diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 41bed9aa7e..0d7eacfb55 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -82,7 +82,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        backend: ["ic-ref", "replica"]
         # macos-latest is currently macos-11, ubuntu-latest is currently ubuntu-20.04
         # ubuntu-18.04 not supported due to:
         #     /home/runner/.cache/dfinity/versions/0.8.3-34-g36e39809/ic-starter:
@@ -107,11 +106,7 @@ jobs:
           time dfx cache install
           time dfx new smoke
           cd smoke
-          if [ "${{ matrix.backend}}" = "ic-ref" ]; then
-              time dfx start --emulator --background
-          else
-              time dfx start --background
-          fi
+          time dfx start --background
           time dfx deploy
           time dfx canister call smoke_backend greet '("fire")'
           time curl --fail http://localhost:"$(dfx info webserver-port)"/sample-asset.txt?canisterId=$(dfx canister id smoke_frontend)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e4d6102937..c594f4f3c9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,13 +2,13 @@
 
 # UNRELEASED
 
-=== fix: `dfx canister delete <canister id>` removes the related entry from the canister id store
+### fix: `dfx canister delete <canister id>` removes the related entry from the canister id store
 
 Previously, deleting a canister in the project by id rather than by name
 would leave the canister id in the canister id store. This would cause
 `dfx deploy` to fail.
 
-=== fix: dfx extension install can no longer create a corrupt cache directory
+### fix: dfx extension install can no longer create a corrupt cache directory
 
 Running `dfx cache delete && dfx extension install nns` would previously
 create a cache directory containing only an `extensions` subdirectory.
@@ -16,13 +16,13 @@ dfx only looks for the existence of a cache version subdirectory to
 determine whether it has been installed. The end result was that later
 commands would fail when the cache did not contain expected files.
 
-=== fix: output_env_file is now considered relative to project root
+### fix: output_env_file is now considered relative to project root
 
 The .env file location, whether specified as `output_env_file` in dfx.json
 or `--output-env-file <file>` on the commandline, is now considered relative
 to the project root, rather than relative to the current working directory.
 
-=== feat: Read dfx canister install argument from a file
+### feat: Read dfx canister install argument from a file
 
 Enables passing large arguments that cannot be passed directly in the command line using the `--argument-file` flag. For example `dfx canister install --argument-file ./my/argument/file.txt my_canister_name`.
 
@@ -36,6 +36,18 @@ call it as a query call. This resolves a potential security risk.
 
 The message "transaction is a duplicate of another transaction in block ...", previously printed to stdout, is now logged to stderr. This means that the output of `dfx ledger transfer` to stdout will contain only "Transfer sent at block height <block height>".
 
+### feat: accept more ways to specify cycle and e8s amounts
+
+Underscores (`_`) can now be used to make large numbers more readable. For example: `dfx canister deposit-cycles 1_234_567 mycanister`
+
+Certain suffixes that replace a number of zeros are now supported. The (case-insensitive) suffixes are:
+- `k` for `000`, e.g. `500k`
+- `m` for `000_000`, e.g. `5m`
+- `b` for `000_000_000`, e.g. `50B`
+- `t` for `000_000_000_000`, e.g. `0.3T`
+
+For cycles an additional `c` or `C` is also acceptable. For example: `dfx canister deposit-cycles 3TC mycanister`
+
 ### feat: added `dfx cycles` command
 
 This won't work on mainnet yet, but can work locally after installing the cycles ledger.
@@ -57,16 +69,26 @@ Defining a custom `etag` header no longer breaks certification.
 
 Fixed a certification issue where under certain conditions the fallback file (`/index.html`) was served with an incomplete certificate tree, not proving sufficiently that the fallback file may be used as a replacement.
 
