diff --git a/.drone/drone.jsonnet b/.drone/drone.jsonnet
index 8a6d818f6d7a..fda1bd2835dc 100644
--- a/.drone/drone.jsonnet
+++ b/.drone/drone.jsonnet
@@ -376,7 +376,7 @@ local manifest_ecr(apps, archs) = pipeline('manifest-ecr') {
   ],
 };
 
-local build_image_tag = '0.33.1-golangci.1.51.2';
+local build_image_tag = '0.33.3';
 [
   pipeline('loki-build-image-' + arch) {
     workspace: {
diff --git a/.drone/drone.yml b/.drone/drone.yml
index 51c0fb6b854f..f720156c3681 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -17,7 +17,7 @@ steps:
       from_secret: docker_password
     repo: grafana/loki-build-image
     tags:
-    - 0.33.1-golangci.1.51.2-amd64
+    - 0.33.3-amd64
     username:
       from_secret: docker_username
   when:
@@ -54,7 +54,7 @@ steps:
       from_secret: docker_password
     repo: grafana/loki-build-image
     tags:
-    - 0.33.1-golangci.1.51.2-arm64
+    - 0.33.3-arm64
     username:
       from_secret: docker_username
   when:
@@ -86,7 +86,7 @@ steps:
     password:
       from_secret: docker_password
     spec: .drone/docker-manifest-build-image.tmpl
-    target: loki-build-image:0.33.1-golangci.1.51.2
+    target: loki-build-image:0.33.3
     username:
       from_secret: docker_username
   when:
@@ -146,7 +146,7 @@ steps:
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.33.1
+  image: grafana/loki-build-image:0.33.3
   name: loki-mixin-check
   when:
     event:
@@ -171,7 +171,7 @@ steps:
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.33.1
+  image: grafana/loki-build-image:0.33.3
   name: documentation-helm-reference-check
 trigger:
   ref:
@@ -1117,7 +1117,7 @@ steps:
       from_secret: docker_password
     DOCKER_USERNAME:
       from_secret: docker_username
-  image: grafana/loki-build-image:0.33.1
+  image: grafana/loki-build-image:0.33.3
   name: build and push
   privileged: true
   volumes:
@@ -1340,6 +1340,6 @@ kind: secret
 name: gpg_private_key
 ---
 kind: signature
-hmac: ef80f57ffff4f20ac7e12ef7eec7d8cee1d0b217a8ec5a93fe8d459f0967e155
+hmac: 361d32e18fac906a3f2cefddaefa6aa5e85a71664930c41976984e7747a7904f
 
 ...
diff --git a/.github/release-workflows.jsonnet b/.github/release-workflows.jsonnet
index bf13bb5da1bb..22393a01c7bb 100644
--- a/.github/release-workflows.jsonnet
+++ b/.github/release-workflows.jsonnet
@@ -20,7 +20,8 @@ local imageJobs = {
   querytee: build.image('loki-query-tee', 'cmd/querytee', platform=['linux/amd64']),
 };
 
-local buildImage = 'grafana/loki-build-image:0.33.1';
+local buildImageVersion = std.extVar('BUILD_IMAGE_VERSION');
+local buildImage = 'grafana/loki-build-image:%s' % buildImageVersion;
 local golangCiLintVersion = 'v1.55.1';
 
