diff --git a/README.md b/README.md
index ebc6b4d..bcfadf1 100644
--- a/README.md
+++ b/README.md
@@ -211,28 +211,33 @@ docker compose build --no-cache \
 ## Upgrade
 
 ### Test
+This is intended for testing the upgrades before rollout on prod. 
 
 1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots`
 2. Update `AUTHENTIK_TAG` to the desired tag in `env.test.template`.
-3. Commit & push changes to the Repo.
+3. Check the upstream `docker-compose.yml` file against ours for changes made in the configuration. Check the Postgresql and Redis docker tags. Minor revisions of Postgresql *should be fine*, check the changelogs for any issues and if none are present raise to the latest Minor version (e.g. 16.6 -> 16.9). Redis should be less problematic for upgrades, check nonetheless.
 4. Run `diff --color='auto' env.test.template .env` to display the diff between
 `env.test.template` and `.env`.
-5. Port the made changes to `.env`.
+5. Port the changes made to `.env`.
 6. `docker-compose-2.32.4 pull`
 7. `docker-compose-2.32.4 down`
 8. `docker-compose-2.32.4 up -d; docker-compose-2.32.4 logs -f`
+9. Check the logs for any issues during during startup. Check if https://sso.test.base23.de is available and test the sso login (e.g https://whoami.test.base23.de) 
+10. Apply changes for test to prod files (`docker-compose.<stage>.yml`,  `env.<stage>.template`), commit & push changes to the Repo in a new branch and create a merge request in preparation for the prod upgrade
 
 ### Prod
+It is expected that the Upgrade has already been performed and tested on https://sso.test.base23.de, and the changes have been merged into main
 
+0. Perform the Upgrade on test first. 
 1. Check if the backups are up to date: `docker compose run --rm restore-cli /usr/local/bin/restic snapshots`
-2. Update `AUTHENTIK_TAG` to the desired tag in `env.prod.template`.
-3. Commit & push changes to the Repo.
-4. Run `diff --color='auto' env.prod.template .env` to display the diff between
-`env.prod.template` and `.env`.
-5. Port the made changes to `.env`.
-6. `docker compose pull`
-7. `docker compose down`
-8. `docker compose up -d; docker compose logs -f`
+2. Perform a git pull
+4. Run `diff --color='auto' env.prod.template .env` to display the diff between `env.prod.template` and `.env`.
+5. Run `diff --color='auto' docker-compose.prod.yml docker-compose.yml` to display the diff between `docker-compose.prod.yml`and  docker-compose.yml`
+6. Port the changes made to `.env` and `docker-compose.yml`
+7. `docker compose pull`
+8. `docker compose down`
+9. `docker compose up -d; docker compose logs -f`
+10.  Check the logs for any issues during during startup. Check if https://sso.base23.de is available and test the sso login (e.g https://vpn.base23.de/admin). 
 
 ## Disaster recovery / restore
 
diff --git a/env.prod.template b/env.prod.template
index a0ae3f8..5925d27 100644
--- a/env.prod.template
+++ b/env.prod.template
@@ -4,9 +4,9 @@ PUBLIC_DOMAIN=sso.base23.de
 COMPOSE_PROJECT_NAME=sso-base23-de
 
 # Server Versions
-AUTHENTIK_TAG=2025.4.2
-POSTGRES_TAG=16.6-alpine
-REDIS_TAG=7.4.2-alpine
+AUTHENTIK_TAG=2025.6.4
+POSTGRES_TAG=16.9-alpine
+REDIS_TAG=8.0-alpine
 RESTICKER_TAG=0.0.2-restic0.17.0
 NGINX_UNPRIVILEGED_TAG=1.27.2-bookworm
 
diff --git a/env.test.template b/env.test.template
index de1120c..b07f13c 100644
--- a/env.test.template
+++ b/env.test.template
@@ -4,9 +4,9 @@ PUBLIC_DOMAIN=sso.test.base23.de
 COMPOSE_PROJECT_NAME=sso-base23-de
 
 # Server Versions
-AUTHENTIK_TAG=2025.4.2
-POSTGRES_TAG=16.6-alpine
-REDIS_TAG=7.4.2-alpine
+AUTHENTIK_TAG=2025.6.4
+POSTGRES_TAG=16.9-alpine
+REDIS_TAG=8.0-alpine
 RESTICKER_TAG=0.0.2-restic0.17.0
 
 # Error reporting & Logging