-- Module hash: 965c8899f0a033593dc9b1634b2ab4e0f3fd28c1cfa06993069be2040a2f700e
+Add the option to (re)set all permissions using upgrade arguments. This is especially useful for SNSes that cannot make calls as the canister's controller.
+
+- Module hash: 657938477f1dee46db70b5a9f0bd167ec5ffcd2f930a1d96593c17dcddef61b3
+- https://github.com/dfinity/sdk/pull/3443
+- https://github.com/dfinity/sdk/pull/3451
 - https://github.com/dfinity/sdk/pull/3429
 - https://github.com/dfinity/sdk/pull/3428
 - https://github.com/dfinity/sdk/pull/3421
 
 ### Replica
 
-Updated replica to elected commit 80a6745673a28ee53d257b3fe19dcd6b7efa93d1.
+Updated replica to elected commit 69e1408347723dbaa7a6cd2faa9b65c42abbe861.
 This incorporates the following executed proposals:
 
+- [126095](https://dashboard.internetcomputer.org/proposal/126095)
+- [126000](https://dashboard.internetcomputer.org/proposal/126000)
+- [125592](https://dashboard.internetcomputer.org/proposal/125592)
+- [125591](https://dashboard.internetcomputer.org/proposal/125591)
+- [125504](https://dashboard.internetcomputer.org/proposal/125504)
+- [125503](https://dashboard.internetcomputer.org/proposal/125503)
 - [125343](https://dashboard.internetcomputer.org/proposal/125343)
 - [125342](https://dashboard.internetcomputer.org/proposal/125342)
 - [125321](https://dashboard.internetcomputer.org/proposal/125321)
diff --git a/Cargo.lock b/Cargo.lock
index f62c4bec0f..9fa94794de 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2470,7 +2470,7 @@ dependencies = [
  "hex",
  "http",
  "http-body",
- "ic-certification 1.2.0",
+ "ic-certification 1.3.0",
  "ic-transport-types",
  "ic-verify-bls-signature",
  "k256 0.13.1",
@@ -2608,9 +2608,9 @@ dependencies = [
 
 [[package]]
 name = "ic-certification"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a59dc342d11b2067e19d0f146bdec3674de921303ffc762f114d201ebbe0e68a"
+checksum = "e8c04340437a32c8b9c80d36f09715909c1e0a755327503a2e2906dcd662ba4e"
 dependencies = [
  "hex",
  "serde",
@@ -2626,7 +2626,7 @@ dependencies = [
  "candid 0.9.11",
  "hex",
  "ic-cdk",
- "ic-certified-map",
+ "ic-certification 1.3.0",
  "ic-crypto-tree-hash",
  "ic-representation-independent-hash",
  "ic-response-verification",
@@ -2929,7 +2929,7 @@ source = "git+https://github.com/dfinity/agent-rs.git?rev=ed0862a45d5973ff123cba
 dependencies = [
  "candid 0.9.11",
  "hex",
- "ic-certification 1.2.0",
+ "ic-certification 1.3.0",
  "leb128",
  "serde",
  "serde_bytes",
diff --git a/docs/design/asset-canister-interface.md b/docs/design/asset-canister-interface.md
index 3f30ac48fe..ffc36bffe6 100644
--- a/docs/design/asset-canister-interface.md
+++ b/docs/design/asset-canister-interface.md
@@ -159,6 +159,29 @@ The size of any chunk cannot exceed the message ingress limit.
 
