diff --git a/Makefile b/Makefile
index d513cfe1b6..11a47584fb 100644
--- a/Makefile
+++ b/Makefile
@@ -126,6 +126,20 @@ show_current_branches:
 	$(foreach CAL_BRANCH,$(CALICO_CLOUD_BRANCHES),$(info * $(CAL_BRANCH)))
 	@true
 
+scripts/versions/format-versions: scripts/versions/go.* scripts/versions/main.go
+ifdef LOCAL_BUILD
+	make -C scripts/versions
+else
+	docker run --rm --net=host \
+	-e LOCAL_USER_ID=$(LOCAL_USER_ID) \
+	-e GOOS=$(shell go env GOOS) \
+	-e GOARCH=$(shell go env GOARCH) \
+	-v $(CURDIR):/go/src/$(PACKAGE_NAME):rw \
+	-v $(CURDIR)/.go-pkg-cache:/go/pkg:rw \
+	-w /go/src/$(PACKAGE_NAME) \
+	$(CALICO_BUILD) make -C scripts/versions
+endif
+
 .PHONY: build-operator-reference
 build-operator-reference:
 	@mkdir -p .go-pkg-cache && \
@@ -199,11 +213,26 @@ run-update-cloud-image-list:
 # 	e.g. for new versions of v3.18.0-2, DOCS_VERSION_STREAM=3.18-2
 # If the version to updates is the latest version for the product, specify IS_LATEST=true
 # 	e.g. if 3,18,1 is the latest version, IS_LATEST=true
-version/autogen:
+
+VERSION_ALL_VERSIONS=$(foreach version,$(wildcard calico-enterprise_versioned_docs/*),version/autogen/$(version:calico-enterprise_versioned_docs/version-%=%))
+
+# This target updates *the current versions* based on what is present in calico-private. It will
+# not (to my knowledge) add a new version which has not yet been added to the docs.
+version/updateall: $(VERSION_ALL_VERSIONS)
+	$(info [info] All current versions have been updated, but please check `git diff` to ensure the values are correct!)
+
+version/autogen/%:
+	$(info Building $@)
+	@$(MAKE) --no-print-directory version/autogen \
+		PRODUCT=calico-enterprise \
+		DOCS_VERSION_STREAM=$* \
+		VERSION=$(shell jq -r '.[0].title' calico-enterprise_versioned_docs/version-$*/releases.json)
+
+version/autogen: scripts/versions/format-versions
 	$(if $(GITHUB_TOKEN),,$(error GITHUB_TOKEN is not set or empty, but is required))
 	$(if $(PRODUCT),,$(error PRODUCT is not set or empty, but is required))
 	$(if $(VERSION),,$(error VERSION is not set or empty, but is required))
-	./scripts/update-component-versions.sh
+	@./scripts/update-component-versions.sh
 
 # Call the github API. $(1) is the http method type for the https request, $(2) is the repo slug, and is $(3) is for json
 # data (if omitted then no data is set for the request). If GITHUB_API_EXIT_ON_FAILURE is set then the macro exits with 1
diff --git a/calico-cloud/reference/installation/_api.mdx b/calico-cloud/reference/installation/_api.mdx
index ba0edb1320..0f90b1e805 100644
--- a/calico-cloud/reference/installation/_api.mdx
+++ b/calico-cloud/reference/installation/_api.mdx
@@ -146,7 +146,7 @@ APIServerDeployment
 <td>
 
 <p>
-APIServerDeployment configures the calico-apiserver Deployment. If
+APIServerDeployment configures the calico-apiserver (or tigera-apiserver in Enterprise) Deployment. If
 used in conjunction with ControlPlaneNodeSelector or ControlPlaneTolerations, then these overrides
 take precedence.
 </p>
@@ -4693,7 +4693,7 @@ APIServerDeployment
 <td>
 
 <p>
-APIServerDeployment configures the calico-apiserver Deployment. If
+APIServerDeployment configures the calico-apiserver (or tigera-apiserver in Enterprise) Deployment. If
 used in conjunction with ControlPlaneNodeSelector or ControlPlaneTolerations, then these overrides
 take precedence.
