diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index e4e15076d..000000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-version: 2.1
-jobs:
-  lint-scripts:
-    docker:
-      - image: koalaman/shellcheck-alpine
-    steps:
-      - checkout
-      - run:
-          command: |
-            shellcheck -x test/e2e-kind.sh
-          
-  lint-install-charts:
-    machine:
-      image: ubuntu-2004:202201-02
-    environment:
-      CHART_TESTING_IMAGE: quay.io/helmpack/chart-testing
-      CHART_TESTING_TAG: v2.3.3
-      K8S_VERSION: v1.14.2
-      KIND_VERSION: v0.3.0
-    steps:
-      - checkout
-      - run:
-          command: test/e2e-kind.sh
-          no_output_timeout: 3600
-          
-workflows:
-  version: 2
-  lint_and_install:
-    jobs:
-      - lint-scripts
-      - lint-install-charts:
-          requires:
-            - lint-scripts
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 57629ffbc..caea2801d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,3 +1,4 @@
+---
 version: 2
 updates:
   - package-ecosystem: gomod
@@ -9,3 +10,12 @@ updates:
       include: scope
     open-pull-requests-limit: 2
     target-branch: main
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: update-github-action
+      include: scope
+    open-pull-requests-limit: 2
+    target-branch: main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cfef113bd..bde10a4f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,18 @@
+---
 name: continuous-integration
+
 on:
-  - push
-  - pull_request
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    env:
+      GOLANGCI_LINT_VERSION: v1.51.2
+
     steps:
       - uses: actions/checkout@v3
       - name: Set up Go
@@ -13,7 +21,11 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
       - name: Lint code
-        run: make lint-docker
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          skip-pkg-cache: true
+          skip-build-cache: true
 