 ## Method Reference
 
+### Method: `init` and `post_upgrade`
+
+```candid
+service: (asset_canister_args: variant {
+  Init: record {};
+  Upgrade: record {
+    set_permissions: opt record {
+      prepare: vec principal;
+      commit: vec principal;
+      manage_permissions: vec principal;
+    };
+  };
+})
+```
+
+The methods `init` and `post_upgrade` are called automatically by the system after new code is installed in the canister.
+
+Both methods take the same argument type by definition. Therefore, to be able to have different arguments for the two cases, an enum is used to make the distinction.
+If `init` is called with the `Upgrade` variant or if `post_upgrade` is called with the `Init` variant the asset canister traps and thereby reverts the code changes.
+
+In `Upgrade`, the field `set_permissions` can be used to (re)set the list of principals with the listed permissions.
+If `set_permissions` that is not `null`, then all permissions are set to the newly provided list of principals and the previous lists of principals are discarded.
+
 ### Method: `get`
 
 ```candid
diff --git a/e2e/tests-dfx/assetscanister.bash b/e2e/tests-dfx/assetscanister.bash
index 628ec8ed82..2a5aaf6083 100644
--- a/e2e/tests-dfx/assetscanister.bash
+++ b/e2e/tests-dfx/assetscanister.bash
@@ -1732,3 +1732,42 @@ WARN: {
   assert_command      dfx canister call e2e_project_frontend configure '(record { max_chunks=opt opt 3; max_bytes = opt opt 5500 })'
   assert_command      dfx deploy
 }
+
+@test "set permissions through upgrade argument" {
+  dfx_start
+  dfx deploy
+
+  assert_command dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { Prepare }; })'
+  assert_eq "(vec {})"
+  assert_command dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { Commit }; })'
+  assert_match "$(dfx identity get-principal)"
+  assert_command dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { ManagePermissions }; })'
+  assert_eq "(vec {})"
+
+  dfx identity new alice --storage-mode plaintext
+  ALICE="$(dfx --identity alice identity get-principal)"
+
+  dfx canister install e2e_project_frontend --upgrade-unchanged --mode upgrade --argument "(opt variant {
+    Upgrade = record {
+      set_permissions = opt record {
+        prepare = vec {
+          principal \"${ALICE}\";
+        };
+        commit = vec {
+          principal \"$(dfx identity get-principal)\";
+          principal \"aaaaa-aa\";
+        };
+        manage_permissions = vec {
+          principal \"$(dfx identity get-principal)\";
+        };
+      }
+    }
+  })"
+  assert_command dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { Prepare }; })'
+  assert_match "${ALICE}"
+  assert_command dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { Commit }; })'
+  assert_match "$(dfx identity get-principal)"
+  assert_match '"aaaaa-aa"'
+  assert_command dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { ManagePermissions }; })'
+  assert_match "$(dfx identity get-principal)"
+}
diff --git a/e2e/tests-dfx/build_granular.bash b/e2e/tests-dfx/build_granular.bash
index 04101028c8..d60b824b53 100644
--- a/e2e/tests-dfx/build_granular.bash
+++ b/e2e/tests-dfx/build_granular.bash
@@ -47,7 +47,7 @@ teardown() {
   dfx build e2e_project_backend
   # validate assets canister wasn't built and can't be installed
   assert_command_fail dfx canister install e2e_project_frontend
-  assert_match "No such file or directory"
+  assert_match "The canister must be built before install. Please run \`dfx build\`."
 }
 
 
diff --git a/e2e/tests-dfx/install.bash b/e2e/tests-dfx/install.bash
index 5511205a07..bd4a4f3d02 100644
--- a/e2e/tests-dfx/install.bash
+++ b/e2e/tests-dfx/install.bash
@@ -211,3 +211,10 @@ teardown() {
   assert_command_fail dfx canister install --all --argument '()'
   assert_contains "error: the argument '--all' cannot be used with '--argument <ARGUMENT>'"
 }
+
+@test "remind to build before install" {
+  dfx_start
+  dfx canister create --all
+  assert_command_fail dfx canister install e2e_project_backend
+  assert_contains "The canister must be built before install. Please run \`dfx build\`."
+}
diff --git a/nix/sources.json b/nix/sources.json
index e73f22befb..5793f4efa5 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -15,53 +15,53 @@
     "canister_sandbox-x86_64-darwin": {
         "builtin": false,