 </p>
diff --git a/calico-enterprise_versioned_docs/version-3.19-2/releases.json b/calico-enterprise_versioned_docs/version-3.19-2/releases.json
index c977f9a465..6da522fcd6 100644
--- a/calico-enterprise_versioned_docs/version-3.19-2/releases.json
+++ b/calico-enterprise_versioned_docs/version-3.19-2/releases.json
@@ -2,8 +2,8 @@
   {
     "title": "v3.19.7",
     "tigera-operator": {
-      "image": "tigera/operator",
       "version": "v1.34.12",
+      "image": "tigera/operator",
       "registry": "quay.io"
     },
     "calico": {
@@ -11,242 +11,242 @@
       "archive_path": "archive"
     },
     "components": {
-      "cnx-manager": {
-        "image": "tigera/cnx-manager",
-        "version": "v3.19.7"
+      "alertmanager": {
+        "version": "v3.19.7",
+        "image": "tigera/alertmanager"
       },
-      "voltron": {
-        "image": "tigera/voltron",
-        "version": "v3.19.7"
+      "calicoctl": {
+        "version": "v3.19.7",
+        "image": "tigera/calicoctl"
       },
-      "guardian": {
-        "image": "tigera/guardian",
-        "version": "v3.19.7"
+      "calicoq": {
+        "version": "v3.19.7",
+        "image": "tigera/calicoq"
       },
       "cnx-apiserver": {
-        "image": "tigera/cnx-apiserver",
-        "version": "v3.19.7"
-      },
-      "cnx-queryserver": {
-        "image": "tigera/cnx-queryserver",
-        "version": "v3.19.7"
+        "version": "v3.19.7",
+        "image": "tigera/cnx-apiserver"
       },
       "cnx-kube-controllers": {
-        "image": "tigera/kube-controllers",
-        "version": "v3.19.7"
-      },
-      "calicoq": {
-        "image": "tigera/calicoq",
-        "version": "v3.19.7"
-      },
-      "typha": {
-        "image": "tigera/typha",
-        "version": "v3.19.7"
+        "version": "v3.19.7",
+        "image": "tigera/kube-controllers"
       },
-      "calicoctl": {
-        "image": "tigera/calicoctl",
-        "version": "v3.19.7"
+      "cnx-manager": {
+        "version": "v3.19.7",
+        "image": "tigera/cnx-manager"
       },
       "cnx-node": {
-        "image": "tigera/cnx-node",
-        "version": "v3.19.7"
+        "version": "v3.19.7",
+        "image": "tigera/cnx-node"
       },
       "cnx-node-windows": {
-        "image": "tigera/cnx-node-windows",
-        "version": "v3.19.7"
+        "version": "v3.19.7",
+        "image": "tigera/cnx-node-windows"
       },
-      "dikastes": {
-        "image": "tigera/dikastes",
-        "version": "v3.19.7"
+      "cnx-queryserver": {
+        "version": "v3.19.7",
+        "image": "tigera/cnx-queryserver"
       },
-      "dex": {
-        "image": "tigera/dex",
-        "version": "v3.19.7"
+      "compliance-benchmarker": {
+        "version": "v3.19.7",
+        "image": "tigera/compliance-benchmarker"
       },
-      "fluentd": {
-        "image": "tigera/fluentd",
-        "version": "v3.19.7"
+      "compliance-controller": {
+        "version": "v3.19.7",
+        "image": "tigera/compliance-controller"
       },
-      "fluentd-windows": {
-        "image": "tigera/fluentd-windows",
-        "version": "v3.19.7"
+      "compliance-reporter": {
+        "version": "v3.19.7",
+        "image": "tigera/compliance-reporter"
       },
-      "es-proxy": {
-        "image": "tigera/es-proxy",
-        "version": "v3.19.7"
+      "compliance-server": {
+        "version": "v3.19.7",
+        "image": "tigera/compliance-server"
       },
-      "eck-kibana": {
-        "version": "7.17.28"
+      "compliance-snapshotter": {
+        "version": "v3.19.7",
+        "image": "tigera/compliance-snapshotter"
       },
-      "kibana": {
-        "image": "tigera/kibana",