 local imageBuildTimeoutMin = 40;
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index b1ccc391fdb3..a59b8fcd11aa 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -2,7 +2,7 @@
   "check":
     "uses": "grafana/loki-release/.github/workflows/check.yml@main"
     "with":
-      "build_image": "grafana/loki-build-image:0.33.1"
+      "build_image": "grafana/loki-build-image:0.33.3"
       "golang_ci_lint_version": "v1.55.1"
       "release_lib_ref": "main"
       "skip_validation": false
diff --git a/.github/workflows/minor-release-pr.yml b/.github/workflows/minor-release-pr.yml
index bc70363da1bb..dea02ac6511f 100644
--- a/.github/workflows/minor-release-pr.yml
+++ b/.github/workflows/minor-release-pr.yml
@@ -16,7 +16,7 @@ jobs:
   check:
     uses: "grafana/loki-release/.github/workflows/check.yml@main"
     with:
-      build_image: "grafana/loki-build-image:0.33.1"
+      build_image: "grafana/loki-build-image:0.33.3"
       golang_ci_lint_version: "v1.55.1"
       release_lib_ref: "main"
       skip_validation: false
@@ -141,7 +141,7 @@ jobs:
           --env SKIP_ARM \
           --volume .:/src/loki \
           --workdir /src/loki \
-          --entrypoint /bin/sh "grafana/loki-build-image:0.33.1"
+          --entrypoint /bin/sh "grafana/loki-build-image:0.33.3"
           git config --global --add safe.directory /src/loki
           echo "${NFPM_SIGNING_KEY}" > $NFPM_SIGNING_KEY_FILE
           make dist packages
diff --git a/.github/workflows/patch-release-pr.yml b/.github/workflows/patch-release-pr.yml
index 831ca48b4087..74ff27d0a6ea 100644
--- a/.github/workflows/patch-release-pr.yml
+++ b/.github/workflows/patch-release-pr.yml
@@ -16,7 +16,7 @@ jobs:
   check:
     uses: "grafana/loki-release/.github/workflows/check.yml@main"
     with:
-      build_image: "grafana/loki-build-image:0.33.1"
+      build_image: "grafana/loki-build-image:0.33.3"
       golang_ci_lint_version: "v1.55.1"
       release_lib_ref: "main"
       skip_validation: false
@@ -141,7 +141,7 @@ jobs:
           --env SKIP_ARM \
           --volume .:/src/loki \
           --workdir /src/loki \
-          --entrypoint /bin/sh "grafana/loki-build-image:0.33.1"
+          --entrypoint /bin/sh "grafana/loki-build-image:0.33.3"
           git config --global --add safe.directory /src/loki
           echo "${NFPM_SIGNING_KEY}" > $NFPM_SIGNING_KEY_FILE
           make dist packages
diff --git a/Makefile b/Makefile
index 689df6f5291f..02e9446070a1 100644
--- a/Makefile
+++ b/Makefile
@@ -36,8 +36,8 @@ DOCKER_IMAGE_DIRS := $(patsubst %/Dockerfile,%,$(DOCKERFILES))
 # or you can override this with an environment variable
 BUILD_IN_CONTAINER ?= true
 
-# ensure you run `make drone` after changing this
-BUILD_IMAGE_VERSION ?= 0.33.1
+# ensure you run `make drone` and `make release-workflows` after changing this
+BUILD_IMAGE_VERSION ?= 0.33.3
 
 # Docker image info
 IMAGE_PREFIX ?= grafana
@@ -656,7 +656,8 @@ ifneq (,$(findstring WIP,$(IMAGE_TAG)))
 	false;
 endif
 	echo ${DOCKER_PASSWORD} | docker login --username ${DOCKER_USERNAME} --password-stdin
-	$(SUDO) $(BUILD_OCI) -o type=registry -t $(IMAGE_PREFIX)/loki-build-image:$(IMAGE_TAG) ./loki-build-image
+	$(SUDO) DOCKER_BUILDKIT=$(DOCKER_BUILDKIT) docker buildx build $(OCI_PLATFORMS) \
+		-o type=registry -t $(IMAGE_PREFIX)/loki-build-image:$(BUILD_IMAGE_VERSION) ./loki-build-image
 
