diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 4516bb10..2017fc46 100755
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -196,12 +196,17 @@ Repository-level variables for this workflow are:
   - Force a reset of previously build markdown files
   - Setting this variable value to `true` will force sandpaper to delete any previously build markdown files
   - Default is unset or `false`
+- OMIT_PR_CONTAINER_VERSION_UPDATE
+  - Control raise behaviour of the workbench-docker version update PR
+  - When a new workbench Docker image version is detected, usually after a sandpaper, varnish, or pegboard update, its version number will be incremented
+  - If a newer version is available, a PR will be raised that updates the `.github/workbench-docker-version.txt` file
+  - To not raise this PR set this to `true`
+  - Default is unset or `false`
 - AUTO_MERGE_WORKBENCH_VERSION_UPDATE
   - Control merge behaviour of the workbench-docker version update PR
-  - When a new workbench Docker image version is detected, usually after a sandpaper, varnish, or pegboard update, its version number will be incremented
-  - If a newer version is available, a PR will be auto-generated that updates the `.github/workbench-docker-version.txt` file, and this PR will be auto-merged
-  - To not auto-merge this PR and to choose when to update the Docker version used, set this to `false`.
-  - Default is unset or `true`
+  - If OMIT_PR_CONTAINER_VERSION_UPDATE is `true` this option does nothing
+  - To auto-merge this PR, set this to `true`
+  - Default is unset or `false`
 - LANG_CODE
   - Two-letter language code that triggers the use of Joel Nitta's {dovetail} package for lesson translation
   - This is used in the internationalisation repos of the main Carpentry lesson programs
diff --git a/.github/workflows/docker_apply_cache.yaml b/.github/workflows/docker_apply_cache.yaml
index dcebb3b3..9c44f5be 100644
--- a/.github/workflows/docker_apply_cache.yaml
+++ b/.github/workflows/docker_apply_cache.yaml
@@ -154,6 +154,9 @@ jobs:
     name: "Prune Dependency Images"
     runs-on: ubuntu-latest
     needs: check-renv
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Prune any old dependency image layers
         uses: carpentries/actions/prune-dependency-images@v1
diff --git a/.github/workflows/docker_build_deploy.yaml b/.github/workflows/docker_build_deploy.yaml
index bb0d0fd6..151fc4d5 100644
--- a/.github/workflows/docker_build_deploy.yaml
+++ b/.github/workflows/docker_build_deploy.yaml
@@ -95,6 +95,7 @@ jobs:
         RENV_PATHS_ROOT: /home/rstudio/lesson/renv
         RENV_PROFILE: "lesson-requirements"
         RENV_CONFIG_EXTERNAL_LIBRARIES: "/usr/local/lib/R/site-library"
+        WORKBENCH_OVERLAY_CUSTOMIZATION: ${{ vars.WORKBENCH_OVERLAY_CUSTOMIZATION || '' }}
       volumes:
         - ${{ github.workspace }}:/home/rstudio/lesson
       options: --cpus 1
@@ -144,7 +145,8 @@ jobs:
         uses: carpentries/actions/record-container-version@v1
         with:
           CONTAINER_VER: ${{ needs.preflight.outputs.wb-vers }}
-          AUTO_MERGE: ${{ vars.AUTO_MERGE_CONTAINER_VERSION_UPDATE || 'true' }}
+          OMIT_PR: ${{ vars.OMIT_PR_CONTAINER_VERSION_UPDATE || 'false' }}
+          AUTO_MERGE: ${{ vars.AUTO_MERGE_CONTAINER_VERSION_UPDATE || 'false' }}
           token: ${{ secrets.GITHUB_TOKEN }}
           role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }}
           aws-region: ${{ secrets.AWS_GH_OIDC_REGION }}
diff --git a/.github/workflows/workflows-version.txt b/.github/workflows/workflows-version.txt
index 570c7965..e946d6bb 100644
--- a/.github/workflows/workflows-version.txt
+++ b/.github/workflows/workflows-version.txt
@@ -1 +1 @@
-v1.0.2
+v1.0.3