         "description": "The canister_sandbox binary. It must be updated together with the replica binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "095abs8cd863svvsgks9z4hn060p4cdz72z0s35c6dnbk0v573lv",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "049hfmpi7njn439hry1z5qb3k45z300jvrvcgycbxrdiz5nd9kaa",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz"
     },
     "canister_sandbox-x86_64-linux": {
         "builtin": false,
         "description": "The canister_sandbox binary. It must be updated together with the replica binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1gfnkmjrn3r3zx17wyahz9hm07dykkx4rbahlnrqa05sbdlg65dc",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "04r9rs47ky6715jwia5qzpj5983y2xyg246wncjhybqn79a9m10i",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/canister_sandbox.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/canister_sandbox.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/canister_sandbox.gz"
     },
     "ic-admin-x86_64-darwin": {
         "builtin": false,
         "description": "The ic-admin binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "0ydxxwwqww64gajl1y3h98wnprzgmhpp78yb0s0c6zfna5g4m4kr",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "15r1ymcrhb1z859cpjhg3y9nswskh94sxr8l1gqbw5lsf6y8ygsb",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-admin.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-admin.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-admin.gz"
     },
     "ic-admin-x86_64-linux": {
         "builtin": false,
         "description": "The ic-admin binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1y0szr5qrnm9b7fkrbplf69mbz4k3x8km71abdrrjipw9w454j2w",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "00hry4mjramd8dwx88v8crrzjj0rzkvd23ckqig3bglvaisnsspf",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-admin.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-admin.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-admin.gz"
     },
     "ic-btc-adapter-x86_64-darwin": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "06vgzrr1bgwls6xgzhxzwqq8jn30wqln5hvi99iqzlsqx4f8dz7g",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "0y79j7rzi12896808sai0nhfzslmgrg1gvm7kfprf89jrikh1v9w",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz"
     },
     "ic-btc-adapter-x86_64-linux": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1v9dsvzn7dnf2c49qkbq0ha0s7248c44z7ciwaj3y52v65xwn8d9",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "1silh7jx2i6ln7r1k49ndgddm4fm10f9f3f822lyz90vz7dml6yk",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz"
     },
     "ic-btc-canister": {
@@ -74,36 +74,36 @@
     },
     "ic-https-outcalls-adapter-x86_64-darwin": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "05gc1kvsk3j6yb2rpqkpwxmp834lhqcnql2w5gr65y1kiyrqyc34",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "14nivx59ww4y0phpwxfcisc4an2sny5r4f3qrmalqk4vi445mszy",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz"
     },
     "ic-https-outcalls-adapter-x86_64-linux": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "0q2znfxvgi5syrgc0kqslm4vilfps4flwg0m8nrsz65556nl6gii",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "0qgxzfzym8gh91bsg5krmlrh39anlcgnff330w4jgiwql95ayvr7",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz"
     },
     "ic-nns-init-x86_64-darwin": {
         "builtin": false,
         "description": "The ic-nns-init binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "10y4gr1cxnsqsmv4vwp9pygpb5pjmdpzwxdv1c5sydwwhzix87qp",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "0c59dsi9gwxzj9l2d94k48yk2vdz0gb1yjfh58ky1sx4w28hxzc5",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz"
     },
     "ic-nns-init-x86_64-linux": {
         "builtin": false,
         "description": "The ic-nns-init binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "0iybz05j6xxnbziby7mw6vx0j7m8bp4yzyj14xlw9ibwcyi6lprd",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "15v8a6d71rg7xgl3nvy5l839qxyvkig1mlldpdr4bmmwp3yqx3nm",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-nns-init.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-nns-init.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-nns-init.gz"
     },
     "ic-ref-x86_64-darwin": {
@@ -126,34 +126,34 @@
     },
     "ic-starter-x86_64-darwin": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1s85f1bw3dsdq9ysw6wcm6iw169yd3pkgr774dbfa6igljp168nl",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "1ar30xi3vnrwpyl0cir3m4dvdzdwm09xji33w25krj5n9503acqz",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-starter.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-starter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-starter.gz"