 # loki-operator
 loki-operator-image:
@@ -881,4 +882,10 @@ scan-vulnerabilities: trivy snyk
 .PHONY: release-workflows
 release-workflows:
 	pushd $(CURDIR)/.github && jb update && popd
-	jsonnet -SJ .github/vendor -m .github/workflows .github/release-workflows.jsonnet
+	jsonnet -SJ .github/vendor -m .github/workflows -V BUILD_IMAGE_VERSION=$(BUILD_IMAGE_VERSION) .github/release-workflows.jsonnet
+
+.PHONY: release-workflows-check
+release-workflows-check:
+	@$(MAKE) release-workflows
+	@echo "Checking diff"
+	@git diff --exit-code -- ".github/workflows/*release*" || (echo "Please build release workflows by running 'make release-workflows'" && false)
diff --git a/docs/sources/shared/configuration.md b/docs/sources/shared/configuration.md
index 8d9f7924caa0..e6a512ba5685 100644
--- a/docs/sources/shared/configuration.md
+++ b/docs/sources/shared/configuration.md
@@ -7,42 +7,29 @@ title: Grafana Loki configuration parameters
 
 ## Printing Loki config at runtime
 
-If you pass Loki the flag `-print-config-stderr` or `-log-config-reverse-order`, (or `-print-config-stderr=true`)
-Loki will dump the entire config object it has created from the built-in defaults combined first with
-overrides from config file, and second by overrides from flags.
+If you pass Loki the flag `-print-config-stderr` or `-log-config-reverse-order`, (or `-print-config-stderr=true`) Loki will dump the entire config object it has created from the built-in defaults combined first with overrides from config file, and second by overrides from flags.
 
 The result is the value for every config object in the Loki config struct, which is very large...
 
-Many values will not be relevant to your install such as storage configs which you are not using and which you did not define,
-this is expected as every option has a default value if it is being used or not.
+Many values will not be relevant to your install such as storage configs which you are not using and which you did not define, this is expected as every option has a default value if it is being used or not.
 
-This config is what Loki will use to run, it can be invaluable for debugging issues related to configuration and
-is especially useful in making sure your config files and flags are being read and loaded properly.
+This config is what Loki will use to run, it can be invaluable for debugging issues related to configuration and is especially useful in making sure your config files and flags are being read and loaded properly.
 
 `-print-config-stderr` is nice when running Loki directly e.g. `./loki ` as you can get a quick output of the entire Loki config.
 
-`-log-config-reverse-order` is the flag we run Loki with in all our environments, the config entries are reversed so
-that the order of configs reads correctly top to bottom when viewed in Grafana's Explore.
+`-log-config-reverse-order` is the flag we run Loki with in all our environments, the config entries are reversed so that the order of configs reads correctly top to bottom when viewed in Grafana's Explore.
 
 ## Configuration file reference
 
-To specify which configuration file to load, pass the `-config.file` flag at the
-command line. The value can be a list of comma separated paths, then the first
-file that exists will be used.
-If no `-config.file` argument is specified, Loki will look up the `config.yaml` in the
-current working directory and the `config/` subdirectory and try to use that.
+To specify which configuration file to load, pass the `-config.file` flag at the command line. The value can be a list of comma separated paths, then the first file that exists will be used. If no `-config.file` argument is specified, Loki will look up the `config.yaml` in the current working directory and the `config/` subdirectory and try to use that.
 
-The file is written in [YAML
-format](https://en.wikipedia.org/wiki/YAML), defined by the scheme below.
-Brackets indicate that a parameter is optional. For non-list parameters the
-value is set to the specified default.
+The file is written in [YAML format](https://en.wikipedia.org/wiki/YAML), defined by the scheme below. Brackets indicate that a parameter is optional. For non-list parameters the value is set to the specified default.
 
 ### Use environment variables in the configuration
 
 > **Note:** This feature is only available in Loki 2.1+.
 
