diff --git a/.circleci/config.yml b/.circleci/config.yml
index caaaefe95..5c05b05b5 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -57,14 +57,17 @@ jobs:
           when: always
   update-helm-charts-index:
     docker:
-      - image: docker.mirror.hashicorp.services/circleci/golang:1.15.3
+      - image: docker.mirror.hashicorp.services/cimg/go:1.19.2
     steps:
       - checkout
       - run:
           name: verify Chart version matches tag version
+          environment:
+            RELEASE_TAG: << pipeline.parameters.release-tag >>
           command: |
-            GO111MODULE=on go get github.com/mikefarah/yq/v2
-            git_tag=$(echo "${CIRCLE_TAG#v}")
+            go install github.com/mikefarah/yq/v2@latest
+            export TAG=${RELEASE_TAG:-$CIRCLE_TAG}
+            git_tag=$(echo "${TAG#v}")
             chart_tag=$(yq r Chart.yaml version)
             if [ "${git_tag}" != "${chart_tag}" ]; then
               echo "chart version (${chart_tag}) did not match git version (${git_tag})"
@@ -72,17 +75,25 @@ jobs:
             fi
       - run:
           name: update helm-charts index
+          environment:
+            RELEASE_TAG: << pipeline.parameters.release-tag >>
           command: |
             curl --show-error --silent --fail --user "${CIRCLE_TOKEN}:" \
                 -X POST \
                 -H 'Content-Type: application/json' \
                 -H 'Accept: application/json' \
-                -d "{\"branch\": \"main\",\"parameters\":{\"SOURCE_REPO\": \"${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}\",\"SOURCE_TAG\": \"${CIRCLE_TAG}\"}}" \
+                -d "{\"branch\": \"main\",\"parameters\":{\"SOURCE_REPO\": \"${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}\",\"SOURCE_TAG\": \"${RELEASE_TAG:-$CIRCLE_TAG}\"}}" \
                 "${CIRCLE_ENDPOINT}/${CIRCLE_PROJECT}/pipeline"
       - slack/status:
           fail_only: true
           failure_message: "Failed to trigger an update to the helm charts index. Check the logs at: ${CIRCLE_BUILD_URL}"
 
+parameters:
+  release-tag:
+    type: string
+    default: ""
+    description: "The tag to release, including v, e.g. v0.22.1"
+
 workflows:
   version: 2
   build_and_test:
@@ -104,3 +115,8 @@ workflows:
               only: /^v.*/
             branches:
               ignore: /.*/
+  manual-trigger-update-helm-charts-index:
+    when: << pipeline.parameters.release-tag >>
+    jobs:
+      - update-helm-charts-index:
+          context: helm-charts-trigger-vault
diff --git a/.github/workflows/setup-test-tools/action.yaml b/.github/workflows/setup-test-tools/action.yaml
index 3fa285416..8c69e3db8 100644
--- a/.github/workflows/setup-test-tools/action.yaml
+++ b/.github/workflows/setup-test-tools/action.yaml
@@ -6,13 +6,15 @@ runs:
   steps:
     - uses: actions/setup-node@v2
       with:
-        node-version: '14'
+        node-version: '16'
     - run: npm install -g bats@${BATS_VERSION}
       shell: bash
       env:
-        BATS_VERSION: '1.5.0'
+        BATS_VERSION: '1.8.2'
     - run: bats -v
       shell: bash
-    - uses: actions/setup-python@v2
+    - uses: actions/setup-python@v4
+      with:
+        python-version: '3.10'
     - run: pip install yq
       shell: bash
diff --git a/test/unit/server-headless-service.bats b/test/unit/server-headless-service.bats
index 7c0e44160..f4aebbd3d 100644
--- a/test/unit/server-headless-service.bats
+++ b/test/unit/server-headless-service.bats
@@ -35,3 +35,21 @@ load _helpers
       yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
   [ "${actual}" = "release-name" ]
 }
+
+@test "server/headless-Service: instance selector cannot be disabled" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-headless-service.yaml \
+      --set 'server.ha.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+
+  local actual=$(helm template \
+      --show-only templates/server-headless-service.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.instanceSelector.enabled=false' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+}