-        "version": "v3.19.7"
+      "coreos-alertmanager": {
+        "version": "v0.28.1"
       },
-      "eck-elasticsearch": {
-        "version": "7.17.28"
+      "coreos-config-reloader": {
+        "version": "v0.76.2"
       },
-      "elasticsearch": {
-        "image": "tigera/elasticsearch",
-        "version": "v3.19.7"
+      "coreos-prometheus": {
+        "version": "v2.55.1"
       },
-      "elastic-tsee-installer": {
-        "image": "tigera/intrusion-detection-job-installer",
-        "version": "v3.19.7"
+      "coreos-prometheus-operator": {
+        "version": "v0.76.2"
       },
-      "intrusion-detection-controller": {
-        "image": "tigera/intrusion-detection-controller",
-        "version": "v3.19.7"
+      "csi": {
+        "version": "v3.19.7",
+        "image": "tigera/csi"
       },
-      "compliance-controller": {
-        "image": "tigera/compliance-controller",
-        "version": "v3.19.7"
+      "csi-node-driver-registrar": {
+        "version": "v3.19.7",
+        "image": "tigera/node-driver-registrar"
       },
-      "compliance-reporter": {
-        "image": "tigera/compliance-reporter",
-        "version": "v3.19.7"
+      "deep-packet-inspection": {
+        "version": "v3.19.7",
+        "image": "tigera/deep-packet-inspection"
       },
-      "compliance-snapshotter": {
-        "image": "tigera/compliance-snapshotter",
-        "version": "v3.19.7"
+      "dex": {
+        "version": "v3.19.7",
+        "image": "tigera/dex"
       },
-      "compliance-server": {
-        "image": "tigera/compliance-server",
-        "version": "v3.19.7"
+      "dikastes": {
+        "version": "v3.19.7",
+        "image": "tigera/dikastes"
       },
-      "compliance-benchmarker": {
-        "image": "tigera/compliance-benchmarker",
-        "version": "v3.19.7"
+      "eck-elasticsearch": {
+        "version": "7.17.28"
       },
-      "ingress-collector": {
-        "image": "tigera/ingress-collector",
-        "version": "v3.19.7"
+      "eck-elasticsearch-operator": {
+        "version": "2.16.1"
       },
-      "l7-collector": {
-        "image": "tigera/l7-collector",
-        "version": "v3.19.7"
+      "eck-kibana": {
+        "version": "7.17.28"
       },
-      "license-agent": {
-        "image": "tigera/license-agent",
-        "version": "v3.19.7"
+      "egress-gateway": {
+        "version": "v3.19.7",
+        "image": "tigera/egress-gateway"
       },
-      "tigera-cni": {
-        "image": "tigera/cni",
-        "version": "v3.19.7"
+      "elastic-tsee-installer": {
+        "version": "v3.19.7",
+        "image": "tigera/intrusion-detection-job-installer"
       },
-      "tigera-cni-windows": {
-        "image": "tigera/cni-windows",
-        "version": "v3.19.7"
+      "elasticsearch": {
+        "version": "v3.19.7",
+        "image": "tigera/elasticsearch"
       },
-      "firewall-integration": {
-        "image": "tigera/firewall-integration",
-        "version": "v3.19.7"
+      "elasticsearch-metrics": {
+        "version": "v3.19.7",
+        "image": "tigera/elasticsearch-metrics"
       },
-      "egress-gateway": {
-        "image": "tigera/egress-gateway",
-        "version": "v3.19.7"
+      "elasticsearch-operator": {
+        "version": "v3.19.7",
+        "image": "tigera/eck-operator"
       },
-      "honeypod": {
-        "image": "tigera/honeypod",
-        "version": "v3.19.7"
+      "envoy": {
+        "version": "v3.19.7",
+        "image": "tigera/envoy"
       },
-      "honeypod-exp-service": {
-        "image": "tigera/honeypod-exp-service",
-        "version": "v3.19.7"
+      "envoy-init": {