   build:
     env:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fe1669bab..d1f3fd11f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 3a7af6f18..f82604d26 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -8,13 +8,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: unshallow
         run: git fetch --prune --unshallow
       - name: setup-go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.19
+          go-version: "1.20"
       - name: capture current date
         id: date
         run: echo "::set-output name=date::$(date -u '+%Y-%m-%d-%H:%M:%S-%Z')"
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index b8f4b1a11..d6430905c 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -287,12 +287,7 @@ $ git cherry-pick <commit from main>
 ```
 
 ### Updating the helm chart
-
-Regardless of which branch you created, you'll need to update the helm chart number. After you've cut the branch, make sure to change the versions in the [`Chart.yaml`](./charts/athens-proxy/Chart.yaml) file:
-
-- If this is a new release of Athens, make sure to update the Docker image version [value](./charts/athens-proxy/values.yaml#L5)
-- Increment the patch number in the [`version` field](./charts/athens-proxy/Chart.yaml#L2)
-- Set the [`appVersion` field](./charts/athens-proxy/Chart.yaml#L2) to the semver of the new branch. Do not include the `v` prefix
+see https://github.com/gomods/athens-charts
 
 ## Creating the new release in GitHub
 
@@ -311,17 +306,8 @@ Make sure the Github Actions CI/CD job finished, and check in Docker Hub to make
 The Github Actions job will do everything except:
 
 - Tweet out about the new release
-- Update the helm chart in the `main` branch
+- Update the helm chart
 
 If you are a core maintainer and don't have access to the `@gomods` account, ask one of the maintainers to give you access. [Here](https://twitter.com/gomodsio/status/1240016379962691585) is an example showing the general format of these tweets. Obviously you should use your creativity here though!
 
-Finally, you'll need to update the helm version number in the `main` branch. Create a new branch called `update-helm-$CURRENT_TAG` and update the following files:
-
-- [charts/athens-proxy/values.yaml](./charts/athens-proxy/values.yaml) - update the `image.tag` field to the latest version number you created, including the `v`. This field should be near the top of the file
-- [charts/athens-proxy/Chart.yaml](./charts/athens-proxy/Chart.yaml) - update the `version` field and the `appVersion` field
-  - Increment the patch number in the `version` field
-  - Change the `appVersion` field to the tag name of the GitHub version you created, including the `v`
-
-[Here](https://github.com/gomods/athens/pull/1574) is an example of how to do this.
-
 Finally, create a pull request from your new branch into the `main` branch. It will be reviewed and merged as soon as possible.
diff --git a/Dockerfile.test b/Dockerfile.test
index 25ed1dfbe..fc205e3fa 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -1,4 +1,4 @@
-ARG GOLANG_VERSION=1.19
+ARG GOLANG_VERSION=1.20
 FROM golang:$GOLANG_VERSION
 
 RUN echo $GOLANG_VERSION
diff --git a/Makefile b/Makefile
index f99c2162b..446266335 100644
--- a/Makefile
+++ b/Makefile
@@ -4,16 +4,16 @@ DATE=$(shell date -u +%Y-%m-%d-%H:%M:%S-%Z)
 GOLANGCI_LINT_VERSION=v1.51.2
 
 ifndef GOLANG_VERSION
-override GOLANG_VERSION = 1.19
+override GOLANG_VERSION = 1.20
 endif
 
 .PHONY: build
 build: ## build the athens proxy
-	go build -o ./cmd/proxy/proxy ./cmd/proxy
+	go build -ldflags="-w -s" -o ./cmd/proxy/proxy ./cmd/proxy
 
 .PHONY: build-ver
 build-ver: ## build the athens proxy with version number
-	GO111MODULE=on CGO_ENABLED=0 GOPROXY="https://proxy.golang.org" go build -ldflags "-X github.com/gomods/athens/pkg/build.version=$(VERSION) -X github.com/gomods/athens/pkg/build.buildDate=$(DATE)" -o athens ./cmd/proxy
+	GO111MODULE=on CGO_ENABLED=0 GOPROXY="https://proxy.golang.org" go build -ldflags "-s -w -X github.com/gomods/athens/pkg/build.version=$(VERSION) -X github.com/gomods/athens/pkg/build.buildDate=$(DATE)" -o athens ./cmd/proxy
 
 athens:
 	$(MAKE) build-ver
@@ -89,14 +89,6 @@ proxy-docker:
 docker-push:
 	./scripts/push-docker-images.sh
 
-.PHONY: charts-push
-charts-push: build-image
-	docker run --rm -it \
-	-v `pwd`:/go/src/github.com/gomods/athens \
-	-e AZURE_STORAGE_CONNECTION_STRING \
-	-e CHARTS_REPO \
-	athens-build ./scripts/push-helm-charts.sh
-
 bench:
 	./scripts/benchmark.sh
 
diff --git a/appveyor.yml b/appveyor.yml
index c595b6cc8..6ae53ddf5 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -10,7 +10,7 @@ environment:
   GOPROXY: https://proxy.golang.org
   SKIP_UNTIL_113: true
 
-stack: go 1.19
+stack: go 1.20
 
 test_script:
   - go version
diff --git a/charts/athens-proxy/Chart.yaml b/charts/athens-proxy/Chart.yaml
deleted file mode 100644
index c2b54b671..000000000
--- a/charts/athens-proxy/Chart.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-name: athens-proxy
-version: 0.5.2
-appVersion: 0.11.1
-description: The proxy server for Go modules
-icon: https://raw.githubusercontent.com/gomods/athens/main/docs/static/banner.png
-keywords:
-- Golang
-- Package Management
-- Goproxy
-home: https://github.com/gomods/athens
-sources:
-maintainers:
-- name: rimusz
-  email: rmocius@gmail.com
-- name: arschles
-  email: aaron@ecomaz.net
-engine: gotpl
diff --git a/charts/athens-proxy/OWNERS b/charts/athens-proxy/OWNERS
deleted file mode 100644
index a7fa63874..000000000
--- a/charts/athens-proxy/OWNERS
+++ /dev/null
@@ -1,7 +0,0 @@
-approvers:
-- rimusz
-- arschles
-reviewers:
-- rimusz
-- arschles
-
diff --git a/charts/athens-proxy/README.md b/charts/athens-proxy/README.md
index 4063b34ae..97fbf0a7a 100644
--- a/charts/athens-proxy/README.md
+++ b/charts/athens-proxy/README.md
@@ -1,85 +1,2 @@
 # Athens Proxy Helm Chart
-
-## What is Athens?
-
-[Athens](https://docs.gomods.io) is a repository for packages used by your go packages.
-
-Athens provides a repository for [Go Modules](https://github.com/golang/go/wiki/Modules) that you can run. It serves public code and your private code for you, so you don't have to pull directly from a version control system (VCS) like GitHub or GitLab.
-
-## Prerequisites
-
-* Kubernetes 1.10+
-
-## Requirements
-
-- A running Kubernetes cluster
-- [Kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) installed and setup to use the cluster
-- [Helm](https://helm.sh/) [installed](https://github.com/helm/helm#install) and setup to use the cluster (helm init) or [Tillerless Helm](https://github.com/rimusz/helm-tiller)
-
-## Deploy Athens
-
-The fastest way to install Athens using Helm is to deploy it from our public Helm chart repository. First, add the repository with this command:
-
-Hint: To make the chart available again, the chart is temporarily hosted at sickhub.github.io until we've found a new solution.
-
-```console
-$ helm repo add athens https://sickhub.github.io/athens-proxy
-$ helm repo update
-```
-
-Next, install the chart with default values to `athens` namespace:  
-
-```
-$ helm install athens/athens-proxy -n athens --namespace athens
-```
-
-This will deploy a single Athens instance in the `athens` namespace with `disk` storage enabled. Additionally, a `ClusterIP` service will be created.
-
-
-## Advanced Configuration
-
-For more advanced configuration options please check Athens [docs](https://docs.gomods.io/install/install-on-kubernetes/#advanced-configuration).
-
-Available options:
-- [Replicas](https://docs.gomods.io/install/install-on-kubernetes/#replicas)
-- [Access to private repositories via Github](https://docs.gomods.io/install/install-on-kubernetes/#give-athens-access-to-private-repositories-via-github-token-optional)
-- [Storage Providers](https://docs.gomods.io/install/install-on-kubernetes/#storage-providers)
-- [Kubernetes Service](https://docs.gomods.io/install/install-on-kubernetes/#kubernetes-service)
-- [Ingress Resource](https://docs.gomods.io/install/install-on-kubernetes/#ingress-resource)
-- [Upstream module repository](https://docs.gomods.io/install/install-on-kubernetes/#upstream-module-repository)
-- [.netrc file support](https://docs.gomods.io/install/install-on-kubernetes/#netrc-file-support)
-- [gitconfig support](https://docs.gomods.io/install/install-on-kubernetes/#gitconfig-support)
-
-### Pass extra configuration environment variables
-
-You can pass any extra environment variables supported in [config.dev.toml](../../../config.dev.toml).
-The example below shows how to set username/password for basic auth:
-
-```yaml
-configEnvVars:
-  - name: BASIC_AUTH_USER
-    value: "some_user"
-  - name: BASIC_AUTH_PASS
-    value: "some_password"
-```
-
-### Private git servers over ssh support
-
-One or more of git servers can added to `sshGitServers`, and the corresponding config files (git config and ssh config) and ssh keys will be created. Athens then will use these configs and keys to download the source from the git servers.
-
-```yaml
-sshGitServers: 
-  ## Private git servers over ssh
-  ## to enable uncomment lines with single hash below
