diff --git a/operate/operators/archive-node.mdx b/operate/operators/archive-node.mdx
index e43110477a..242def0da2 100644
--- a/operate/operators/archive-node.mdx
+++ b/operate/operators/archive-node.mdx
@@ -67,7 +67,7 @@ Ensure any datadir you supply is not in use by a running node before proceeding.
     OP_RETH__SNAPSHOT=true
     ```
 
-    On first start this downloads the snapshot matching your `NODE_TYPE` (here, the archive snapshot) and continues from there. **On mainnet a snapshot is required** — it provides the pre-L2 (Celo L1) history. On **Celo Sepolia**, which has no pre-L2 history, you can instead leave `OP_RETH__SNAPSHOT=false` and execute every block from genesis. Either way, `NODE_TYPE=archive` is what keeps the full historical state available, and `DATADIR_PATH` must be empty on first start — a datadir written by `op-geth` cannot be reused.
+    On first start this downloads the snapshot matching your `NODE_TYPE` (here, the archive snapshot) and continues from there. **On mainnet a snapshot is required** — it provides the pre-L2 (Celo L1) history. On **Celo Sepolia**, which has no pre-L2 history, you can instead set `OP_RETH__SNAPSHOT=false` and execute every block from genesis. Either way, `NODE_TYPE=archive` is what keeps the full historical state available, and `DATADIR_PATH` must be empty on first start — a datadir written by `op-geth` cannot be reused.
 
     #### Configure Historical RPC Service
 
diff --git a/operate/operators/configuration.mdx b/operate/operators/configuration.mdx
index 9bb3f698b4..99ac2f1d22 100644
--- a/operate/operators/configuration.mdx
+++ b/operate/operators/configuration.mdx
@@ -17,7 +17,7 @@ The variables below configure `op-reth`, Celo's supported execution client. Supp
 | Variable | Values | Description |
 |---|---|---|
 | `NODE_TYPE` | `minimal`, `full` (default), `archive` | Sets the prune profile and the snapshot tier downloaded. A `minimal` node prunes transaction lookups fully and keeps only the most recent receipts, so it serves latest-state RPC on the smallest disk but little history. A `full` node stores historical state only for recent blocks. An `archive` node stores historical state for the entire chain (roughly 10x the storage). All three execute every block. |
-| `OP_RETH__SNAPSHOT` | `true`, `false` (default) | When `true`, an empty datadir is bootstrapped from a published snapshot (`snapshots.celo.org`). Required on mainnet, which needs the pre-L2 history; optional on Celo Sepolia, which can sync from genesis. Ignored once the datadir holds data. |
+| `OP_RETH__SNAPSHOT` | `true` (default in the shipped `.env` files), `false` | When `true`, an empty datadir is bootstrapped from a published snapshot (`snapshots.celo.org`). Required on mainnet, which needs the pre-L2 history; optional on Celo Sepolia, which can sync from genesis. Ignored once the datadir holds data. |
 
 `op-reth` syncs by executing every block. A new node starts from an empty datadir (see [Run a node with Docker](/operate/operators/run-node)); datadirs written by `op-geth` cannot be reused. For archive nodes, see [Running an archive node](/operate/operators/archive-node).
 
diff --git a/operate/operators/maintenance.mdx b/operate/operators/maintenance.mdx
index cb747a20cb..36101baf8c 100644
--- a/operate/operators/maintenance.mdx
+++ b/operate/operators/maintenance.mdx
@@ -24,7 +24,7 @@ This pulls the latest changes from GitHub and the latest images from the registr
 Network hardforks require running a compatible client version *before* the fork block, or your node will stop following the chain. Watch the [Notices](/operate/notices/overview) for each upgrade's required versions and timing. Support for op-geth has ended; a node still running it must migrate to op-reth — see [End of Support for op-geth](/operate/notices/op-geth-deprecation).
 </Warning>
 
-To pin a specific image version instead of tracking the latest, set the matching `IMAGE_TAG__*` variable in your `.env` (for example `IMAGE_TAG__OP_RETH` or `IMAGE_TAG__OP_NODE`).
+To pin a specific image version instead of tracking the latest, set the matching `IMAGE_TAG__*` variable in your `.env` (for example `IMAGE_TAG__OP_RETH`). The op-node and eigenda-proxy image tags are fixed in `docker-compose.yml` and change only when you `git pull`.
 
 ## Restarting and stopping
 
diff --git a/operate/operators/monitoring.mdx b/operate/operators/monitoring.mdx
index 708ef00186..615ae197cd 100644
--- a/operate/operators/monitoring.mdx
+++ b/operate/operators/monitoring.mdx
@@ -21,7 +21,11 @@ This starts four services alongside your node: **Healthcheck**, **Prometheus**,
 With monitoring enabled, Grafana is available at [http://localhost:3000](http://localhost:3000) (configurable via `PORT__GRAFANA`).
 