+        "version": "v3.19.7",
+        "image": "tigera/envoy-init"
       },
-      "honeypod-controller": {
-        "image": "tigera/honeypod-controller",
-        "version": "v3.19.7"
+      "es-gateway": {
+        "version": "v3.19.7",
+        "image": "tigera/es-gateway"
       },
-      "key-cert-provisioner": {
-        "image": "tigera/key-cert-provisioner",
-        "version": "v3.19.7"
+      "es-proxy": {
+        "version": "v3.19.7",
+        "image": "tigera/es-proxy"
       },
-      "elasticsearch-metrics": {
-        "image": "tigera/elasticsearch-metrics",
-        "version": "v3.19.7"
+      "firewall-integration": {
+        "version": "v3.19.7",
+        "image": "tigera/firewall-integration"
       },
-      "packetcapture": {
-        "image": "tigera/packetcapture",
-        "version": "v3.19.7"
+      "flexvol": {
+        "version": "v3.19.7",
+        "image": "tigera/pod2daemon-flexvol"
       },
-      "policy-recommendation": {
-        "image": "tigera/policy-recommendation",
-        "version": "v3.19.7"
+      "fluentd": {
+        "version": "v3.19.7",
+        "image": "tigera/fluentd"
       },
-      "prometheus": {
-        "image": "tigera/prometheus",
-        "version": "v3.19.7"
+      "fluentd-windows": {
+        "version": "v3.19.7",
+        "image": "tigera/fluentd-windows"
       },
-      "coreos-prometheus": {
-        "version": "v2.55.1"
+      "guardian": {
+        "version": "v3.19.7",
+        "image": "tigera/guardian"
       },
-      "coreos-prometheus-operator": {
-        "version": "v0.76.2"
+      "honeypod": {
+        "version": "v3.19.7",
+        "image": "tigera/honeypod"
       },
-      "coreos-config-reloader": {
-        "version": "v0.76.2"
+      "honeypod-controller": {
+        "version": "v3.19.7",
+        "image": "tigera/honeypod-controller"
       },
-      "prometheus-operator": {
-        "image": "tigera/prometheus-operator",
-        "version": "v3.19.7"
+      "honeypod-exp-service": {
+        "version": "v3.19.7",
+        "image": "tigera/honeypod-exp-service"
       },
-      "prometheus-config-reloader": {
-        "image": "tigera/prometheus-config-reloader",
-        "version": "v3.19.7"
+      "ingress-collector": {
+        "version": "v3.19.7",
+        "image": "tigera/ingress-collector"
       },
-      "tigera-prometheus-service": {
-        "image": "tigera/prometheus-service",
-        "version": "v3.19.7"
+      "intrusion-detection-controller": {
+        "version": "v3.19.7",
+        "image": "tigera/intrusion-detection-controller"
       },
-      "es-gateway": {
-        "image": "tigera/es-gateway",
-        "version": "v3.19.7"
+      "key-cert-provisioner": {
+        "version": "v3.19.7",
+        "image": "tigera/key-cert-provisioner"
+      },
+      "kibana": {
+        "version": "v3.19.7",
+        "image": "tigera/kibana"
+      },
+      "l7-collector": {
+        "version": "v3.19.7",
+        "image": "tigera/l7-collector"
+      },
+      "license-agent": {
+        "version": "v3.19.7",
+        "image": "tigera/license-agent"
       },
       "linseed": {
-        "image": "tigera/linseed",
-        "version": "v3.19.7"
+        "version": "v3.19.7",
+        "image": "tigera/linseed"
       },
-      "deep-packet-inspection": {
-        "image": "tigera/deep-packet-inspection",
-        "version": "v3.19.7"
+      "packetcapture": {
+        "version": "v3.19.7",
+        "image": "tigera/packetcapture"
       },
-      "eck-elasticsearch-operator": {
-        "version": "2.16.1"
+      "policy-recommendation": {
+        "version": "v3.19.7",
+        "image": "tigera/policy-recommendation"
       },