-  ## hostname of the git server
-  - host: git.example.com
-    ## ssh username
-    user: git
-    ## ssh private key for the user
-    privateKey: |
-      -----BEGIN RSA PRIVATE KEY-----
-      ...
-      -----END RSA PRIVATE KEY-----
-    ## ssh port
-    port: 22
-```
+The chart has a new home at https://github.com/gomods/athens-charts
\ No newline at end of file
diff --git a/charts/athens-proxy/templates/NOTES.txt b/charts/athens-proxy/templates/NOTES.txt
deleted file mode 100644
index 9f7c0d843..000000000
--- a/charts/athens-proxy/templates/NOTES.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{{- if .Values.ingress.enabled }}
-The Athens can be accessed via URL:
-{{- else }}
-Get the Athens URL by running these commands:
-{{- end }}
-{{- if (and .Values.ingress.enabled .Values.ingress.tls) }}
-{{- range .Values.ingress.hosts }}
-  https://{{ . }}
-{{- end }}
-{{- else if .Values.ingress.enabled }}
-{{- range .Values.ingress.hosts }}
-  http://{{ . }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get svc -w {{ template "fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
-  echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "fullname" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl port-forward $POD_NAME 8080:3000
-{{- end }}
diff --git a/charts/athens-proxy/templates/_helpers.tpl b/charts/athens-proxy/templates/_helpers.tpl
deleted file mode 100644
index dd892ad80..000000000
--- a/charts/athens-proxy/templates/_helpers.tpl
+++ /dev/null
@@ -1,19 +0,0 @@
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-*/}}
-{{- define "fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- define "readinessPath" -}}
-{{- if contains "v0.2.0" .Values.image.tag -}}/{{- else -}}/readyz{{- end -}}
-{{- end -}}
diff --git a/charts/athens-proxy/templates/config-ssh-git-servers.yaml b/charts/athens-proxy/templates/config-ssh-git-servers.yaml
deleted file mode 100644
index e5cceba3f..000000000
--- a/charts/athens-proxy/templates/config-ssh-git-servers.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-{{- if .Values.sshGitServers -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ template "fullname" . }}-ssh-git-servers
-  labels:
-    app: {{ template "fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-data:
-  ssh_config: |
-    {{- range $server := .Values.sshGitServers }}
-    Host {{ $server.host }}
-      Hostname {{ $server.host }}
-      User {{ $server.user }}
-      Port {{ $server.port }}
-      StrictHostKeyChecking no
-      IdentityFile /ssh-keys/id_rsa-{{ $server.host }}
-    {{- end }}
-  git_config: |
-    {{- range $server := .Values.sshGitServers }}
-    [url "ssh://{{ $server.user }}@{{ $server.host }}:{{ $server.port}}"]
-      insteadOf = https://{{ $server.host }}
-    {{- end }}
-{{- end -}}
diff --git a/charts/athens-proxy/templates/config-upstream.yaml b/charts/athens-proxy/templates/config-upstream.yaml
deleted file mode 100644
index ccce0684b..000000000
--- a/charts/athens-proxy/templates/config-upstream.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.upstreamProxy.enabled -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ template "fullname" . }}-upstream
-  labels:
-    app: {{ template "fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-data:
-  FilterForUpstreamProxy: |-
-    # FilterFile for fetching modules directly from upstream proxy
-    D
-{{- end -}}
diff --git a/charts/athens-proxy/templates/deployment.yaml b/charts/athens-proxy/templates/deployment.yaml
deleted file mode 100644
index 48516fab8..000000000
--- a/charts/athens-proxy/templates/deployment.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "fullname" . }}
-  labels:
-    app: {{ template "fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  replicas: {{ .Values.replicaCount }}
-{{- if .Values.strategy }}
-  strategy:
-{{ toYaml .Values.strategy | indent 4 }}
-  {{- if eq .Values.strategy.type "Recreate" }}
-  rollingUpdate: null
-  {{- end }}
-{{- end }}
-  selector:
-    matchLabels:
-      app: {{ template "fullname" . }}
-      release: "{{ .Release.Name }}"
-  template:
-    metadata:
-      labels:
-        app: {{ template "fullname" . }}
-        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-        release: "{{ .Release.Name }}"
-      annotations:
-        checksum/upstream: {{ include (print $.Template.BasePath "/config-upstream.yaml") . | sha256sum }}
-        checksum/ssh-config: {{ include (print $.Template.BasePath "/config-ssh-git-servers.yaml") . | sha256sum }}
-        checksum/ssh-secret: {{ include (print $.Template.BasePath "/secret-ssh-git-servers.yaml") . | sha256sum }}
-        {{- if .Values.annotations }}
-{{ toYaml .Values.annotations | indent 8 }}
-        {{- end }}
-    spec:
-      serviceAccount: {{ template "fullname" . }}
-      {{- if .Values.sshGitServers }}
-      initContainers:
-        - name: copy-key-files
-          image: alpine:3.9
-          command:
-            - sh
-            - -c
-          args: ["cp /root/.ssh/id_rsa* /ssh-keys && chmod 400 /ssh-keys/*"]
-          volumeMounts:
-          - name: ssh-keys
-            mountPath: /ssh-keys
-          {{- range $server := .Values.sshGitServers }}
-          - name: ssh-git-servers-secret
-            mountPath: /root/.ssh/id_rsa-{{ $server.host }}
-            subPath: id_rsa-{{ $server.host }}
-          {{- end }}
-      {{- end }}
-      containers:
-      - name: {{ template "fullname" . }}
-        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-        imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
-        livenessProbe:
-          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
-          httpGet:
-            path: "/healthz"
-            port: 3000
-          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
-          successThreshold: {{ .Values.livenessProbe.successThreshold }}
-          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
-        readinessProbe:
-          httpGet:
-            path: "{{ template "readinessPath" . }}"
-            port: 3000
-        env:
-        - name: ATHENS_GOGET_WORKERS
-        {{- if .Values.goGetWorkers }}
-          value: {{ .Values.goGetWorkers | quote }}
-        {{- else }}
-          value: "3"
-        {{- end }}
-        {{- if .Values.configEnvVars }}
-{{ toYaml .Values.configEnvVars | indent 8 }}
-        {{- end }}
-        - name: ATHENS_STORAGE_TYPE
-          value: {{ .Values.storage.type | quote }}
-        {{- if eq .Values.storage.type "disk"}}
-        - name: ATHENS_DISK_STORAGE_ROOT
-          value: {{ .Values.storage.disk.storageRoot | quote }}
-        {{- else if eq .Values.storage.type "mongo"}}
-        - name: ATHENS_MONGO_STORAGE_URL
-          value: {{ .Values.storage.mongo.url | quote }}
-        {{- else if eq .Values.storage.type "s3" }}
-        - name: AWS_REGION
-          value: {{ .Values.storage.s3.region | quote }}
-        - name: ATHENS_S3_BUCKET_NAME
-          value: {{ .Values.storage.s3.bucket | quote }}
-        - name: AWS_USE_DEFAULT_CONFIGURATION
-          value: {{ .Values.storage.s3.useDefaultConfiguration | quote }}
-        - name: AWS_FORCE_PATH_STYLE
-          value: {{ .Values.storage.s3.ForcePathStyle | quote }}
-        {{- if .Values.storage.s3.access_key_id }}
-        - name: AWS_ACCESS_KEY_ID
-          value: {{ .Values.storage.s3.access_key_id | quote }}
-        {{- end }}
-        {{- if .Values.storage.s3.secret_access_key }}
-        - name: AWS_SECRET_ACCESS_KEY
-          value: {{ .Values.storage.s3.secret_access_key | quote }}
-        {{- end }}
-        {{- if .Values.storage.s3.session_token }}
-        - name: AWS_SESSION_TOKEN
-          value: {{ .Values.storage.s3.session_token | quote }}
-        {{- end }}
-        {{- else if eq .Values.storage.type "gcp"}}
-        - name: GOOGLE_CLOUD_PROJECT
-          value: {{ .Values.storage.gcp.projectID | quote }}
-        - name: ATHENS_STORAGE_GCP_BUCKET
-          value: {{ .Values.storage.gcp.bucket | quote }}
-        {{- if .Values.storage.gcp.serviceAccount }}
-        - name: ATHENS_STORAGE_GCP_JSON_KEY
-          value: {{ .Values.storage.gcp.serviceAccount | b64enc | quote }}
-        {{- end }}
-        {{- else if eq .Values.storage.type "minio" }}
-        {{- if .Values.storage.minio.endpoint }}
-        - name: ATHENS_MINIO_ENDPOINT
-          value: {{ .Values.storage.minio.endpoint | quote }}
-        {{- end }}
-        {{- if .Values.storage.minio.accessKey }}
-        - name: ATHENS_MINIO_ACCESS_KEY_ID
-          value: {{ .Values.storage.minio.accessKey | quote }}
-        {{- end }}
-        {{- if .Values.storage.minio.secretKey }}
-        - name: ATHENS_MINIO_SECRET_ACCESS_KEY
-          value: {{ .Values.storage.minio.secretKey | quote }}
-        {{- end }}
-        {{- if .Values.storage.minio.bucket }}
-        - name: ATHENS_MINIO_BUCKET_NAME
-          value: {{ .Values.storage.minio.bucket | quote }}
-        {{- end }}
-        {{- end }}
-        {{- if .Values.netrc.enabled }}
-        - name: ATHENS_NETRC_PATH
-          value: "/etc/netrc/.netrc"
-        {{- end }}