     },
     "ic-starter-x86_64-linux": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "0ynbq60qixq750y526jzndic4rid2gdna1ip1z815nlgfv6scppb",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "1ddgxd9pnybnjiqhgggxlkbq8ml99ca4iq54kh221kdj7h1m334d",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-starter.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-starter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-starter.gz"
     },
     "icx-proxy-x86_64-darwin": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "18l3lawpg9qwsrfxd7c6pq2pmjb5pniyvq55awabkl74wj8qzk26",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "1p9gmlz85j514s6da189hwaghg18p62pbknkn3q59jyxmf22fzxh",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz"
     },
     "icx-proxy-x86_64-linux": {
         "builtin": false,
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1r2ynp5j08xgsagrzw8039ffiigykj37g16aidjpm18mhajdylkd",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "105jm3px6ky88jc86am8dkxz1vnhzcxy0p7skzs98baylr96kzrb",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz"
     },
     "motoko-base": {
@@ -185,55 +185,55 @@
     "replica-x86_64-darwin": {
         "builtin": false,
         "description": "The replica binary. It must be updated together with the canister_sandbox binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "06p15dncxxs4rir937kw0rjq32gqigz55kd7a99zqf82ppzq2daj",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "12z1lvhv257ywf1b4gknywdimh5yqnfx20yxn37f30iifg2zw87k",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/replica.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/replica.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/replica.gz"
     },
     "replica-x86_64-linux": {
         "builtin": false,
         "description": "The replica binary. It must be updated together with the canister_sandbox binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1nmiagipm99izjar7zrf6i16qp2kvdd44savyk5p5p1shhrv7kfc",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "120iinjcybvc346wf1iq6r964a3w5dhhif6rnf2ngf0q3350rlrc",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/replica.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/replica.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/replica.gz"
     },
     "sandbox_launcher-x86_64-darwin": {
         "builtin": false,
         "description": "The sandbox_launcher binary. It must be updated together with the replica binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "11zq2nqa2dicpplv38ncj2hwhn187lwnrpi4sj9dkzsnhmml8b99",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "12pz2i2yhfl2saab3rc5sf0dr24l6siirpsx8z414818mzpc42zd",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz"
     },
     "sandbox_launcher-x86_64-linux": {
         "builtin": false,
         "description": "The sandbox_launcher binary. It must be updated together with the replica binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "0vrgcdzg4z30rr3iw9ym2k21lp1wdz95hr9a8n99mvdrrvic0vi6",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "0zzpr02vc14ibx1qzd31a9jzh1zhb7ahcg85fazs6jkjk2zidi4n",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz"
     },
     "sns-x86_64-darwin": {
         "builtin": false,
         "description": "The sns binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "144ri5i5bb7p6f8l0zq1hasda3n4390xlsldq9cbnnh2h8nxg9kk",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "12xkvxp3jprxw0205ml4ad3gdksi0x5c3kf7skcmkvqk744nml04",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/sns.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sns.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/sns.gz"
     },
     "sns-x86_64-linux": {
         "builtin": false,
         "description": "The sns binary.",
-        "rev": "80a6745673a28ee53d257b3fe19dcd6b7efa93d1",
-        "sha256": "1f0d08mz2h1ljh49sl84ka9i8jdpiy32f26v8x9an25i1x80rqx9",
+        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
+        "sha256": "02aqj9qcpvk216sdvkz25q1pf32bwb6wnf8v704rw133wpqq8sln",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/sns.gz",
+        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sns.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/sns.gz"
     }
 }