-You can use environment variable references in the configuration file to set values that need to be configurable during deployment.
-To do this, pass `-config.expand-env=true` and use:
+You can use environment variable references in the configuration file to set values that need to be configurable during deployment. To do this, pass `-config.expand-env=true` and use:
 
 ```
 ${VAR}
@@ -50,9 +37,7 @@ ${VAR}
 
 Where VAR is the name of the environment variable.
 
-Each variable reference is replaced at startup by the value of the environment variable.
-The replacement is case-sensitive and occurs before the YAML file is parsed.
-References to undefined variables are replaced by empty strings unless you specify a default value or custom error text.
+Each variable reference is replaced at startup by the value of the environment variable. The replacement is case-sensitive and occurs before the YAML file is parsed. References to undefined variables are replaced by empty strings unless you specify a default value or custom error text.
 
 To specify a default value, use:
 
@@ -429,7 +414,7 @@ compactor_grpc_client:
 
   # Override the default cipher suite list (separated by commas). Allowed
   # values:
-  # 
+  #
   # Secure Ciphers:
   # - TLS_AES_128_GCM_SHA256
   # - TLS_AES_256_GCM_SHA384
@@ -444,7 +429,7 @@ compactor_grpc_client:
   # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
   # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-  # 
+  #
   # Insecure Ciphers:
   # - TLS_RSA_WITH_RC4_128_SHA
   # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -495,8 +480,8 @@ compactor_grpc_client:
 
 # Configuration for memberlist client. Only applies if the selected kvstore is
 # memberlist.
-# 
-# When a memberlist config with atleast 1 join_members is defined, kvstore of
+#
+# When a memberlist config with at least 1 join_members is defined, kvstore of
 # type memberlist is automatically selected for all the components that require
 # a ring unless otherwise specified in the component's configuration section.
 [memberlist: <memberlist>]
@@ -1254,7 +1239,7 @@ memcached_client:
 
   # Override the default cipher suite list (separated by commas). Allowed
   # values:
-  # 
+  #
   # Secure Ciphers:
   # - TLS_AES_128_GCM_SHA256
   # - TLS_AES_256_GCM_SHA384
@@ -1269,7 +1254,7 @@ memcached_client:
   # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
   # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-  # 
+  #
   # Insecure Ciphers:
   # - TLS_RSA_WITH_RC4_128_SHA
   # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -2067,7 +2052,7 @@ Configuration for an ETCD v3 client. Only applies if the selected kvstore is `et
 [tls_insecure_skip_verify: <boolean> | default = false]
 
 # Override the default cipher suite list (separated by commas). Allowed values:
-# 
+#
 # Secure Ciphers:
 # - TLS_AES_128_GCM_SHA256
 # - TLS_AES_256_GCM_SHA384
@@ -2082,7 +2067,7 @@ Configuration for an ETCD v3 client. Only applies if the selected kvstore is `et
 # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-# 
+#
 # Insecure Ciphers:
 # - TLS_RSA_WITH_RC4_128_SHA
 # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -2384,7 +2369,7 @@ backoff_config:
 [tls_insecure_skip_verify: <boolean> | default = false]
 
 # Override the default cipher suite list (separated by commas). Allowed values:
-# 
+#
 # Secure Ciphers:
 # - TLS_AES_128_GCM_SHA256
 # - TLS_AES_256_GCM_SHA384
@@ -2399,7 +2384,7 @@ backoff_config:
 # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-# 
+#
 # Insecure Ciphers:
 # - TLS_RSA_WITH_RC4_128_SHA
 # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -2725,7 +2710,7 @@ lifecycler:
 [chunk_target_size: <int> | default = 1572864]
 
 # The algorithm to use for compressing chunk. (none, gzip, lz4-64k, snappy,
-# lz4-256k, lz4-1M, lz4, flate, zstd)
+# lz4-256k, lz4-1M, lz4, flat, zstd)
 # CLI flag: -ingester.chunk-encoding
 [chunk_encoding: <string> | default = "gzip"]
 
@@ -3097,7 +3082,7 @@ The `limits_config` block configures global and per-tenant limits in Loki. The v
 # metadata request that falls in this window is split using
 # `split_recent_metadata_queries_by_interval`. The value 0 disables using a
 # different split interval for recent metadata queries.
-# 
+#
 # This is added to improve cacheability of recent metadata queries. Query split
 # interval also determines the interval used in cache key. The default split
 # interval of 24h is useful for caching long queries, each cache key holding 1
@@ -3397,7 +3382,7 @@ The `local_storage_config` block configures the usage of local file system as ob
 
 Configuration for `memberlist` client. Only applies if the selected kvstore is memberlist.
 
-When a memberlist config with atleast 1 join_members is defined, kvstore of type memberlist is automatically selected for all the components that require a ring unless otherwise specified in the component's configuration section.
+When a memberlist config with at least 1 join_members is defined, kvstore of type memberlist is automatically selected for all the components that require a ring unless otherwise specified in the component's configuration section.
 
