diff --git a/ansible/roles/borg/tasks/main.yml b/ansible/roles/borg/tasks/main.yml
index 3c73ab6..96b4829 100644
--- a/ansible/roles/borg/tasks/main.yml
+++ b/ansible/roles/borg/tasks/main.yml
@@ -15,8 +15,8 @@
     ssh_config_defined: "{{ ssh_config.stat.exists }}"
 
 - name: Sync local ssh config vault remote
-  become: true
   when: ssh_config_defined
+  become: true
   ansible.builtin.copy:
     src: "{{ playbook_dir }}/vaults/borg/.ssh/"
     dest: "{{ ansible_user_home_dir }}/borgmatic/.ssh"
diff --git a/ansible/roles/datalab/tasks/main.yml b/ansible/roles/datalab/tasks/main.yml
index 43c2668..48bf48b 100644
--- a/ansible/roles/datalab/tasks/main.yml
+++ b/ansible/roles/datalab/tasks/main.yml
@@ -12,6 +12,24 @@
     dest: "{{ ansible_user_home_dir }}/datalab/pydatalab/.env"
     mode: "0644"
 
+- name: Get git tag version locally to use as fact # noqa: command-instead-of-module
+  delegate_to: localhost
+  ansible.builtin.shell:
+    cmd: set -o pipefail && git describe --tags --match 'v*' | sed 's/^v//' | sed 's/-rc/rc/' | sed 's/-/+/'
+    chdir: "{{ playbook_dir }}/../src/datalab"
+  register: git_tag
+  changed_when: false
+
+- name: Set fact for git tag version
+  ansible.builtin.set_fact:
+    git_tag: "{{ git_tag.stdout }}"
+
+- name: Write git version to a .env file to be loaded by build
+  ansible.builtin.copy:
+    content: "SETUPTOOLS_SCM_PRETEND_VERSION={{ git_tag }}\nVUE_APP_GIT_VERSION={{ git_tag }}"
+    dest: "{{ ansible_user_home_dir }}/datalab/.env_version"
+    mode: "0644"
+
 - name: Copy encrypted API config file from vault
   ansible.builtin.copy:
     src: "{{ playbook_dir }}/vaults/datalab/prod_config.json"
@@ -38,6 +56,7 @@
     build: always
     env_files:
       - "{{ ansible_user_home_dir }}/datalab/pydatalab/.env"
+      - "{{ ansible_user_home_dir }}/datalab/.env_version"
 
 - name: Check whether ssh config exists
   ansible.builtin.stat:
@@ -85,6 +104,7 @@
     build: always
     env_files:
       - "{{ ansible_user_home_dir }}/datalab/webapp/.env"
+      - "{{ ansible_user_home_dir }}/datalab/.env_version"
 
 - name: Add daily backup task to crontab
   ansible.builtin.cron:
diff --git a/ansible/roles/ssl_first_run/tasks/main.yml b/ansible/roles/ssl_first_run/tasks/main.yml
index a05b1d4..6c0f8ce 100644
--- a/ansible/roles/ssl_first_run/tasks/main.yml
+++ b/ansible/roles/ssl_first_run/tasks/main.yml
@@ -69,6 +69,6 @@
     name: SSL renewal with certbot
     minute: "38"
     hour: "10"
-    day: "2"
+    weekday: "2"
     month: "*"
     job: docker run -v certbot-www:/var/www/certbot -v certbot-conf:/etc/letsencrypt certbot/certbot:latest renew
diff --git a/src/datalab b/src/datalab
index 5eb83b3..7e63cdd 160000
--- a/src/datalab
+++ b/src/datalab
@@ -1 +1 @@
-Subproject commit 5eb83b3b91a3ca5e71a8396d8037e00333e074ae
+Subproject commit 7e63cdd881e18e08c30fff6e1332d933fc88f4d1
diff --git a/src/datalab-ansible-terraform b/src/datalab-ansible-terraform
index 8bbd87e..4fb4e71 160000
--- a/src/datalab-ansible-terraform
+++ b/src/datalab-ansible-terraform
@@ -1 +1 @@
-Subproject commit 8bbd87eecf83d344f7c9690fd7a604437be6854d
+Subproject commit 4fb4e71b1eb94b1e4843d76dc6d6340b959576d8