-      "elasticsearch-operator": {
-        "image": "tigera/eck-operator",
-        "version": "v3.19.7"
+      "prometheus": {
+        "version": "v3.19.7",
+        "image": "tigera/prometheus"
       },
-      "coreos-alertmanager": {
-        "version": "v0.28.1"
+      "prometheus-config-reloader": {
+        "version": "v3.19.7",
+        "image": "tigera/prometheus-config-reloader"
       },
-      "alertmanager": {
-        "image": "tigera/alertmanager",
-        "version": "v3.19.7"
+      "prometheus-operator": {
+        "version": "v3.19.7",
+        "image": "tigera/prometheus-operator"
       },
-      "envoy": {
-        "image": "tigera/envoy",
-        "version": "v3.19.7"
+      "tigera-cni": {
+        "version": "v3.19.7",
+        "image": "tigera/cni"
       },
-      "envoy-init": {
-        "image": "tigera/envoy-init",
-        "version": "v3.19.7"
+      "tigera-cni-windows": {
+        "version": "v3.19.7",
+        "image": "tigera/cni-windows"
       },
-      "webhooks-processor": {
-        "image": "tigera/webhooks-processor",
-        "version": "v3.19.7"
+      "tigera-prometheus-service": {
+        "version": "v3.19.7",
+        "image": "tigera/prometheus-service"
       },
-      "flexvol": {
-        "image": "tigera/pod2daemon-flexvol",
-        "version": "v3.19.7"
+      "typha": {
+        "version": "v3.19.7",
+        "image": "tigera/typha"
       },
-      "csi": {
-        "image": "tigera/csi",
-        "version": "v3.19.7"
+      "voltron": {
+        "version": "v3.19.7",
+        "image": "tigera/voltron"
       },
-      "csi-node-driver-registrar": {
-        "image": "tigera/node-driver-registrar",
-        "version": "v3.19.7"
+      "webhooks-processor": {
+        "version": "v3.19.7",
+        "image": "tigera/webhooks-processor"
       }
     }
   },
diff --git a/calico-enterprise_versioned_docs/version-3.19-2/variables.js b/calico-enterprise_versioned_docs/version-3.19-2/variables.js
index 6ef7cff14f..a481acd372 100644
--- a/calico-enterprise_versioned_docs/version-3.19-2/variables.js
+++ b/calico-enterprise_versioned_docs/version-3.19-2/variables.js
@@ -9,6 +9,7 @@ const variables = {
   openSourceVersion: releases[0].calico.minor_version.slice(1),
   baseUrl: '/calico-enterprise/3.19',
   filesUrl: 'https://downloads.tigera.io/ee/v3.19.7',
+  // No rpmsUrl for this release
   tutorialFilesURL: 'https://docs.tigera.io/files',
   tmpScriptsURL: 'https://docs.tigera.io/calico-enterprise/3.19',
   windowsScriptsURL: 'https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/hostprocess',
diff --git a/calico-enterprise_versioned_docs/version-3.20-2/releases.json b/calico-enterprise_versioned_docs/version-3.20-2/releases.json
index e1ec18c60f..4352e1fd28 100644
--- a/calico-enterprise_versioned_docs/version-3.20-2/releases.json
+++ b/calico-enterprise_versioned_docs/version-3.20-2/releases.json
@@ -71,7 +71,10 @@
         "version": "v0.28.1"
       },
       "coreos-config-reloader": {
-        "version": "v0.76.2"
+        "version": "v0.76.0"
+      },
+      "coreos-fluentd": {
+        "version": "1.18.0"
       },
       "coreos-prometheus": {
         "version": "v2.55.1"
@@ -235,9 +238,6 @@
       "upstream-dex": {
         "version": "v2.41.1"
       },
-      "upstream-fluentd": {
-        "version": "1.18.0"
-      },
       "voltron": {
         "version": "v3.20.5",
         "image": "tigera/voltron"
diff --git a/calico-enterprise_versioned_docs/version-3.20-2/variables.js b/calico-enterprise_versioned_docs/version-3.20-2/variables.js
index 999460ad31..20748e7315 100644
--- a/calico-enterprise_versioned_docs/version-3.20-2/variables.js