diff --git a/src/canisters/frontend/ic-certified-assets/Cargo.toml b/src/canisters/frontend/ic-certified-assets/Cargo.toml
index 6c2ef2b88d..0aa6639bbc 100644
--- a/src/canisters/frontend/ic-certified-assets/Cargo.toml
+++ b/src/canisters/frontend/ic-certified-assets/Cargo.toml
@@ -16,7 +16,7 @@ base64.workspace = true
 candid.workspace = true
 hex.workspace = true
 ic-cdk.workspace = true
-ic-certified-map = "0.3.2"
+ic-certification = "1.3.0"
 ic-response-verification = "0.3.0"
 ic-representation-independent-hash = "0.3.0"
 itertools.workspace = true
diff --git a/src/canisters/frontend/ic-certified-assets/assets.did b/src/canisters/frontend/ic-certified-assets/assets.did
index d607712e01..51bb1a235b 100644
--- a/src/canisters/frontend/ic-certified-assets/assets.did
+++ b/src/canisters/frontend/ic-certified-assets/assets.did
@@ -139,7 +139,25 @@ type ListPermitted = record { permission: Permission };
 
 type ValidationResult = variant { Ok : text; Err : text };
 
-service: {
+type AssetCanisterArgs = variant {
+  Init: InitArgs;
+  Upgrade: UpgradeArgs;
+};
+
+type InitArgs = record {};
+
+type UpgradeArgs = record {
+  set_permissions: opt SetPermissions;
+};
+
+/// Sets the list of principals granted each permission.
+type SetPermissions = record {
+  prepare: vec principal;
+  commit: vec principal;
+  manage_permissions: vec principal;
+};
+
+service: (asset_canister_args: opt AssetCanisterArgs) -> {
   api_version: () -> (nat16) query;
 
   get: (record {
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs
index 2ee8f5eac7..b69e5d2233 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs
@@ -1,5 +1,5 @@
 use self::{
-    tree::{merge_hash_trees, NestedTree},
+    tree::NestedTree,
     types::{
         certification::{AssetPath, HashTreePath, NestedTreeKey, RequestHash, WitnessResult},
         http::{
@@ -8,13 +8,14 @@ use self::{
     },
 };
 use crate::asset_certification::types::http::build_ic_certificate_expression_header;
+use ic_certification::merge_hash_trees;
 use ic_representation_independent_hash::Value;
 use serde::Serialize;
 use sha2::Digest;
 
 pub mod tree;
 pub mod types;
-pub use ic_certified_map::HashTree;
+pub use ic_certification::HashTree;
 
 pub type CertifiedResponses = NestedTree<NestedTreeKey, Vec<u8>>;
 
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/tree.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/tree.rs
index 89b292f2ab..d46c4dfec9 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/tree.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/tree.rs
@@ -1,4 +1,4 @@
-use ic_certified_map::{AsHashTree, HashTree, RbTree};
+use ic_certification::{AsHashTree, HashTree, RbTree};
 
 pub trait NestedTreeKeyRequirements: Clone + AsRef<[u8]> + 'static {}
 pub trait NestedTreeValueRequirements: AsHashTree + 'static {}
@@ -18,14 +18,14 @@ impl<K: NestedTreeKeyRequirements, V: NestedTreeValueRequirements> Default for N
 }
 
 impl<K: NestedTreeKeyRequirements, V: NestedTreeValueRequirements> AsHashTree for NestedTree<K, V> {
-    fn root_hash(&self) -> ic_certified_map::Hash {
+    fn root_hash(&self) -> ic_certification::Hash {
         match self {
             NestedTree::Leaf(a) => a.root_hash(),
             NestedTree::Nested(tree) => tree.root_hash(),
         }
     }
 
-    fn as_hash_tree(&self) -> HashTree<'_> {
+    fn as_hash_tree(&self) -> HashTree {
         match self {
             NestedTree::Leaf(a) => a.as_hash_tree(),
             NestedTree::Nested(tree) => tree.as_hash_tree(),
@@ -129,41 +129,6 @@ impl<K: NestedTreeKeyRequirements, V: NestedTreeValueRequirements> NestedTree<K,
     }
 }
 
-pub fn merge_hash_trees<'a>(lhs: HashTree<'a>, rhs: HashTree<'a>) -> HashTree<'a> {
-    use HashTree::{Empty, Fork, Labeled, Leaf, Pruned};
-
-    match (lhs, rhs) {
-        (Pruned(l), Pruned(r)) => {
-            if l != r {
-                panic!("merge_hash_trees: inconsistent hashes");
-            }
-            Pruned(l)
-        }
-        (Pruned(_), r) => r,
-        (l, Pruned(_)) => l,
-        (Fork(l), Fork(r)) => Fork(Box::new((
-            merge_hash_trees(l.0, r.0),
-            merge_hash_trees(l.1, r.1),
-        ))),
-        (Labeled(l_label, l), Labeled(r_label, r)) => {
-            if l_label != r_label {
-                panic!("merge_hash_trees: inconsistent hash tree labels");
-            }
-            Labeled(l_label, Box::new(merge_hash_trees(*l, *r)))
-        }
-        (Empty, Empty) => Empty,
-        (Leaf(l), Leaf(r)) => {