-        {{- if .Values.upstreamProxy.enabled }}
-        - name: ATHENS_FILTER_FILE
-          value: "/usr/local/lib/FilterForUpstreamProxy"
-        - name: ATHENS_GLOBAL_ENDPOINT
-          value: {{ .Values.upstreamProxy.url | quote }}
-        {{- end }}
-        {{- if .Values.jaeger.enabled }}
-        - name: ATHENS_TRACE_EXPORTER_URL
-          value: {{ .Values.jaeger.url | quote }}
-        - name: ATHENS_TRACE_EXPORTER
-          value: "jaeger"
-        {{- end }}
-        {{- if .Values.basicAuth.enabled }}
-        - name: BASIC_AUTH_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
-              key: {{ default "username" .Values.basicAuth.usernameSecretKey | quote }}
-        - name: BASIC_AUTH_PASS
-          valueFrom:
-            secretKeyRef:
-              name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
-              key: {{ default "password" .Values.basicAuth.passwordSecretKey | quote }}
-        {{- end }}
-        ports:
-        - containerPort: 3000
-        {{- if or (eq .Values.storage.type "disk") .Values.upstreamProxy.enabled .Values.netrc.enabled .Values.sshGitServers .Values.gitconfig.enabled}}
-        volumeMounts:
-        {{- end }}
-        {{- if eq .Values.storage.type "disk" }}
-        - name: storage-volume
-          mountPath: {{ .Values.storage.disk.storageRoot | quote }}
-        {{- end }}
-        {{- if .Values.upstreamProxy.enabled }}
-        - name: upstream-config
-          mountPath: "/usr/local/lib"
-          readOnly: true
-        {{- end }}
-        {{- if .Values.netrc.enabled }}
-        - name: netrc
-          mountPath: "/etc/netrc"
-          readOnly: true
-        {{- end }}
-        {{- if .Values.sshGitServers }}
-        - name: ssh-git-servers-config
-          mountPath: /root/.ssh/config
-          subPath: ssh_config
-        - name: ssh-git-servers-config
-          mountPath: /root/.gitconfig
-          subPath: git_config
-        - name: ssh-keys
-          mountPath: /ssh-keys
-        {{- end }}
-        {{- if .Values.gitconfig.enabled }}
-        - name: gitconfig
-          mountPath: "/etc/gitconfig"
-          subPath: "gitconfig"
-        {{- end }}
-      {{- with .Values.resources }}
-        resources:
-{{ toYaml . | indent 10 }}
-      {{- end }}
-      volumes:
-      - name: storage-volume
-      {{- if .Values.storage.disk.persistence.enabled }}
-        persistentVolumeClaim:
-          claimName: {{ template "fullname" . }}-storage
-      {{- else }}
-        emptyDir: {}
-      {{- end }}
-      {{- if .Values.upstreamProxy.enabled }}
-      - name: upstream-config
-        configMap:
-          name: {{ template "fullname" . }}-upstream
-      {{- end }}
-      {{- if .Values.netrc.enabled }}
-      - name: netrc
-        secret:
-          secretName: {{ .Values.netrc.existingSecret }}
-      {{- end }}
-      {{- if .Values.sshGitServers }}
-      - name: ssh-keys
-        emptyDir: {}
-      - name: ssh-git-servers-config
-        configMap:
-          name: {{ template "fullname" . }}-ssh-git-servers
-      - name: ssh-git-servers-secret
-        secret:
-          secretName: {{ template "fullname" . }}-ssh-git-servers
-      {{- end }}
-      {{- if .Values.gitconfig.enabled }}
-      - name: gitconfig
-        secret:
-          secretName: {{ .Values.gitconfig.secretName }}
-          items:
-          - key: {{ .Values.gitconfig.secretKey }}
-            path: "gitconfig"
-      {{- end }}
-    {{- with .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-    {{- end }}
diff --git a/charts/athens-proxy/templates/ingress.yaml b/charts/athens-proxy/templates/ingress.yaml
deleted file mode 100644
index eda575a8b..000000000
--- a/charts/athens-proxy/templates/ingress.yaml
+++ /dev/null
@@ -1,64 +0,0 @@
-{{- if .Values.ingress.enabled -}}
-{{- $fullName := include "fullname" . -}}
-{{- $svcPort := .Values.service.servicePort -}}
-{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
-  {{- end }}
-{{- end }}
-{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" -}}
-apiVersion: networking.k8s.io/v1
-{{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
-apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: {{ $fullName }}
-  labels:
-    app: {{ template "fullname" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
-            pathType: {{ .pathType }}
-            {{- end }}
-            backend:
-              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
-              service:
-                name: {{ $fullName }}
-                port:
-                  number: {{ $svcPort }}
-              {{- else }}
-              serviceName: {{ $fullName }}
-              servicePort: {{ $svcPort }}
-              {{- end }}
-          {{- end }}
-    {{- end }}
-{{- end }}
diff --git a/charts/athens-proxy/templates/jaeger-deploy.yaml b/charts/athens-proxy/templates/jaeger-deploy.yaml
deleted file mode 100644
index 75083cc37..000000000
--- a/charts/athens-proxy/templates/jaeger-deploy.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-{{- if .Values.jaeger.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "fullname" . }}-jaeger
-  labels:
-    app: {{ template "fullname" . }}-jaeger
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ template "fullname" . }}-jaeger
-      release: "{{ .Release.Name }}"
-  template:
-    metadata:
-      labels:
-        app: {{ template "fullname" . }}-jaeger
-        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-        release: "{{ .Release.Name }}"
-    spec:
-      containers:
-        - env:
-            - name: COLLECTOR_ZIPKIN_HTTP_PORT
-              value: "9441"
-          image: "{{ .Values.jaeger.image.repository }}:{{ .Values.jaeger.image.tag }}"
-          name: {{ template "fullname" . }}-jaeger
-          ports:
-            - containerPort: 14268
-              protocol: TCP
-            - containerPort: 5775
-              protocol: UDP
-            - containerPort: 6831
-              protocol: UDP
-            - containerPort: 6832
-              protocol: UDP
-            - containerPort: 5778
-              protocol: TCP
-            - containerPort: 16686
-              protocol: TCP
-            - containerPort: 9411
-              protocol: TCP
-{{- end -}}
diff --git a/charts/athens-proxy/templates/jaeger-svc.yaml b/charts/athens-proxy/templates/jaeger-svc.yaml
deleted file mode 100644
index 7c5a9d029..000000000
--- a/charts/athens-proxy/templates/jaeger-svc.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-{{- if .Values.jaeger.enabled -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "fullname" . }}-jaeger
-  labels:
-    app: {{ template "fullname" . }}-jaeger
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  type: {{ .Values.jaeger.type }}
-  ports:
-    - name: jaeger-collector-http
-      port: 14268
-      protocol: TCP
-      targetPort: 14268
-    - name: jaeger-zipkin-thrift
-      port: 5775
-      protocol: UDP
-      targetPort: 5775
-    - name: jaeger-compact
-      port: 6831
-      protocol: UDP
-      targetPort: 6831
-    - name: jaeger-binary
-      port: 6832
-      protocol: UDP
-      targetPort: 6832
-    - name: jaeger-configs
-      port: 5778
-      protocol: TCP
-      targetPort: 5778
-    - name: jaeger-query-http
-      port: 16686
-      protocol: TCP
-      targetPort: 16686
-  selector:
-    app: {{ template "fullname" . }}-jaeger
-    release: "{{ .Release.Name }}"
-{{- end -}}
diff --git a/charts/athens-proxy/templates/secret-ssh-git-servers.yaml b/charts/athens-proxy/templates/secret-ssh-git-servers.yaml
deleted file mode 100644
index 228a590dc..000000000
--- a/charts/athens-proxy/templates/secret-ssh-git-servers.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if .Values.sshGitServers -}}
-kind: Secret
-apiVersion: v1
-metadata:
-  name: {{ template "fullname" . }}-ssh-git-servers
-type: Opaque
-data:
-{{- range $server := .Values.sshGitServers }}
-  id_rsa-{{ $server.host }}: {{ $server.privateKey | b64enc | quote }}
-{{- end }}
-{{- end -}}
diff --git a/charts/athens-proxy/templates/service-account.yaml b/charts/athens-proxy/templates/service-account.yaml
deleted file mode 100644
index f616d7c6b..000000000
--- a/charts/athens-proxy/templates/service-account.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "fullname" . }}
-  labels:
-    app: {{ template "fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-{{ toYaml . | indent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/charts/athens-proxy/templates/service.yaml b/charts/athens-proxy/templates/service.yaml
deleted file mode 100644
index 9f650df0e..000000000
--- a/charts/athens-proxy/templates/service.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "fullname" . }}
-{{- if .Values.service.annotations }}
-  annotations:
-{{ toYaml .Values.service.annotations | indent 4 }}
-{{- end }}
-  labels:
-    app: {{ template "fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-  - name: http
-    port: {{ .Values.service.servicePort }}
-    targetPort: 3000
-    protocol: TCP
-    {{- if eq .Values.service.type "NodePort" }}