+++ b/calico-enterprise_versioned_docs/version-3.20-2/variables.js
@@ -7,7 +7,7 @@ const variables = {
   prodnamedash: 'calico-enterprise',
   version: 'v3.20',
   openSourceVersion: releases[0].calico.minor_version.slice(1),
-  baseUrl: '/calico-enterprise/latest',
+  baseUrl: '/calico-enterprise/3.20',
   filesUrl: 'https://downloads.tigera.io/ee/v3.20.5',
   rpmsUrl: 'https://downloads.tigera.io/ee/rpms/v3.20',
   tutorialFilesURL: 'https://docs.tigera.io/files',
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/releases.json b/calico-enterprise_versioned_docs/version-3.21-2/releases.json
index a336baae50..091a977960 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/releases.json
+++ b/calico-enterprise_versioned_docs/version-3.21-2/releases.json
@@ -1,5 +1,5 @@
 [
-    {
+  {
     "title": "v3.21.2",
     "tigera-operator": {
       "version": "v1.38.5",
diff --git a/calico-enterprise_versioned_docs/version-3.22-1/releases.json b/calico-enterprise_versioned_docs/version-3.22-1/releases.json
index 3d6938bcc7..25130f26e9 100644
--- a/calico-enterprise_versioned_docs/version-3.22-1/releases.json
+++ b/calico-enterprise_versioned_docs/version-3.22-1/releases.json
@@ -35,6 +35,10 @@
         "version": "v3.22.0-1.0",
         "image": "tigera/cnx-manager"
       },
+      "cnx-manager-proxy": {
+        "version": "v3.22.0-1.0",
+        "image": "tigera/cnx-manager-proxy"
+      },
       "cnx-node": {
         "version": "v3.22.0-1.0",
         "image": "tigera/cnx-node"
@@ -254,6 +258,10 @@
         "version": "v3.22.0-1.0",
         "image": "tigera/voltron"
       },
+      "waf-http-filter": {
+        "version": "v3.22.0-1.0",
+        "image": "tigera/waf-http-filter"
+      },
       "webhooks-processor": {
         "version": "v3.22.0-1.0",
         "image": "tigera/webhooks-processor"
diff --git a/scripts/update-component-versions.sh b/scripts/update-component-versions.sh
index e66a735ede..0353cd9bbb 100755
--- a/scripts/update-component-versions.sh
+++ b/scripts/update-component-versions.sh
@@ -43,11 +43,11 @@ get_product_version_info() {
   local version=$1
   product_branch_ref=$(get_product_branch_ref $version)
   api_url="https://api.github.com/repos/${product_repo_dict[$PRODUCT]}/contents/calico/_data/versions.yml${product_branch_ref}"
-  versions_yml=$(curl -H 'Accept: application/vnd.github.v3.raw' -H "Authorization: token ${GITHUB_TOKEN}" "${api_url}")
+  versions_yml=$(curl -fsSL -H 'Accept: application/vnd.github.v3.raw' -H "Authorization: token ${GITHUB_TOKEN}" "${api_url}")
   yq "
   ... comments=\"\" | .[] |
-  select(.title == \"v${VERSION}\" or .title == \"${VERSION}\")
-  " <(echo "$versions_yml")
+  select(.title == \"v${VERSION}\" or .title == \"${VERSION}\") 
+  " <(echo "$versions_yml") | scripts/versions/format-versions
 }
 
 get_docs_folder_path() {
@@ -75,10 +75,46 @@ update_calico_enterprise_version() {
   fi
   local release_title=v${VERSION}
   local release_stream=$(echo ${VERSION} | cut -d. -f1,2)
+  local release_stream_minor=${release_stream#3.}
   local docs_base_url="/calico-enterprise/${release_stream}"
+
+  latest_count=$(grep -F "/calico-enterprise/latest" calico-enterprise_versioned_docs/version-*/variables.js | wc -l)
+
+  # None of the current versions are set as latest, so we should make sure the user sets one
+  if [ ${latest_count} -eq 0 ] && [ "${IS_LATEST}" != "true" ]; then
+    echo >&2 "No versions are set as latest; please run one of the version/autogen targets with IS_LATEST=true"
+    exit 1
+  fi
+
+  # There's more than one 'latest', this is one of them, and we've *not* specified
+  # this one should be latest, so we're fixing the problem.
