diff --git a/src/addons.js b/src/addons.js
index 037928061..7e2c0ae4c 100644
--- a/src/addons.js
+++ b/src/addons.js
@@ -713,6 +713,7 @@ function startMysql(existingInfra, callback) {
                 -e CLOUDRON_MYSQL_ROOT_HOST=172.18.0.1 \
                 -e CLOUDRON_MYSQL_ROOT_PASSWORD=${rootPassword} \
                 -v "${dataDir}/mysql:/var/lib/mysql" \
+                --label isCloudronManaged=true \
                 --read-only -v /tmp -v /run "${tag}"`;
 
     shell.execSync('startMysql', cmd);
@@ -903,6 +904,7 @@ function startPostgresql(existingInfra, callback) {
                 -e CLOUDRON_POSTGRESQL_ROOT_PASSWORD="${rootPassword}" \
                 -e CLOUDRON_POSTGRESQL_TOKEN="${cloudronToken}" \
                 -v "${dataDir}/postgresql:/var/lib/postgresql" \
+                --label isCloudronManaged=true \
                 --read-only -v /tmp -v /run "${tag}"`;
 
     shell.execSync('startPostgresql', cmd);
@@ -1083,6 +1085,7 @@ function startMongodb(existingInfra, callback) {
                 -e CLOUDRON_MONGODB_ROOT_PASSWORD="${rootPassword}" \
                 -e CLOUDRON_MONGODB_TOKEN="${cloudronToken}" \
                 -v "${dataDir}/mongodb:/var/lib/mongodb" \
+                --label isCloudronManaged=true \
                 --read-only -v /tmp -v /run "${tag}"`;
 
     shell.execSync('startMongodb', cmd);
@@ -1284,6 +1287,7 @@ function setupRedis(app, options, callback) {
                         -e CLOUDRON_REDIS_PASSWORD="${redisPassword}" \
                         -e CLOUDRON_REDIS_TOKEN="${redisServiceToken}" \
                         -v "${paths.PLATFORM_DATA_DIR}/redis/${app.id}:/var/lib/redis" \
+                        --label isCloudronManaged=true \
                         --read-only -v /tmp -v /run ${tag}`;
 
             var env = [
diff --git a/src/docker.js b/src/docker.js
index bc782043b..600c8e8a6 100644
--- a/src/docker.js
+++ b/src/docker.js
@@ -230,7 +230,8 @@ function createSubcontainer(app, name, cmd, options, callback) {
             Labels: {
                 'fqdn': app.fqdn,
                 'appId': app.id,
-                'isSubcontainer': String(!isAppContainer)
+                'isSubcontainer': String(!isAppContainer),
+                'isCloudronManaged': String(true)
             },
             HostConfig: {
                 Mounts: addons.getMountsSync(app, app.manifest.addons),
diff --git a/src/graphs.js b/src/graphs.js
index 4407297d4..3b0f8cf47 100644
--- a/src/graphs.js
+++ b/src/graphs.js
@@ -33,6 +33,7 @@ function startGraphite(existingInfra, callback) {
                 -p 127.0.0.1:2004:2004 \
                 -p 127.0.0.1:8000:8000 \
                 -v "${dataDir}/graphite:/var/lib/graphite" \
+                --label isCloudronManaged=true \
                 --read-only -v /tmp -v /run "${tag}"`;
 
     shell.execSync('startGraphite', cmd);
diff --git a/src/infra_version.js b/src/infra_version.js
index e74ea6086..1447c07d3 100644
--- a/src/infra_version.js
+++ b/src/infra_version.js
@@ -6,7 +6,7 @@
 
 exports = module.exports = {
     // a version change recreates all containers with latest docker config
-    'version': '48.12.0',
+    'version': '48.12.1',
 
     'baseImages': [
         { repo: 'cloudron/base', tag: 'cloudron/base:1.0.0@sha256:147a648a068a2e746644746bbfb42eb7a50d682437cead3c67c933c546357617' }
diff --git a/src/mail.js b/src/mail.js
index e82c4eb5f..4f61c1a16 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -589,6 +589,7 @@ function restartMail(callback) {
                         -v "${paths.PLATFORM_DATA_DIR}/addons/mail:/etc/mail" \
                         ${ports} \
                         -p 127.0.0.1:2020:2020 \
+                        --label isCloudronManaged=true \
                         --read-only -v /run -v /tmp ${tag}`;
 
             shell.execSync('startMail', cmd);
diff --git a/src/platform.js b/src/platform.js
index 324acea53..b7f6fb912 100644
--- a/src/platform.js
+++ b/src/platform.js
@@ -110,6 +110,7 @@ function pruneInfraImages(callback) {
 function stopContainers(existingInfra, callback) {
     // always stop addons to restart them on any infra change, regardless of minor or major update
     if (existingInfra.version !== infra.version) {
+        // TODO: only nuke containers with isCloudronManaged=true
         debug('stopping all containers for infra upgrade');
         shell.execSync('stopContainers', 'docker ps -qa | xargs --no-run-if-empty docker stop');
         shell.execSync('stopContainers', 'docker ps -qa | xargs --no-run-if-empty docker rm -f');