-    nodePort: {{ .Values.service.nodePort.port }}
-    {{- end }}
-  selector:
-    app: {{ template "fullname" . }}
-    release: "{{ .Release.Name }}"
diff --git a/charts/athens-proxy/templates/storage-pvc.yaml b/charts/athens-proxy/templates/storage-pvc.yaml
deleted file mode 100644
index 03cc8e076..000000000
--- a/charts/athens-proxy/templates/storage-pvc.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-{{- if and (eq .Values.storage.type "disk") .Values.storage.disk.persistence.enabled }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ template "fullname" . }}-storage
-  labels:
-    app: {{ template "fullname" . }}-storage
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  accessModes:
-    - {{ .Values.storage.disk.persistence.accessMode | quote }}
-  resources:
-    requests:
-      storage: {{ .Values.storage.disk.persistence.size | quote }}
-{{- if .Values.storage.disk.persistence.storageClass }}
-{{- if (eq "-" .Values.storage.disk.persistence.storageClass) }}
-  storageClassName: ""
-{{- else }}
-  storageClassName: "{{ .Values.storage.disk.persistence.storageClass }}"
-{{- end }}
-{{- end }}
-{{- end }}
diff --git a/charts/athens-proxy/values.yaml b/charts/athens-proxy/values.yaml
deleted file mode 100644
index b60f213d6..000000000
--- a/charts/athens-proxy/values.yaml
+++ /dev/null
@@ -1,170 +0,0 @@
-replicaCount: 1
-image:
-  registry: docker.io
-  repository: gomods/athens
-  tag: v0.11.0
-
-  ## Specify a imagePullPolicy
-  ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-  ##
-  pullPolicy: IfNotPresent
-
-
-livenessProbe:
-  failureThreshold: 3
-  periodSeconds: 10
-  successThreshold: 1
-  timeoutSeconds: 1
-
-## Server Deployment Strategy type
-# strategy:
-#   type: Recreate
-
-service:
-  ## Additional annotations to apply to the service
-  annotations: {}
-  ## Port as exposed by the service
-  servicePort: 80
-  ## Type of service; valid values are "ClusterIP", "LoadBalancer", and
-  ## "NodePort". "ClusterIP" is sufficient in the case when the Proxy will be used
-  ## from within the cluster. To expose externally, consider a "NodePort" or "LoadBalancer" service.
-  type: ClusterIP
-  ## Further configuration if service is of type "NodePort"
-  nodePort:
-    ## Available port in allowable range (e.g. 30000 - 32767 on minikube)
-    port: 30080
-
-ingress:
-  enabled: false
-  # Provide key/value annotations
-  annotations:
-  className: ""
-  # Provide an array of values for the ingress host mapping
-  hosts:
-    # - host: athens-proxy.local
-    # paths:
-    #   - path: /
-    #     pathType: ImplementationSpecific
-  # Provide a base64 encoded cert for TLS use
-  tls:
-
-storage:
-  type: disk
-  disk:
-    storageRoot: "/var/lib/athens"
-    persistence:
-      ## Note if you use disk.persistence.enabled, replicaCount should be set to 1 unless your access mode is ReadWriteMany
-      ## and strategy type must be Recreate
-      enabled: false
-      accessMode: ReadWriteOnce
-      size: 4Gi
-  mongo:
-    # you must set this on the command line when you run 'helm install'
-    # for example, you need to run 'helm install --set storage.mongo.url=myurl ...'
-    url: "SET THIS ON THE COMMAND LINE"
-  s3:
-    # you must set s3 bucket and region when running 'helm install'
-    region: ""
-    bucket: ""
-    useDefaultConfiguration: true
-  minio:
-    # All these variables needs to be set when configuring athens to run with minio backend
-    endpoint: ""
-    accessKey: ""
-    secretKey: ""
-    bucket: ""
-  gcp:
-  # For more information, see:
-  # https://docs.gomods.io/install/install-on-kubernetes/#google-cloud-storage
-    # you must set gcp projectID and bucket when running 'helm install'
-    projectID: ""
-    bucket: ""
-    # set serviceAccount to a key which has read/write access to the GCS bucket.
-    # If you are running Athens inside GCP, you will most likely not need this
-    # as GCP figures out internal authentication between products for you.
-    serviceAccount: ""
-
-# Extra environment variables to be passed
-# You can add any new ones at the bottom
-configEnvVars: {}
-
-# Extra annotations to be added to the athens pods
-annotations: {}
-
-# HTTP basic auth
-basicAuth:
-  enabled: false
-  secretName: athens-proxy-basic-auth
-  passwordSecretKey: password
-  usernameSecretKey: username
-
-netrc:
-  # if enabled, it expects to find the content of a valid .netrc file imported as a secret named netrcsecret
-  enabled: false
-  existingSecret: netrcsecret
-
-# gitconfig section provides a way to inject git config file to make athens able to fetch modules from private git repos.
-gitconfig:
-  # By default, gitconfig is disabled.
-  enabled: false
-  # Name of the kubernetes secret (in the same namespace as athens-proxy) that contains git config.
-  secretName: athens-proxy-gitconfig
-  # Key in the kubernetes secret that contains git config data.
-  secretKey: gitconfig
-
-upstreamProxy:
-  # This is where you can set the URL for the upstream module repository.
-  # If 'enabled' is set to true, Athens will try to download modules from the upstream when it doesn't find them in its own storage.
-  # Here's a non-exhaustive list of options you can set here:
-  #
-  # - https://gocenter.io
-  # - https://proxy.golang.org
-  # - another Athens server
-  enabled: false
-  url: "https://gocenter.io"
-
-jaeger:
-  ## Type of service; valid values are "ClusterIP", "LoadBalancer", and "NodePort".
-  type: ClusterIP
-  image:
-    repository: jaegertracing/all-in-one
-    tag: latest
-  enabled: true
-  # you must set this on the command line when you run 'helm install'
-  # for example, you need to run 'helm install --set jaeger.url=myurl ...'
-  url: "SET THIS ON THE COMMAND LINE"
-
-sshGitServers: {}
-  ## Private git servers over ssh
-  ## to enable uncomment lines with single hash below
-  ## hostname of the git server
-  # - host: git.example.com
-    ## ssh username
-  #  user: git
-    ## ssh private key for the user
-  #  privateKey: |
-  #    -----BEGIN RSA PRIVATE KEY-----
-  #    -----END RSA PRIVATE KEY-----
-    ## ssh port
-  #  port: 22
-
-goGetWorkers: 3
-
-serviceAccount:
-  create: true
-  annotations: {}
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}
-
-resources: {}
-#  limits:
-#    cpu: 100m
-#    memory: 64Mi
-#  requests:
-#    cpu: 100m
-#    memory: 64Mi
diff --git a/cmd/proxy/Dockerfile b/cmd/proxy/Dockerfile
index 4ff555112..ce788bf5b 100644
--- a/cmd/proxy/Dockerfile
+++ b/cmd/proxy/Dockerfile
@@ -5,8 +5,8 @@
 # You can override the Go version used to build the image.
 # See project Makefile if using make.
 # See docker --build-arg if building directly.
-ARG GOLANG_VERSION=1.19
-ARG ALPINE_VERSION=3.15
+ARG GOLANG_VERSION=1.20
+ARG ALPINE_VERSION=3.17
 
 FROM golang:${GOLANG_VERSION}-alpine AS builder
 
@@ -16,7 +16,7 @@ COPY . .
 
 ARG VERSION="unset"
 
-RUN DATE="$(date -u +%Y-%m-%d-%H:%M:%S-%Z)" && GO111MODULE=on CGO_ENABLED=0 GOPROXY="https://proxy.golang.org" go build -ldflags "-X github.com/gomods/athens/pkg/build.version=$VERSION -X github.com/gomods/athens/pkg/build.buildDate=$DATE" -o /bin/athens-proxy ./cmd/proxy
+RUN DATE="$(date -u +%Y-%m-%d-%H:%M:%S-%Z)" && GO111MODULE=on CGO_ENABLED=0 GOPROXY="https://proxy.golang.org" go build -ldflags "-X github.com/gomods/athens/pkg/build.version=$VERSION -X github.com/gomods/athens/pkg/build.buildDate=$DATE -s -w" -o /bin/athens-proxy ./cmd/proxy
 
 FROM alpine:${ALPINE_VERSION}
 
@@ -32,6 +32,9 @@ RUN chmod 644 /config/config.toml
 RUN apk add --update git git-lfs mercurial openssh-client subversion procps fossil tini && \
 	mkdir -p /usr/local/go
 
+ARG USER=athens
+RUN adduser -D -h /home/$USER $USER
+
 EXPOSE 3000
 
 ENTRYPOINT [ "/sbin/tini", "--" ]
diff --git a/docker-compose.yml b/docker-compose.yml
index 0d387235a..cb5910def 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,7 +5,7 @@ services:
       context: .
       dockerfile: cmd/proxy/Dockerfile
       args:
-        GOLANG_VERSION: 1.19
+        GOLANG_VERSION: 1.20
     environment:
       - ATHENS_MONGO_STORAGE_URL=mongodb://mongo:27017
       - TIMEOUT=20 # in case the mongo dependency takes longer to start up
@@ -20,7 +20,7 @@ services:
       context: .
       dockerfile: Dockerfile.test
       args:
-        GOLANG_VERSION: 1.19
+        GOLANG_VERSION: 1.20
     command: ["./scripts/test_unit.sh"]
     environment:
       - GO_ENV=test
@@ -36,7 +36,7 @@ services:
       context: .
       dockerfile: Dockerfile.test
       args:
-        GOLANG_VERSION: 1.19
+        GOLANG_VERSION: 1.20
     command: ["./scripts/test_e2e.sh"]
   azurite:
     image: arafato/azurite:2.6.5
diff --git a/docs/content/install/install-on-kubernetes.md b/docs/content/install/install-on-kubernetes.md
index 5f22e83c0..992265af3 100644
--- a/docs/content/install/install-on-kubernetes.md
+++ b/docs/content/install/install-on-kubernetes.md
@@ -82,7 +82,7 @@ tiller-deploy-5456568744-76c6s          1/1       Running   0          5s
 The fastest way to install Athens using Helm is to deploy it from our public Helm chart repository. First, add the repository with this command:
 