 ```yaml
 # Name of the node in memberlist cluster. Defaults to hostname.
@@ -3555,7 +3540,7 @@ When a memberlist config with atleast 1 join_members is defined, kvstore of type
 [tls_insecure_skip_verify: <boolean> | default = false]
 
 # Override the default cipher suite list (separated by commas). Allowed values:
-# 
+#
 # Secure Ciphers:
 # - TLS_AES_128_GCM_SHA256
 # - TLS_AES_256_GCM_SHA384
@@ -3570,7 +3555,7 @@ When a memberlist config with atleast 1 join_members is defined, kvstore of type
 # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-# 
+#
 # Insecure Ciphers:
 # - TLS_RSA_WITH_RC4_128_SHA
 # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -3595,16 +3580,7 @@ When a memberlist config with atleast 1 join_members is defined, kvstore of type
 
 ### named_stores_config
 
-Configures additional object stores for a given storage provider.
-Supported stores: aws, azure, bos, filesystem, gcs, swift.
-Example:
-storage_config:
-  named_stores:
-    aws:
-      store-1:
-        endpoint: s3://foo-bucket
-        region: us-west1
-Named store from this example can be used by setting object_store to store-1 in period_config.
+Configures additional object stores for a given storage provider. Supported stores: aws, azure, bos, filesystem, gcs, swift. Example: storage_config: named_stores: aws: store-1: endpoint: s3://foo-bucket region: us-west1 Named store from this example can be used by setting object_store to store-1 in period_config.
 
 ```yaml
 [aws: <map of string to aws_storage_config>]
@@ -4139,7 +4115,7 @@ alertmanager_client:
 
   # Override the default cipher suite list (separated by commas). Allowed
   # values:
-  # 
+  #
   # Secure Ciphers:
   # - TLS_AES_128_GCM_SHA256
   # - TLS_AES_256_GCM_SHA384
@@ -4154,7 +4130,7 @@ alertmanager_client:
   # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
   # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-  # 
+  #
   # Insecure Ciphers:
   # - TLS_RSA_WITH_RC4_128_SHA
   # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -4415,7 +4391,7 @@ evaluation:
 
     # Override the default cipher suite list (separated by commas). Allowed
     # values:
-    # 
+    #
     # Secure Ciphers:
     # - TLS_AES_128_GCM_SHA256
     # - TLS_AES_256_GCM_SHA384
@@ -4430,7 +4406,7 @@ evaluation:
     # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
     # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
     # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-    # 
+    #
     # Insecure Ciphers:
     # - TLS_RSA_WITH_RC4_128_SHA
     # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -4689,7 +4665,7 @@ grpc_tls_config:
   # CLI flag: -server.grpc-tls-ca-path
   [client_ca_file: <string> | default = ""]
 
-# Register the intrumentation handlers (/metrics etc).
+# Register the instrumentation handlers (/metrics etc).
 # CLI flag: -server.register-instrumentation
 [register_instrumentation: <boolean> | default = true]
 
@@ -5724,7 +5700,7 @@ The TLS configuration.
 [tls_insecure_skip_verify: <boolean> | default = false]
 
 # Override the default cipher suite list (separated by commas). Allowed values:
-# 
+#
 # Secure Ciphers:
 # - TLS_AES_128_GCM_SHA256
 # - TLS_AES_256_GCM_SHA384
@@ -5739,7 +5715,7 @@ The TLS configuration.
 # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-# 
+#
 # Insecure Ciphers:
 # - TLS_RSA_WITH_RC4_128_SHA
 # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
@@ -5801,58 +5777,43 @@ overrides:
     max_chunks_per_query: 1000000
 
 multi_kv_config:
-    mirror-enabled: false
-    primary: consul
+  mirror-enabled: false
+  primary: consul
 ```
 