-            if l != r {
-                panic!("merge_hash_trees: inconsistent leaves");
-            }
-            Leaf(l)
-        }
-        (_l, _r) => {
-            panic!("merge_hash_trees: inconsistent tree structure");
-        }
-    }
-}
-
 #[test]
 fn nested_tree_operation() {
     let mut tree: NestedTree<&str, Vec<u8>> = NestedTree::default();
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs
index 8ca56fc6fe..1e176c9549 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs
@@ -4,7 +4,7 @@ use crate::{
     state_machine::{encoding_certification_order, Asset, AssetEncoding},
 };
 use candid::{define_function, CandidType, Deserialize, Nat};
-use ic_certified_map::Hash;
+use ic_certification::Hash;
 use ic_representation_independent_hash::{representation_independent_hash, Value};
 use serde_bytes::ByteBuf;
 use sha2::Digest;
diff --git a/src/canisters/frontend/ic-certified-assets/src/lib.rs b/src/canisters/frontend/ic-certified-assets/src/lib.rs
index a4c82e037a..336a0106a9 100644
--- a/src/canisters/frontend/ic-certified-assets/src/lib.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/lib.rs
@@ -413,7 +413,10 @@ fn is_controller() -> Result<(), String> {
     }
 }
 
-pub fn init() {
+pub fn init(args: Option<AssetCanisterArgs>) {
+    if let Some(upgrade_arg) = args {
+        let AssetCanisterArgs::Init(InitArgs {}) = upgrade_arg else { ic_cdk::trap("Cannot initialize the canister with an Upgrade argument. Please provide an Init argument.")};
+    }
     STATE.with(|s| {
         let mut s = s.borrow_mut();
         s.clear();
@@ -425,10 +428,18 @@ pub fn pre_upgrade() -> StableState {
     STATE.with(|s| s.take().into())
 }
 
-pub fn post_upgrade(stable_state: StableState) {
+pub fn post_upgrade(stable_state: StableState, args: Option<AssetCanisterArgs>) {
+    let set_permissions = args.and_then(|args| {
+        let AssetCanisterArgs::Upgrade(UpgradeArgs { set_permissions }) = args else {ic_cdk::trap("Cannot upgrade the canister with an Init argument. Please provide an Upgrade argument.")};
+        set_permissions
+    });
+
     STATE.with(|s| {
         *s.borrow_mut() = State::from(stable_state);
         set_certified_data(&s.borrow().root_hash());
+        if let Some(set_permissions) = set_permissions {
+            s.borrow_mut().set_permissions(set_permissions);
+        }
     });
 }
 
diff --git a/src/canisters/frontend/ic-certified-assets/src/state_machine.rs b/src/canisters/frontend/ic-certified-assets/src/state_machine.rs
index 4bcc82b90a..3a41f358a6 100644
--- a/src/canisters/frontend/ic-certified-assets/src/state_machine.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/state_machine.rs
@@ -24,7 +24,7 @@ use crate::{
     url_decode::url_decode,
 };
 use candid::{CandidType, Deserialize, Int, Nat, Principal};
-use ic_certified_map::{AsHashTree, Hash};
+use ic_certification::{AsHashTree, Hash};
 use ic_representation_independent_hash::Value;
 use num_traits::ToPrimitive;
 use serde::Serialize;
@@ -320,6 +320,20 @@ impl State {
             .ok_or_else(|| "asset not found".to_string())
     }
 
+    pub fn set_permissions(
+        &mut self,
+        SetPermissions {
+            prepare,
+            commit,
+            manage_permissions,
+        }: SetPermissions,
+    ) {
+        *self.get_mut_permission_list(&Permission::Prepare) = prepare.into_iter().collect();
+        *self.get_mut_permission_list(&Permission::Commit) = commit.into_iter().collect();
+        *self.get_mut_permission_list(&Permission::ManagePermissions) =
+            manage_permissions.into_iter().collect();
+    }
+
     pub fn grant_permission(&mut self, principal: Principal, permission: &Permission) {
         let permitted = self.get_mut_permission_list(permission);
         permitted.insert(principal);
diff --git a/src/canisters/frontend/ic-certified-assets/src/types.rs b/src/canisters/frontend/ic-certified-assets/src/types.rs
index 0373146bb6..d72ccdf92d 100644
--- a/src/canisters/frontend/ic-certified-assets/src/types.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/types.rs
@@ -184,3 +184,27 @@ pub struct RevokePermissionArguments {
 pub struct ListPermittedArguments {
     pub permission: Permission,
 }
+
+/// The argument to `init` and `post_upgrade` needs to have the same argument type by definition.
+/// `AssetCanisterArgs` is there so that the two functions can take different argument types.
+#[derive(Clone, Debug, CandidType, Deserialize)]