 ```console
-$ helm repo add gomods https://athens.blob.core.windows.net/charts
+$ helm repo add gomods https://gomods.github.io/athens-charts
 $ helm repo update
 ```
 
diff --git a/docs/content/install/install-on-kubernetes.zh.md b/docs/content/install/install-on-kubernetes.zh.md
index 58a4d32d0..c552f08b0 100755
--- a/docs/content/install/install-on-kubernetes.zh.md
+++ b/docs/content/install/install-on-kubernetes.zh.md
@@ -82,7 +82,7 @@ tiller-deploy-5456568744-76c6s          1/1       Running   0          5s
 使用Helm安装Athens的最快方法是从我们的公共Helm Chart库中进行部署。 首先，使用以下命令添加库
 
 ```console
-$ helm repo add gomods https://athens.blob.core.windows.net/charts
+$ helm repo add gomods https://gomods.github.io/athens-charts
 $ helm repo update
 ```
 接下来，将含有默认值的chart安装到`athens`命名空间：
diff --git a/docs/content/install/using-docker.md b/docs/content/install/using-docker.md
index b0b3581c4..efb4658f7 100644
--- a/docs/content/install/using-docker.md
+++ b/docs/content/install/using-docker.md
@@ -53,6 +53,23 @@ docker run -d -v "$($env:ATHENS_STORAGE):/var/lib/athens" `
    gomods/athens:latest
 ```
 