+  if [ ${latest_count} -gt 1 ] && \
+    grep -F -q "/calico-enterprise/latest" "${docs_folder_path}/variables.js" && \
+    [ "${IS_LATEST}" != "true" ]; then
+    echo >&2 "[warn] More than one version is set as latest, including this one, but we're unsetting this one"
+
+  # Otherwise, bail out and force the user to fix the invalid one(s) first.
+  elif [ ${latest_count} -gt 1 ]; then
+    echo >&2 "Currently ${latest_count} versions are set as latest. Please regenerate any which are incorrect first:"
+    grep -F --files-with-matches "/calico-enterprise/latest" calico-enterprise_versioned_docs/version-*/variables.js | sed 's/^/    /'
+    exit 1
+  fi
+
+  if [ ${latest_count} -eq 1 ] && grep -F -q "/calico-enterprise/latest" "${docs_folder_path}/variables.js"; then
+    echo "[info] Release ${release_stream} is set as latest in docs, keeping it as latest for now"
+    IS_LATEST=true
+  fi
+
   if [ "${IS_LATEST}" == "true" ]; then
     docs_base_url="/calico-enterprise/latest"
   fi
+
+  if [ ${release_stream_minor} -ge 20 ]; then
+    rpmsUrl="rpmsUrl: 'https://downloads.tigera.io/ee/rpms/v${release_stream}',"
+  else
+    rpmsUrl="// No rpmsUrl for this release"
+  fi
+
   cat <<EOF >${docs_folder_path}/variables.js
 const releases = require('./releases.json');
 const componentImage = require('../../src/components/utils/componentImage');
@@ -88,8 +124,10 @@ const variables = {
   prodname: 'Calico Enterprise',
   prodnamedash: 'calico-enterprise',
   version: 'v${release_stream}',
+  openSourceVersion: releases[0].calico.minor_version.slice(1),
   baseUrl: '${docs_base_url}',
   filesUrl: 'https://downloads.tigera.io/ee/${release_title}',
+  ${rpmsUrl}
   tutorialFilesURL: 'https://docs.tigera.io/files',
   tmpScriptsURL: 'https://docs.tigera.io/calico-enterprise/${release_stream}',
   windowsScriptsURL: 'https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/hostprocess',
diff --git a/scripts/versions/.gitignore b/scripts/versions/.gitignore
new file mode 100644
index 0000000000..fa32ff22ce
--- /dev/null
+++ b/scripts/versions/.gitignore
@@ -0,0 +1 @@
+format-versions
diff --git a/scripts/versions/Makefile b/scripts/versions/Makefile
new file mode 100644
index 0000000000..6d719ae467
--- /dev/null
+++ b/scripts/versions/Makefile
@@ -0,0 +1,4 @@
+.SILENT:
+
+all:
+	go build -v -o format-versions
diff --git a/scripts/versions/go.mod b/scripts/versions/go.mod
new file mode 100644
index 0000000000..ba9b34278f
--- /dev/null
+++ b/scripts/versions/go.mod
@@ -0,0 +1,5 @@
+module parseyaml/v2
+
+go 1.23.6
+
+require gopkg.in/yaml.v3 v3.0.1
diff --git a/scripts/versions/go.sum b/scripts/versions/go.sum
new file mode 100644
index 0000000000..a62c313c5b
--- /dev/null
+++ b/scripts/versions/go.sum
@@ -0,0 +1,4 @@
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/scripts/versions/main.go b/scripts/versions/main.go
new file mode 100644
index 0000000000..1ed182e2ef
--- /dev/null
+++ b/scripts/versions/main.go
@@ -0,0 +1,144 @@
+// Package main is small functionality to pre-process versions.yaml for docs.