 ## Accept out-of-order writes
 
-Since the beginning of Loki, log entries had to be written to Loki in order
-by time.
-This limitation has been lifted.
-Out-of-order writes are enabled globally by default, but can be disabled/enabled
-on a cluster or per-tenant basis.
+Since the beginning of Loki, log entries had to be written to Loki in order by time. This limitation has been lifted. Out-of-order writes are enabled globally by default, but can be disabled/enabled on a cluster or per-tenant basis.
 
-- To disable out-of-order writes for all tenants,
-place in the `limits_config` section:
+- To disable out-of-order writes for all tenants, place in the `limits_config` section:
 
-    ```
-    limits_config:
-        unordered_writes: false
-    ```
+      ```
+      limits_config:
+          unordered_writes: false
+      ```
 
-- To disable out-of-order writes for specific tenants,
-configure a runtime configuration file:
+- To disable out-of-order writes for specific tenants, configure a runtime configuration file:
 
-    ```
-    runtime_config:
-      file: overrides.yaml
-    ```
+      ```
+      runtime_config:
+        file: overrides.yaml
+      ```
 
-    In the `overrides.yaml` file, add `unordered_writes` for each tenant
-    permitted to have out-of-order writes:
+      In the `overrides.yaml` file, add `unordered_writes` for each tenant
+      permitted to have out-of-order writes:
 
-    ```
-    overrides:
-      "tenantA":
-        unordered_writes: false
-    ```
+      ```
+      overrides:
+        "tenantA":
+          unordered_writes: false
+      ```
 
-How far into the past accepted out-of-order log entries may be
-is configurable with `max_chunk_age`.
-`max_chunk_age` defaults to 2 hour.
-Loki calculates the earliest time that out-of-order entries may have
-and be accepted with
+How far into the past accepted out-of-order log entries may be is configurable with `max_chunk_age`. `max_chunk_age` defaults to 2 hour. Loki calculates the earliest time that out-of-order entries may have and be accepted with
 
 ```
 time_of_most_recent_line - (max_chunk_age/2)
 ```
 
-Log entries with timestamps that are after this earliest time are accepted.
-Log entries further back in time return an out-of-order error.
+Log entries with timestamps that are after this earliest time are accepted. Log entries further back in time return an out-of-order error.
 
-For example, if `max_chunk_age` is 2 hours
-and the stream `{foo="bar"}` has one entry at `8:00`,
-Loki will accept data for that stream as far back in time as `7:00`.
-If another log line is written at `10:00`,
-Loki will accept data for that stream as far back in time as `9:00`.
+For example, if `max_chunk_age` is 2 hours and the stream `{foo="bar"}` has one entry at `8:00`, Loki will accept data for that stream as far back in time as `7:00`. If another log line is written at `10:00`, Loki will accept data for that stream as far back in time as `9:00`.
diff --git a/loki-build-image/Dockerfile b/loki-build-image/Dockerfile
index a8d8e7996056..42c52c18d625 100644
--- a/loki-build-image/Dockerfile
+++ b/loki-build-image/Dockerfile
@@ -6,7 +6,7 @@
 # on how to publish a new build image.
 