+## Non-Root User
+
+The Athens docker images comes with a non-root user `athens` with `uid: 1000`, `gid: 1000` and home directory `/home/athens`.
+In situations where running as root is not permitted, this user can be used instead. In all other instuctions
+replace `/root/` with `/home/athens/` and set the user and group ids in the run environment to `1000`.
+
+```shell
+docker run -d -v $ATHENS_STORAGE:/var/lib/athens \
+   -e ATHENS_DISK_STORAGE_ROOT=/var/lib/athens \
+   -e ATHENS_STORAGE_TYPE=disk \
+   -v "$PWD/gitconfig/.gitconfig:/home/athens/.gitconfig" \
+   --name athens-proxy \
+   --restart always \
+   -p 3000:3000 \
+   -u 1000:1000 \
+   gomods/athens:latest
+```
 
 ## Troubleshooting Athens in Docker
 
diff --git a/go.mod b/go.mod
index 78bdd39f6..1d02f2bee 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/gomods/athens
 
-go 1.19
+go 1.20
 
 require (
 	cloud.google.com/go/storage v1.20.0
@@ -10,14 +10,14 @@ require (
 	github.com/Azure/azure-storage-blob-go v0.10.0
 	github.com/BurntSushi/toml v1.0.0
 	github.com/DataDog/opencensus-go-exporter-datadog v0.0.0-20180917103902-e6c7f767dc57
-	github.com/aws/aws-sdk-go v1.34.0
+	github.com/aws/aws-sdk-go v1.44.220
 	github.com/bsm/redislock v0.7.2
 	github.com/fatih/color v1.13.0
 	github.com/go-redis/redis/v8 v8.11.4
 	github.com/go-sql-driver/mysql v1.6.0
 	github.com/gobuffalo/envy v1.7.0
 	github.com/gobuffalo/httptest v1.0.4
-	github.com/google/go-cmp v0.5.8
+	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.6.2
 	github.com/hashicorp/go-multierror v1.0.0
@@ -34,9 +34,9 @@ require (
 	go.etcd.io/etcd/client/v3 v3.5.2
 	go.mongodb.org/mongo-driver v1.7.1
 	go.opencensus.io v0.23.0
-	golang.org/x/mod v0.7.0
+	golang.org/x/mod v0.8.0
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
+	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4
 	google.golang.org/api v0.67.0
 	gopkg.in/go-playground/validator.v9 v9.20.2
 )
@@ -69,7 +69,7 @@ require (
 	github.com/googleapis/gax-go/v2 v2.1.1 // indirect
 	github.com/gorilla/context v1.1.1 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
-	github.com/jmespath/go-jmespath v0.3.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/joho/godotenv v1.3.0 // indirect
 	github.com/json-iterator/go v1.1.11 // indirect
 	github.com/klauspost/compress v1.9.5 // indirect
@@ -107,9 +107,9 @@ require (
 	go.uber.org/multierr v1.7.0 // indirect
 	go.uber.org/zap v1.21.0 // indirect
 	golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa // indirect
-	golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4 // indirect
-	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect
-	golang.org/x/text v0.3.8 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220211171837-173942840c17 // indirect
diff --git a/go.sum b/go.sum
index 509fe28b9..ecd49958c 100644
--- a/go.sum
+++ b/go.sum
@@ -107,8 +107,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
 github.com/apparentlymart/go-textseg v1.0.0 h1:rRmlIsPEEhUTIKQb7T++Nz/A5Q6C9IuX2wFoYVvnCs0=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
-github.com/aws/aws-sdk-go v1.34.0 h1:brux2dRrlwCF5JhTL7MUT3WUwo9zfDHZZp3+g3Mvlmo=
-github.com/aws/aws-sdk-go v1.34.0/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
+github.com/aws/aws-sdk-go v1.44.220 h1:yAj99qAt0Htjle9Up3DglgHfOP77lmFPrElA4jKnrBo=
+github.com/aws/aws-sdk-go v1.44.220/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -179,7 +179,6 @@ github.com/go-playground/universal-translator v0.16.0 h1:X++omBR/4cE2MNg91AoC3rm
 github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
 github.com/go-redis/redis/v8 v8.11.4 h1:kHoYkfZP6+pe04aFTnhDH6GDROa5yJdHJVNxV3F46Tg=
 github.com/go-redis/redis/v8 v8.11.4/go.mod h1:2Z2wHZXdQpCDXEGzqMockDpNyYvi2l4Pxt6RJr792+w=
-github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
@@ -269,8 +268,8 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -331,8 +330,10 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jmespath/go-jmespath v0.3.0 h1:OS12ieG61fsCg5+qLJ+SsW9NicxNkg3b25OyT2yCeUc=
-github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -508,6 +509,7 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zclconf/go-cty v0.0.0-20190426224007-b18a157db9e2 h1:Ai1LhlYNEqE39zGU07qHDNJ41iZVPZfZr1dSCoXrp1w=
 github.com/zclconf/go-cty v0.0.0-20190426224007-b18a157db9e2/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 go.etcd.io/etcd/api/v3 v3.5.2 h1:tXok5yLlKyuQ/SXSjtqHc4uzNaMqZi2XsoSPr/LlJXI=
@@ -550,6 +552,7 @@ golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa h1:idItI2DDfCokpg0N51B2VtiLdJ4vAuXC9fnCb2gACo4=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -587,8 +590,9 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -634,8 +638,10 @@ golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLd
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4 h1:HVyaeDAYux4pnY+D/SiwmLOR36ewZ4iGQIIrtnuCjFA=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -664,8 +670,9 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -738,9 +745,14 @@ golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f h1:v4INt8xihDGvnrfjMDVXGxw9wrfxYyCjk0KbXjhR55s=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -749,8 +761,10 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -814,7 +828,8 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/pkg/storage/s3/checker.go b/pkg/storage/s3/checker.go
index 63c6a91a7..b5d039c10 100644
--- a/pkg/storage/s3/checker.go
+++ b/pkg/storage/s3/checker.go
@@ -2,13 +2,13 @@ package s3
 
 import (
 	"context"
-	"fmt"
+	"sync"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/gomods/athens/pkg/config"
 	"github.com/gomods/athens/pkg/errors"
-	"github.com/gomods/athens/pkg/log"
 	"github.com/gomods/athens/pkg/observ"
 )
 
@@ -19,27 +19,39 @@ func (s *Storage) Exists(ctx context.Context, module, version string) (bool, err
 	ctx, span := observ.StartSpan(ctx, op.String())
 	defer span.End()
 
-	lsParams := &s3.ListObjectsInput{
-		Bucket: aws.String(s.bucket),
-		Prefix: aws.String(fmt.Sprintf("%s/@v", module)),
+	files := []string{"info", "mod", "zip"}
+	errChan := make(chan error, len(files))
+	defer close(errChan)
+	cancelingCtx, cancel := context.WithCancel(ctx)
+	var wg sync.WaitGroup
+	for _, file := range files {
+		wg.Add(1)
+		go func(file string) {
+			defer wg.Done()
+			_, err := s.s3API.HeadObjectWithContext(
+				cancelingCtx,
+				&s3.HeadObjectInput{
+					Bucket: aws.String(s.bucket),
+					Key:    aws.String(config.PackageVersionedName(module, version, file)),
+				})
+			errChan <- err
+		}(file)
 	}
-	found := make(map[string]struct{}, 3)
-	err := s.s3API.ListObjectsPagesWithContext(ctx, lsParams, func(loo *s3.ListObjectsOutput, lastPage bool) bool {
-		for _, o := range loo.Contents {
-			if _, exists := found[*o.Key]; exists {
-				log.EntryFromContext(ctx).Warnf("duplicate key in prefix %q: %q", *lsParams.Prefix, *o.Key)
-				continue
-			}
-			if *o.Key == config.PackageVersionedName(module, version, "info") ||
-				*o.Key == config.PackageVersionedName(module, version, "mod") ||
-				*o.Key == config.PackageVersionedName(module, version, "zip") {
-				found[*o.Key] = struct{}{}
-			}
+	exists := true
+	var err error
+	for range files {
+		err = <-errChan
+		if err == nil {
+			continue
 		}
-		return len(found) < 3
-	})
-	if err != nil {
-		return false, errors.E(op, err, errors.M(module), errors.V(version))
+		var aerr awserr.Error
+		if errors.AsErr(err, &aerr) && aerr.Code() == "NotFound" {
+			err = nil
+			exists = false
+		}
+		break
 	}
-	return len(found) == 3, nil
+	cancel()
+	wg.Wait()
+	return exists, err
 }
diff --git a/pkg/storage/s3/getter.go b/pkg/storage/s3/getter.go
index 8420864bc..f3c748dcf 100644
--- a/pkg/storage/s3/getter.go
+++ b/pkg/storage/s3/getter.go
@@ -6,6 +6,7 @@ import (
 	"io"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/gomods/athens/pkg/config"
 	"github.com/gomods/athens/pkg/errors"
@@ -18,16 +19,13 @@ func (s *Storage) Info(ctx context.Context, module, version string) ([]byte, err
 	const op errors.Op = "s3.Info"
 	ctx, span := observ.StartSpan(ctx, op.String())
 	defer span.End()
-	exists, err := s.Exists(ctx, module, version)
-	if err != nil {
-		return nil, errors.E(op, err, errors.M(module), errors.V(version))
-	}
-	if !exists {
-		return nil, errors.E(op, errors.M(module), errors.V(version), errors.KindNotFound)
-	}
 
