diff --git a/base/manifests/app-clamav.yaml b/base/manifests/app-clamav.yaml
index f96eb89..75c79bb 100644
--- a/base/manifests/app-clamav.yaml
+++ b/base/manifests/app-clamav.yaml
@@ -27,6 +27,28 @@ spec:
         app: backend-clamav
         role: backend
     spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            # Prefer to be scheduled on a burstable node.
+            #
+            # NOTE: "inveniem.com/workload-type" is a *label* that has the same
+            # name and value as the *taint* on the same nodes. Kubernetes
+            # doesn't have a way to use the taint for affinity, so we duplicate
+            # it as a label.
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: inveniem.com/workload-type
+                    operator: In
+                    values:
+                      - burstable
+      tolerations:
+        # Allow scheduling this job on burstable nodes.
+        - key: inveniem.com/workload-type
+          operator: Equal
+          value: burstable
+          effect: NoSchedule
       containers:
         - name: backend-clamav
           image: "mkodockx/docker-clamav:latest"
diff --git a/base/manifests/cronjob-nextcloud-cron.yaml b/base/manifests/cronjob-nextcloud-cron.yaml
index ea8e2e0..af51b5d 100644
--- a/base/manifests/cronjob-nextcloud-cron.yaml
+++ b/base/manifests/cronjob-nextcloud-cron.yaml
@@ -17,6 +17,28 @@ spec:
       template:
         spec:
           restartPolicy: Never
+          affinity:
+            nodeAffinity:
+              preferredDuringSchedulingIgnoredDuringExecution:
+              # Prefer to be scheduled on a burstable node.
+              #
+              # NOTE: "inveniem.com/workload-type" is a *label* that has the same
+              # name and value as the *taint* on the same nodes. Kubernetes
+              # doesn't have a way to use the taint for affinity, so we duplicate
+              # it as a label.
+              - weight: 100
+                preference:
+                  matchExpressions:
+                    - key: inveniem.com/workload-type
+                      operator: In
+                      values:
+                        - burstable
+          tolerations:
+            # Allow scheduling this job on burstable nodes.
+            - key: inveniem.com/workload-type
+              operator: Equal
+              value: burstable
+              effect: NoSchedule
           containers:
             - name: cron-nextcloud
               image: "inveniem/nextcloud-cron:latest"
diff --git a/components/http-apache/manifests/app-nextcloud.apache.yaml b/components/http-apache/manifests/app-nextcloud.apache.yaml
index ad605cf..79e738c 100644
--- a/components/http-apache/manifests/app-nextcloud.apache.yaml
+++ b/components/http-apache/manifests/app-nextcloud.apache.yaml
@@ -22,6 +22,21 @@ spec:
         role: backend
     spec:
       affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            # Prefer to be scheduled on a burstable node.
+            #
+            # NOTE: "inveniem.com/workload-type" is a *label* that has the same
+            # name and value as the *taint* on the same nodes. Kubernetes
+            # doesn't have a way to use the taint for affinity, so we duplicate
+            # it as a label.
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: inveniem.com/workload-type
+                    operator: In
+                    values:
+                      - burstable
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             # Prevent multiple replicas from being on the same node.
diff --git a/components/http-nginx-fpm/manifests/app-nextcloud.nginx-fpm.yaml b/components/http-nginx-fpm/manifests/app-nextcloud.nginx-fpm.yaml
index fcbefe6..f740ac2 100644
--- a/components/http-nginx-fpm/manifests/app-nextcloud.nginx-fpm.yaml
+++ b/components/http-nginx-fpm/manifests/app-nextcloud.nginx-fpm.yaml
@@ -23,6 +23,21 @@ spec:
         role: backend
     spec:
       affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            # Prefer to be scheduled on a burstable node.
+            #
+            # NOTE: "inveniem.com/workload-type" is a *label* that has the same
+            # name and value as the *taint* on the same nodes. Kubernetes
+            # doesn't have a way to use the taint for affinity, so we duplicate
+            # it as a label.
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: inveniem.com/workload-type
+                    operator: In
+                    values:
+                      - burstable
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             # Prevent multiple replicas from being on the same node.
diff --git a/overlays/00-sample/kustomization.yaml b/overlays/00-sample/kustomization.yaml
index c6206df..4938e4d 100644
--- a/overlays/00-sample/kustomization.yaml
+++ b/overlays/00-sample/kustomization.yaml
@@ -96,20 +96,20 @@ images:
 
   - name: inveniem/nextcloud-cron
     newName: your-acr-instance.azurecr.io/inveniem/nextcloud-cron
-    newTag: 10.1.1
+    newTag: 10.2.0
 
   - name: inveniem/nextcloud-apache
     newName: your-acr-instance.azurecr.io/inveniem/nextcloud-apache
-    newTag: 10.1.1
+    newTag: 10.2.0
 
   - name: inveniem/nextcloud-fpm
     newName: your-acr-instance.azurecr.io/inveniem/nextcloud-fpm
-    newTag: 10.1.1
+    newTag: 10.2.0
 
   - name: inveniem/nextcloud-nginx-middleware
     newName: your-acr-instance.azurecr.io/inveniem/nextcloud-nginx-middleware
-    newTag: 10.1.1
+    newTag: 10.2.0
 
   - name: inveniem/sftp-ws-server
     newName: your-acr-instance.azurecr.io/inveniem/sftp-ws-server
-    newTag: 10.1.1
+    newTag: 10.2.0