 # Install helm (https://helm.sh/) and helm-docs (https://github.com/norwoodj/helm-docs) for generating Helm Chart reference.
-FROM golang:1.21.9-bullseye as helm
+FROM golang:1.22.2-bookworm as helm
 ARG TARGETARCH
 ARG HELM_VER="v3.2.3"
 RUN curl -L "https://get.helm.sh/helm-${HELM_VER}-linux-$TARGETARCH.tar.gz" | tar zx && \
@@ -27,7 +27,7 @@ RUN apk add --no-cache curl && \
 FROM alpine:3.18.6 as golangci
 RUN apk add --no-cache curl && \
     cd / && \
-    curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.51.2
+    curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.55.1
 
 FROM alpine:3.18.6 as buf
 ARG TARGETOS
@@ -38,7 +38,7 @@ RUN apk add --no-cache curl && \
 FROM alpine:3.18.6 as docker
 RUN apk add --no-cache docker-cli docker-cli-buildx
 
-FROM golang:1.21.9-bullseye as drone
+FROM golang:1.22.2-bookworm as drone
 ARG TARGETARCH
 RUN curl -L "https://github.com/drone/drone-cli/releases/download/v1.7.0/drone_linux_$TARGETARCH".tar.gz | tar zx && \
     install -t /usr/local/bin drone
@@ -48,35 +48,35 @@ RUN curl -L "https://github.com/drone/drone-cli/releases/download/v1.7.0/drone_l
 # Error:
 # github.com/fatih/faillint@v1.5.0 requires golang.org/x/tools@v0.0.0-20200207224406-61798d64f025
 #   (not golang.org/x/tools@v0.0.0-20190918214920-58d531046acd from golang.org/x/tools/cmd/goyacc@58d531046acdc757f177387bc1725bfa79895d69)
-FROM golang:1.21.9-bullseye as faillint
-RUN GO111MODULE=on go install github.com/fatih/faillint@v1.11.0
+FROM golang:1.22.2-bookworm as faillint
+RUN GO111MODULE=on go install github.com/fatih/faillint@v1.12.0
 RUN GO111MODULE=on go install golang.org/x/tools/cmd/goimports@v0.7.0
 
-FROM golang:1.21.9-bullseye as delve
+FROM golang:1.22.2-bookworm as delve
 RUN GO111MODULE=on go install github.com/go-delve/delve/cmd/dlv@latest
 
 # Install ghr used to push binaries and template the release
 # This collides with the version of go tools used in the base image, thus we install it in its own image and copy it over.
-FROM golang:1.21.9-bullseye as ghr
+FROM golang:1.22.2-bookworm as ghr
 RUN GO111MODULE=on go install github.com/tcnksm/ghr@9349474
 
 # Install nfpm (https://nfpm.goreleaser.com) for creating .deb and .rpm packages.
-FROM golang:1.21.9-bullseye as nfpm
+FROM golang:1.22.2-bookworm as nfpm
 RUN GO111MODULE=on go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.11.3
 
 # Install gotestsum
-FROM golang:1.21.9-bullseye as gotestsum
+FROM golang:1.22.2-bookworm as gotestsum
 RUN GO111MODULE=on go install gotest.tools/gotestsum@v1.8.2
 
 # Install tools used to compile jsonnet.
-FROM golang:1.21.9-bullseye as jsonnet
-RUN GO111MODULE=on go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.4.0
-RUN GO111MODULE=on go install github.com/monitoring-mixins/mixtool/cmd/mixtool@bca3066
-RUN GO111MODULE=on go install github.com/google/go-jsonnet/cmd/jsonnet@v0.18.0
+FROM golang:1.22.2-bookworm as jsonnet
+RUN GO111MODULE=on go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.5.1
+RUN GO111MODULE=on go install github.com/monitoring-mixins/mixtool/cmd/mixtool@16dc166166d91e93475b86b9355a4faed2400c18
+RUN GO111MODULE=on go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
 
 FROM aquasec/trivy as trivy
 
-FROM golang:1.21.9-bullseye
+FROM golang:1.22.2-bookworm
 RUN apt-get update && \
     apt-get install -qy \
     musl gnupg ragel \