION=24.12.1
 ARG SYMBOLICATOR_IMAGE=getsentry/symbolicator:${SENTRY_VERSION}
-ARG APPLICATION=symbolicator-hh=24.11.2-4-3-1-7-1
+ARG APPLICATION=symbolicator-hh=24.11.2
 FROM ${SYMBOLICATOR_IMAGE}
diff --git a/docker/Dockerfile.vroom b/docker/Dockerfile.vroom
index 785b73a235..283474956e 100644
--- a/docker/Dockerfile.vroom
+++ b/docker/Dockerfile.vroom
@@ -1,4 +1,4 @@
-ARG SENTRY_VERSION=24.11.2
+ARG SENTRY_VERSION=24.12.1
 ARG VROOM_IMAGE=getsentry/vroom:${SENTRY_VERSION}
-ARG APPLICATION=vroom-hh=24.11.2-4-3-1-7-1
+ARG APPLICATION=vroom-hh=24.11.2
 FROM ${VROOM_IMAGE}
diff --git a/nginx.conf b/nginx.conf
index 32d9487f80..94d7964d58 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -98,6 +98,10 @@ http {
 		location / {
 			proxy_pass http://sentry;
 		}
+		location /_assets/ {
+			proxy_pass http://sentry/_static/dist/sentry/;
+			proxy_hide_header Content-Disposition;
+		}
 		location /_static/ {
 			proxy_pass http://sentry;
 			proxy_hide_header Content-Disposition;
diff --git a/relay/config.example.yml b/relay/config.example.yml
index 52e6630671..f73e45acca 100644
--- a/relay/config.example.yml
+++ b/relay/config.example.yml
@@ -11,3 +11,10 @@ processing:
     - {name: "message.max.bytes", value: 50000000} # 50MB
   redis: redis://redis:6379
   geoip_path: "/geoip/GeoLite2-City.mmdb"
+
+# In some cases, relay might fail to find out the actual machine memory
+# therefore it makes the healthcheck fail and events can't be submitted.
+# As a workaround, uncomment the following line:
+#
+# health:
+#  max_memory_percent: 1.0
diff --git a/sentry/sentry.conf.example.py b/sentry/sentry.conf.example.py
index 27f6ad02c2..98e7a6c0fb 100644
--- a/sentry/sentry.conf.example.py
+++ b/sentry/sentry.conf.example.py
@@ -72,6 +72,18 @@ def get_internal_network():
     env("SENTRY_EVENT_RETENTION_DAYS", "90")
 )
 
+# Self-hosted Sentry infamously has a lot of Docker containers required to make
+# all the features work. Oftentimes, users don't use the full feature set that
+# requires all the containers. This is a way to enable only the error monitoring
+# feature which also reduces the amount of containers required to run Sentry.
+#
+# To make Sentry work with all features, set `COMPOSE_PROFILES` to `feature-complete`
+# in your `.env` file. To enable only the error monitoring feature, set
+# `COMPOSE_PROFILES` to `errors-only`.
+#
+# See https://develop.sentry.dev/self-hosted/experimental/errors-only/
+SENTRY_SELF_HOSTED_ERRORS_ONLY = env("COMPOSE_PROFILES") != "feature-complete"
+
 #########
 # Redis #
 #########
@@ -373,10 +385,6 @@ def get_internal_network():
 # if you're using it directly like a CDN instead of using the loader script.
 JS_SDK_LOADER_DEFAULT_SDK_URL = "https://browser.sentry-cdn.com/%s/bundle%s.min.js"
 
-
-# If you would like to use self-hosted Sentry with only errors enabled, please set this
-SENTRY_SELF_HOSTED_ERRORS_ONLY = env("COMPOSE_PROFILES") != "feature-complete"
-
 #####################
 # Insights Settings #
 #####################