diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 11b301c2..9be1ce3b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -24,6 +24,10 @@ jobs:
           VERSION=pr-${{ github.event.pull_request.number }}-merge
           COMMIT_SHA=${{ github.event.pull_request.head.sha }}
         fi
+        printf "Version resolved to %s\n" "${VERSION}"
+        echo ::set-output name=version::${VERSION}
+        echo ::set-output name=version-sha::${COMMIT_SHA}
+
         TAGS=${{ github.repository }}:sha-${COMMIT_SHA:0:7}
         SLIM_TAGS=${{ github.repository }}:slim-sha-${COMMIT_SHA:0:7}
         if [[ -n $VERSION ]]; then
@@ -54,6 +58,9 @@ jobs:
       with:
         push: ${{ (github.event_name == 'release' && github.event.action == 'created') || github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'schedule' }}
         tags: ${{ steps.prepare.outputs.tags }}
+        build-args: |
+          VERSION=${{ steps.prepare.outputs.version }}
+          VERSION_SHA=${{ steps.prepare.outputs.version-sha }}
     - name: "Build and push slim docker image to DockerHub"
       id: docker_slim_build
       uses: docker/build-push-action@v2
@@ -61,3 +68,6 @@ jobs:
         file: ./Dockerfile.slim
         push: ${{ (github.event_name == 'release' && github.event.action == 'created') || github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'schedule' }}
         tags: ${{ steps.prepare.outputs.slim-tags }}
+        build-args: |
+          VERSION=${{ steps.prepare.outputs.version }}
+          VERSION_SHA=${{ steps.prepare.outputs.version-sha }}
diff --git a/modules/terraform/scripts/nightly-update b/modules/terraform/scripts/nightly-update
old mode 100644
new mode 100755
index aac92847..2c57b8e7
--- a/modules/terraform/scripts/nightly-update
+++ b/modules/terraform/scripts/nightly-update
@@ -1,7 +1,11 @@
 #!/bin/bash
 
-export THIS_UPDATE_SHA=
-export LATEST_NULL_LABEL_VERSION=
+export THIS_UPDATE_SHA=${VERSION_SHA}
+[[ -n $THIS_UPDATE_SHA ]] || { echo "# Cannot find update SHA, quitting" >&2; exit 99; }
+
+# We leave LATEST_NULL_LABEL_VERSION to be updated manually, so we can have a testing period
+# where we only roll out a new null-label version to a few modules at first.
+export LATEST_NULL_LABEL_VERSION=0.24.1
 
 export CREATE_PR=false
 export CREATE_RELEASE=false
@@ -15,14 +19,14 @@ function set_outputs() {
 	printf "::set-output name=create_pull_request::%s\n" "${CREATE_PR}"
 	[[ "${CREATE_RELEASE}" == "true" ]] || PR_LABELS+=,no-release
 	printf "::set-output name=pull_request_labels::%s\n" "${PR_LABELS}"
-	printf "::set-output name=nightly_update_sha::%s\n" "${THIS_UPDATE_SHA}"
+	printf "::set-output name=nightly_update_sha::%s\n" "${THIS_UPDATE_SHA:0:7}"
 	printf "::set-output name=null_label_version::%s\n" "${LATEST_NULL_LABEL_VERSION}"
 }
 
 trap set_outputs EXIT RETURN
 
 if [[ -r $CHECKPOINT_FILE ]]; then
-	LAST_UPDATE_SHA=$(jq -r .LAST_UPDATE_SHA <x)
+	LAST_UPDATE_SHA=$(jq -r .LAST_UPDATE_SHA <${CHECKPOINT_FILE})
 	if [[ "${LAST_UPDATE_SHA}" == "${THIS_UPDATE_SHA}" ]]; then
 		printf "Already updated to %s. Exiting.\n" "$LAST_UPDATE_SHA"
 		exit 0
diff --git a/templates/terraform/.github/workflows/nightly-update-terraform.yml b/templates/terraform/.github/workflows/nightly-update-terraform.yml
index a4dcff5a..3fe4c57c 100644
--- a/templates/terraform/.github/workflows/nightly-update-terraform.yml
+++ b/templates/terraform/.github/workflows/nightly-update-terraform.yml
@@ -1,5 +1,7 @@
 name: "nightly"
 on:
+  workflow_dispatch:
+
   schedule:
   # Update Terraform modules nightly
   - cron:  '0 3 * * *'
@@ -12,14 +14,30 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
+    - name: Check for update
+      id: check
+      shell: bash
+      run: |
+        CHECKPOINT_FILE=".github/last-update.json"
+        if [[ -r $CHECKPOINT_FILE ]]; then
+        	LAST_UPDATE_SHA=$(jq -r .LAST_UPDATE_SHA <${CHECKPOINT_FILE})
+            BH_LATEST_COMIIT=$(curl -sSL https://api.github.com/repos/cloudposse/build-harness/commits?per_page=1 | jq -r .[0].sha)
+        	if [[ "${LAST_UPDATE_SHA}" == "${BH_LATEST_COMIIT}" ]]; then
+        		printf "Already updated to %s. Skipping.\n" "$LAST_UPDATE_SHA"
+                printf "::set-output name=update::false\n"
+                exit 0
+        	fi
+        fi
+        printf "::set-output name=update::true\n"
+
     - name: Nightly Update
       id: nightly
-      if: github.event_name == 'schedule'
+      if: steps.check.outputs.update == 'true'
       shell: bash
       run: /usr/bin/make BUILD_HARNESS_PATH=/build-harness PACKAGES_PREFER_HOST=true -f /build-harness/templates/Makefile.build-harness terraform/nightly/host
 
     - name: Create Pull Request
-      if: steps.nightly.outputs.create_pull_request == 'true'
+      if: steps.check.outputs.update == 'true' && steps.nightly.outputs.create_pull_request == 'true'
       uses: cloudposse/actions/github/create-pull-request@0.28.1
       with:
         token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}