diff --git a/.gitpod.yml b/.gitpod.yml
index a32dcf9abc3a47..efca58c07a68cc 100644
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -1,4 +1,4 @@
-image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
 workspaceLocation: gitpod/gitpod-ws.code-workspace
 checkoutLocation: gitpod
 ports:
diff --git a/.werft/build.yaml b/.werft/build.yaml
index 884e01eed55766..fb7821c552c675 100644
--- a/.werft/build.yaml
+++ b/.werft/build.yaml
@@ -71,7 +71,7 @@ pod:
     - name: MYSQL_TCP_PORT
       value: 23306
   - name: build
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     resources:
diff --git a/.werft/debug.yaml b/.werft/debug.yaml
index 4b01a5fb32a77c..49f511a96bcf20 100644
--- a/.werft/debug.yaml
+++ b/.werft/debug.yaml
@@ -53,7 +53,7 @@ pod:
     - name: MYSQL_TCP_PORT
       value: 23306
   - name: build
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     volumeMounts:
diff --git a/.werft/gke-installer-tests.yaml b/.werft/gke-installer-tests.yaml
index 6a79f679f28387..ba657369ce276d 100644
--- a/.werft/gke-installer-tests.yaml
+++ b/.werft/gke-installer-tests.yaml
@@ -21,7 +21,7 @@ pod:
       secretName: sh-playground-dns-perm
   containers:
   - name: nightly-test
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: Always
     volumeMounts:
diff --git a/.werft/ide-integration-tests-startup-jetbrains.yaml b/.werft/ide-integration-tests-startup-jetbrains.yaml
index 0fb026ba70da06..59c56212f888c0 100644
--- a/.werft/ide-integration-tests-startup-jetbrains.yaml
+++ b/.werft/ide-integration-tests-startup-jetbrains.yaml
@@ -12,7 +12,7 @@ pod:
     emptyDir: {}
   containers:
   - name: gcloud
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     env:
diff --git a/.werft/ide-integration-tests-startup-vscode.yaml b/.werft/ide-integration-tests-startup-vscode.yaml
index 25b1a4c11bd426..56d25d1f6fbbff 100644
--- a/.werft/ide-integration-tests-startup-vscode.yaml
+++ b/.werft/ide-integration-tests-startup-vscode.yaml
@@ -12,7 +12,7 @@ pod:
     emptyDir: {}
   containers:
   - name: gcloud
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     env:
diff --git a/.werft/ide-run-integration-tests.yaml b/.werft/ide-run-integration-tests.yaml
index e4bfd7b8f09caa..c9821b47eb673d 100644
--- a/.werft/ide-run-integration-tests.yaml
+++ b/.werft/ide-run-integration-tests.yaml
@@ -25,7 +25,7 @@ pod:
     emptyDir: {}
   initContainers:
   - name: gcloud
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     volumeMounts:
diff --git a/.werft/platform-delete-preview-environments-cron.yaml b/.werft/platform-delete-preview-environments-cron.yaml
index 78ab1a75e45c2d..4de18541145c54 100644
--- a/.werft/platform-delete-preview-environments-cron.yaml
+++ b/.werft/platform-delete-preview-environments-cron.yaml
@@ -27,7 +27,7 @@ pod:
       secretName: harvester-vm-ssh-keys
   containers:
   - name: build
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     volumeMounts:
diff --git a/.werft/platform-trigger-werft-cleanup.yaml b/.werft/platform-trigger-werft-cleanup.yaml
index 378ff8363ddf90..359b19bceabbdb 100644
--- a/.werft/platform-trigger-werft-cleanup.yaml
+++ b/.werft/platform-trigger-werft-cleanup.yaml
@@ -21,7 +21,7 @@ pod:
         secretName: gcp-sa-gitpod-dev-deployer
   containers:
     - name: build
-      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+      image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
       workingDir: /workspace
       imagePullPolicy: IfNotPresent
       volumeMounts:
diff --git a/.werft/run-integration-tests.yaml b/.werft/run-integration-tests.yaml
index d6db859906852a..bbdb1dafb3974b 100644
--- a/.werft/run-integration-tests.yaml
+++ b/.werft/run-integration-tests.yaml
@@ -22,7 +22,7 @@ pod:
     emptyDir: {}
   initContainers:
   - name: gcloud
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     volumeMounts:
diff --git a/.werft/wipe-devstaging.yaml b/.werft/wipe-devstaging.yaml
index 9024c0dfbfa1e4..1d597d7a575f16 100644
--- a/.werft/wipe-devstaging.yaml
+++ b/.werft/wipe-devstaging.yaml
@@ -14,7 +14,7 @@ pod:
       secretName: gcp-sa-gitpod-dev-deployer
   containers:
   - name: wipe-devstaging
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     volumeMounts:
diff --git a/.werft/workspace-run-integration-tests.yaml b/.werft/workspace-run-integration-tests.yaml
index bae3aa00ce3eb8..d779ddfbe1623b 100644
--- a/.werft/workspace-run-integration-tests.yaml
+++ b/.werft/workspace-run-integration-tests.yaml
@@ -12,7 +12,7 @@ pod:
     emptyDir: {}
   containers:
   - name: gcloud
-    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:af-add-gcloud-auth.6
+    image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:ljb-werft-cli-grpc-changes.2
     workingDir: /workspace
     imagePullPolicy: IfNotPresent
     env:
diff --git a/dev/image/Dockerfile b/dev/image/Dockerfile
index 3455fe44a00843..5593d83843fdb1 100644
--- a/dev/image/Dockerfile
+++ b/dev/image/Dockerfile
@@ -64,8 +64,9 @@ RUN cd /usr/bin && curl -fsSL https://github.com/gitpod-io/leeway/releases/downl
 RUN cd /usr/bin && curl -fsSL https://github.com/gitpod-io/dazzle/releases/download/v0.1.11/dazzle_0.1.11_Linux_x86_64.tar.gz | tar xz
 
 # werft CLI
-ENV WERFT_K8S_NAMESPACE=werft
-ENV WERFT_DIAL_MODE=kubernetes
+ENV WERFT_CREDENTIAL_HELPER=/workspace/gitpod/dev/preview/werft-credential-helper.sh
+ENV WERFT_HOST=werft-grpc.gitpod-dev.com:443
+ENV WERFT_TLS_MODE=system
 RUN cd /usr/bin && curl -fsSL https://github.com/csweichel/werft/releases/download/v0.3.3/werft-client-linux-amd64.tar.gz | tar xz && mv werft-client-linux-amd64 werft
 
 # yq - jq for YAML files
@@ -242,8 +243,6 @@ RUN curl -fsSLO https://github.com/brancz/gojsontoyaml/releases/download/v${GOJS
 RUN curl https://raw.githubusercontent.com/replicatedhq/replicated/v0.38.0/install.sh | sudo bash && \
     curl https://kots.io/install/1.65.0 | bash
 
-ENV WERFT_CREDENTIAL_HELPER=/workspace/gitpod/dev/preview/werft-credential-helper.sh
-
 # Copy our own tools
 ENV NEW_KUBECDL=1
 COPY dev-kubecdl--app/kubecdl dev-gpctl--app/gpctl dev-preview-previewctl--cli/previewctl /usr/bin/