 - **Username:** `admin`
-- **Password:** `optimism`
+- **Password:** `celo`
+
+<Warning>
+These are the compose defaults, and compose publishes Grafana on every host interface (`${PORT__GRAFANA:-3000}:3000`). Set `GF_SECURITY_ADMIN_PASSWORD` in `.env` before you first start with monitoring enabled: Grafana reads it only when it creates the admin user, and keeps that user in the `grafana_data` volume. If Grafana has already started, change the password in Grafana instead (user icon → **Change Password**). Either way, firewall port 3000 so it is not reachable from the public internet.
+</Warning>
 
 The **Simple Node Dashboard** (Dashboards → Manage → Simple Node Dashboard) shows basic node information and sync status. If you run the challenger, the **Succinct Challenger** dashboard shows challenger activity.
 
@@ -33,7 +37,7 @@ The **Simple Node Dashboard** (Dashboards → Manage → Simple Node Dashboard)
 
 ## Key metrics to watch
 
-From **op-node** (Prometheus, `http://localhost:7300/metrics`):
+From **op-node** (query in Prometheus at `http://localhost:9090` or in Grafana; the op-node port 7300 is not published to the host, where `localhost:7300` is the healthcheck):
 
 - **`op_node_default_refs_number`** — the op-node's current L1/L2 reference block numbers. If it stops increasing, your node is not syncing; if it goes backwards, your node is reorging.
 - **`op_node_default_peer_count`** — how many peers op-node is connected to. Without peers, op-node cannot sync unsafe blocks and your node will lag behind the sequencer.
diff --git a/operate/operators/network-config.mdx b/operate/operators/network-config.mdx
index 236cf76825..0c0d29cc5d 100644
--- a/operate/operators/network-config.mdx
+++ b/operate/operators/network-config.mdx
@@ -57,13 +57,13 @@ The recommended [celo-l2-node-docker-compose](https://github.com/celo-org/celo-l
 
 - Container images:
   - [op-reth](https://us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/op-reth:celo-v1.0.5)
-  - [op-node](https://us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/op-node:celo-v2.1.0)
-  - [eigenda-proxy](https://ghcr.io/layr-labs/eigenda-proxy:v1.8.2)
+  - [op-node](https://us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/op-node:celo-v2.2.3)
+  - [eigenda-proxy](https://ghcr.io/layr-labs/eigenda-proxy:v2.6.0)
   - [Celo L1 client](https://us-docker.pkg.dev/celo-org/us.gcr.io/geth-all:1.8.9) — legacy archive / historical RPC service
 
 ## Celo Sepolia
 
-- op-reth snapshots — published at [`snapshots.celo.org`](https://snapshots.celo.org); optional, enable with `OP_RETH__SNAPSHOT=true` to skip syncing from genesis (see [Run a node](/operate/operators/run-node))
+- op-reth snapshots — published at [`snapshots.celo.org`](https://snapshots.celo.org); optional and on by default (`OP_RETH__SNAPSHOT=true`); set it to `false` to sync from genesis instead (see [Run a node](/operate/operators/run-node))
 - [L1 contract addresses](https://storage.googleapis.com/cel2-rollup-files/celo-sepolia/deployment-l1.json)
 - [rollup.json](https://storage.googleapis.com/cel2-rollup-files/celo-sepolia/rollup.json)
 - [Genesis](https://storage.googleapis.com/cel2-rollup-files/celo-sepolia/genesis.json)
@@ -90,5 +90,5 @@ The recommended [celo-l2-node-docker-compose](https://github.com/celo-org/celo-l
 
 - Container images:
   - [op-reth](https://us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/op-reth:celo-v1.0.5)
-  - [op-node](https://us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/op-node:celo-v2.1.0)
-  - [eigenda-proxy](https://ghcr.io/layr-labs/eigenda-proxy:v1.8.2)
+  - [op-node](https://us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/op-node:celo-v2.2.3)
+  - [eigenda-proxy](https://ghcr.io/layr-labs/eigenda-proxy:v2.6.0)
diff --git a/operate/operators/run-node.mdx b/operate/operators/run-node.mdx
index 3b41d5a913..35c878655d 100644
--- a/operate/operators/run-node.mdx
+++ b/operate/operators/run-node.mdx
@@ -76,7 +76,7 @@ Follow these steps to run a full node. If you would like to run an archive node,
 
         **On mainnet a snapshot is required** — it provides the pre-L2 (Celo L1) history, which `op-reth` cannot reproduce by executing blocks.
 
-    - **From genesis.** On **Celo Sepolia**, which has no pre-L2 history, you can leave `OP_RETH__SNAPSHOT=false` (the default) and execute every block from genesis. This needs no external data but takes considerably longer to reach the chain tip.
+    - **From genesis.** On **Celo Sepolia**, which has no pre-L2 history, you can set `OP_RETH__SNAPSHOT=false` (the shipped `.env` files set it to `true`) and execute every block from genesis. This needs no external data but takes considerably longer to reach the chain tip.
 
     <Warning>
     **Datadirs from op-geth cannot be reused**