 	infoReader, err := s.open(ctx, config.PackageVersionedName(module, version, "info"))
 	if err != nil {
+		var aerr awserr.Error
+		if errors.AsErr(err, &aerr) && aerr.Code() == s3.ErrCodeNoSuchKey {
+			return nil, errors.E(op, errors.M(module), errors.V(version), errors.KindNotFound)
+		}
 		return nil, errors.E(op, err, errors.M(module), errors.V(version))
 	}
 	defer func() { _ = infoReader.Close() }()
@@ -44,16 +42,13 @@ func (s *Storage) GoMod(ctx context.Context, module, version string) ([]byte, er
 	const op errors.Op = "s3.GoMod"
 	ctx, span := observ.StartSpan(ctx, op.String())
 	defer span.End()
-	exists, err := s.Exists(ctx, module, version)
-	if err != nil {
-		return nil, errors.E(op, err, errors.M(module), errors.V(version))
-	}
-	if !exists {
-		return nil, errors.E(op, errors.M(module), errors.V(version), errors.KindNotFound)
-	}
 
 	modReader, err := s.open(ctx, config.PackageVersionedName(module, version, "mod"))
 	if err != nil {
+		var aerr awserr.Error
+		if errors.AsErr(err, &aerr) && aerr.Code() == s3.ErrCodeNoSuchKey {
+			return nil, errors.E(op, errors.M(module), errors.V(version), errors.KindNotFound)
+		}
 		return nil, errors.E(op, err, errors.M(module), errors.V(version))
 	}
 	defer func() { _ = modReader.Close() }()
@@ -71,16 +66,13 @@ func (s *Storage) Zip(ctx context.Context, module, version string) (storage.Size
 	const op errors.Op = "s3.Zip"
 	ctx, span := observ.StartSpan(ctx, op.String())
 	defer span.End()
-	exists, err := s.Exists(ctx, module, version)
-	if err != nil {
-		return nil, errors.E(op, err, errors.M(module), errors.V(version))
-	}
-	if !exists {
-		return nil, errors.E(op, errors.M(module), errors.V(version), errors.KindNotFound)
-	}
 
 	zipReader, err := s.open(ctx, config.PackageVersionedName(module, version, "zip"))
 	if err != nil {
+		var aerr awserr.Error
+		if errors.AsErr(err, &aerr) && aerr.Code() == s3.ErrCodeNoSuchKey {
+			return nil, errors.E(op, errors.M(module), errors.V(version), errors.KindNotFound)
+		}
 		return nil, errors.E(op, err, errors.M(module), errors.V(version))
 	}
 
@@ -98,6 +90,10 @@ func (s *Storage) open(ctx context.Context, path string) (storage.SizeReadCloser
 
 	goo, err := s.s3API.GetObjectWithContext(ctx, getParams)
 	if err != nil {
+		var aerr awserr.Error
+		if errors.AsErr(err, &aerr) && aerr.Code() == s3.ErrCodeNoSuchKey {
+			return nil, errors.E(op, errors.KindNotFound)
+		}
 		return nil, errors.E(op, err)
 	}
 	var size int64
diff --git a/pkg/storage/s3/s3_test.go b/pkg/storage/s3/s3_test.go
index 6cc54e6a8..08c7edd25 100644
--- a/pkg/storage/s3/s3_test.go
+++ b/pkg/storage/s3/s3_test.go
@@ -89,7 +89,6 @@ func getStorage(t testing.TB) *Storage {
 		config.GetTimeoutDuration(300),
 		options,
 	)
-
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/scripts/build-image/Dockerfile b/scripts/build-image/Dockerfile
index 0261d958c..f462a39df 100644
--- a/scripts/build-image/Dockerfile
+++ b/scripts/build-image/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.19-bullseye
+FROM golang:1.20-bullseye
 
 WORKDIR /tmp
 
diff --git a/scripts/push-helm-charts.sh b/scripts/push-helm-charts.sh
deleted file mode 100755
index 668568750..000000000
--- a/scripts/push-helm-charts.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-set -xeuo pipefail
-
-helm init --client-only
-
-#####
-# set up the repo dir, and package up all charts
-#####
-CHARTS_REPO=${CHARTS_REPO:-"https://athens.blob.core.windows.net"}
-CHARTS_BUCKET=charts
-REPO_DIR=bin/charts # This is where we do the charge merge and dirty things up, not the source chart directory
-mkdir -p $REPO_DIR
-echo "entering $REPO_DIR"
-cd $REPO_DIR
-if curl --output /dev/null --silent --head --fail ${CHARTS_REPO}/${CHARTS_BUCKET}/index.yaml; then
-  echo "downloading existing index.yaml"
-  curl -sLO ${CHARTS_REPO}/${CHARTS_BUCKET}/index.yaml
-fi
-
-#####
-# package the charts
-#####
-for dir in `ls ../../charts`;do
-    if [ ! -f ../../charts/$dir/Chart.yaml ];then
-        echo "skipping $dir because it lacks a Chart.yaml file"
-    else
-        echo "packaging $dir"
-        helm dep build ../../charts/$dir
-        helm package ../../charts/$dir
-    fi
-done
-
-if [ -f $REPO_DIR/index.yaml ]; then
-  echo "merging with existing index.yaml"
-  helm repo index --url "$CHARTS_REPO/$CHARTS_BUCKET" --merge index.yaml .
-else
-  echo "generating new index.yaml"
-  helm repo index .
-fi
-
-#####
-# upload to Azure blob storage
-#####
-if [ ! -v AZURE_STORAGE_CONNECTION_STRING ]; then
-    echo "AZURE_STORAGE_CONNECTION_STRING env var required to publish"
-    exit 1
-fi
-echo "uploading from $PWD"
-az storage blob upload-batch --destination $CHARTS_BUCKET --source .