+package main
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"slices"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// Components where the component's key in the map is different from the docker image name
+var imageNameMaps = map[string]string{
+	"cnx-kube-controllers":        "kube-controllers",
+	"csi-node-driver-registrar":   "node-driver-registrar",
+	"elastic-tsee-installer":      "intrusion-detection-job-installer",
+	"elasticsearch-operator":      "eck-operator",
+	"flexvol":                     "pod2daemon-flexvol",
+	"gateway-api-envoy-gateway":   "envoy-gateway",
+	"gateway-api-envoy-proxy":     "envoy-proxy",
+	"gateway-api-envoy-ratelimit": "envoy-ratelimit",
+	"tigera-cni-windows":          "cni-windows",
+	"tigera-cni":                  "cni",
+	"tigera-prometheus-service":   "prometheus-service",
+}
+
+// Components that we want to remove from the components list entirely
+var componentsToPrune = []string{
+	"calico-private",
+}
+
+// Components where the key in the upstream yaml file is different from what's present in docs
+var componentsToRename = map[string]string{
+	"upstream-fluentd": "coreos-fluentd",
+}
+
+// Components that we leave as-is without updating
+var componentsToIgnore = []string{
+	"upstream-dex",
+}
+
+// TigeraOperator represents the tigera-operator configuration
+type TigeraOperator struct {
+	Version  string `yaml:"version" json:"version"`
+	Image    string `yaml:"image" json:"image"`
+	Registry string `yaml:"registry" json:"registry"`
+}
+
+// Component represents a single component with version information
+type Component struct {
+	Version string `yaml:"version" json:"version"`
+	Image   string `yaml:"image,omitempty" json:"image"`
+}
+
+// Components represents all the components in the versions file
+type Components map[string]*Component
+
+// revalidate ensures that the appropriate keys are specified for each component
+func (c Components) revalidate() {
+
+	// Rename c[oldname] to c[newname] for cases where our keys don't match the docs keys
+	for oldName, newName := range componentsToRename {
+		entry, ok := c[oldName]
+		if ok {
+			c[newName] = entry
+			delete(c, oldName)
+		}
+	}
+
+	// Remove these components
+	for _, img := range componentsToPrune {
+		delete(c, img)
+	}
+
+	// Filter the remaining components to ensure their versions and image names are correct
+	for componentName, component := range c {
+		// Skip over ignored components
+		if slices.Contains(componentsToIgnore, componentName) {
+			continue
+		}
+
+		// We specify coreos and ECK components, even though they don't have images
+		// for those components. The actual images are listed under separate components.
+		if strings.HasPrefix(componentName, "coreos-") || strings.HasPrefix(componentName, "eck-") {
+			continue
+		}
+
+		// For each component, ensure that we set a default image path if one does not exist
+		if component.Image == "" {
+			val, ok := imageNameMaps[componentName]
+			if ok {
+				component.Image = fmt.Sprintf("tigera/%s", val)
+			} else {
+				component.Image = fmt.Sprintf("tigera/%s", componentName)
+			}
+		}
+	}
+}
+
+// Calico represents the calico configuration
+type Calico struct {
+	MinorVersion string `yaml:"minor_version" json:"minor_version"`
+	ArchivePath  string `yaml:"archive_path" json:"archive_path"`
+}
+
+// Versions represents the complete structure of the versions.yaml file
+type Versions struct {
+	Title          string         `yaml:"title" json:"title"`
+	ReleaseName    string         `yaml:"release_name" json:"release_name"`
+	Note           string         `yaml:"note" json:"note"`
+	FullHash       string         `yaml:"full_hash" json:"full_hash"`
+	TigeraOperator TigeraOperator `yaml:"tigera-operator" json:"tigera-operator"`
+	Components     Components     `yaml:"components" json:"components"`
+	HelmRelease    string         `yaml:"helmRelease" json:"helmRelease"`
+	Calico         Calico         `yaml:"calico" json:"calico"`
+}
+
+func main() {
+	// Read the YAML file
+	// yamlData, err := os.ReadFile("versions.yaml")
+	yamlData, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		log.Fatalf("Error reading YAML file from stdin: %v", err)
+	}
+
+	// Parse YAML into the Versions struct
+	var versions Versions
+	err = yaml.Unmarshal(yamlData, &versions)
+	if err != nil {
+		log.Fatalf("Error parsing YAML: %v", err)
+	}
+
+	versions.Components.revalidate()
+
+	newYamlData, err := yaml.Marshal(versions)
+	if err != nil {
+		panic(err)
+	}
+	fmt.Print(string(newYamlData))
+
+}