+pub enum AssetCanisterArgs {
+    Init(InitArgs),
+    Upgrade(UpgradeArgs),
+}
+
+#[derive(Clone, Debug, CandidType, Deserialize)]
+pub struct InitArgs {}
+
+#[derive(Clone, Debug, CandidType, Deserialize)]
+pub struct UpgradeArgs {
+    pub set_permissions: Option<SetPermissions>,
+}
+
+/// Sets the list of principals with a certain permission for every permission that is `Some`.
+#[derive(Clone, Debug, CandidType, Deserialize)]
+pub struct SetPermissions {
+    pub prepare: Vec<Principal>,
+    pub commit: Vec<Principal>,
+    pub manage_permissions: Vec<Principal>,
+}
diff --git a/src/canisters/frontend/ic-frontend-canister/src/lib.rs b/src/canisters/frontend/ic-frontend-canister/src/lib.rs
index ac0cd9d0c7..ccb562c56d 100644
--- a/src/canisters/frontend/ic-frontend-canister/src/lib.rs
+++ b/src/canisters/frontend/ic-frontend-canister/src/lib.rs
@@ -1,8 +1,9 @@
 use ic_cdk::{init, post_upgrade, pre_upgrade};
+use ic_certified_assets::types::AssetCanisterArgs;
 
 #[init]
-fn init() {
-    ic_certified_assets::init();
+fn init(args: Option<AssetCanisterArgs>) {
+    ic_certified_assets::init(args);
 }
 
 #[pre_upgrade]
@@ -12,8 +13,8 @@ fn pre_upgrade() {
 }
 
 #[post_upgrade]
-fn post_upgrade() {
+fn post_upgrade(args: Option<AssetCanisterArgs>) {
     let (stable_state,): (ic_certified_assets::StableState,) =
         ic_cdk::storage::stable_restore().expect("failed to restore stable state");
-    ic_certified_assets::post_upgrade(stable_state);
+    ic_certified_assets::post_upgrade(stable_state, args);
 }
diff --git a/src/dfx/assets/dfx-asset-sources.toml b/src/dfx/assets/dfx-asset-sources.toml
index 5cd20632b0..41c18e690d 100644
--- a/src/dfx/assets/dfx-asset-sources.toml
+++ b/src/dfx/assets/dfx-asset-sources.toml
@@ -1,33 +1,33 @@
 # generated by write-dfx-asset-sources.sh
-replica-rev = '80a6745673a28ee53d257b3fe19dcd6b7efa93d1'
+replica-rev = '69e1408347723dbaa7a6cd2faa9b65c42abbe861'
 
 [x86_64-darwin.ic-ref]
 url = 'https://download.dfinity.systems/ic-ref/ic-ref-0.0.1-a9f73dba-x86_64-darwin.tar.gz'
 sha256 = 'e1c1694579f46d544aa87f6387d7e5a4b096fe65015b1609a459efcbaf15890f'
 
 [x86_64-darwin.icx-proxy]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz'
-sha256 = '46cc8f91e4e4d0b91457a5e0eda3bd65c97a05be869dd65dd61ca777b9a283a2'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz'
+sha256 = 'b07f2784abddcb54f0b0d3ce7585b9283cf814870905d58c26a1c8823ead2fdd'
 
 [x86_64-darwin.ic-admin]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-admin.gz'
-sha256 = '79924a5e51d67dc38006cba3732facefe76b394a70f840a57ac4708e39efbd79'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-admin.gz'
+sha256 = '4b3f8fbc719a16bef00b14e5ae498253736d931f0fcacb52413f2c9859f52197'
 
 [x86_64-darwin.ic-btc-adapter]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz'
-sha256 = 'effc861ce958d38f634a71c36229e660588930e6bfc3ffbad194bf1572fe6f1b'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz'
+sha256 = '3ced0067cc322197af9ba7ee175e7e95eaefa00551690490494884f8f391e978'
 
 [x86_64-darwin.ic-https-outcalls-adapter]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz'
-sha256 = '64308fb38f33f862f22b5c506c1986940c746be777e29bc5f2468ea9f70cec15'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz'
+sha256 = 'feeb5a08899b4c4c55cd7838928bb75a5845988ecc757ee1059e709e4adfd192'
 
 [x86_64-darwin.ic-nns-init]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz'
-sha256 = '171fd4e3879c37af0b0bbb75fe6fabf296759fbfe9f24d76d558dbce427ec483'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz'
+sha256 = '85fd0e91e0a4ebe0272ad0491fd603bf6d313d2293a4266892bff397a26ea930'
 
 [x86_64-darwin.ic-starter]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/ic-starter.gz'
-sha256 = 'd42213aea42f1ae55623e7e437ef683e99c0a3a98c1bae7dc24db7c1577005e9'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-starter.gz'
+sha256 = '1f33354049b6c83c8be06344d913a8bcfdb61ba9234706a8bf3cdb3d620723ab'
 
 [x86_64-darwin.motoko]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.2/motoko-Darwin-x86_64-0.10.2.tar.gz'
@@ -35,21 +35,21 @@ sha256 = '866d35fa33ce9de5b459dba72d247ecfb63e288a178a195f91cdb09e3fc789f4'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-darwin.replica]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/replica.gz'
-sha256 = '523581ffbd0239fc5352a7cd52fe8bf8898165067c9e9172cc44f7ce6c2be11a'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/replica.gz'
+sha256 = 'f320fec5733182e1ceb0dd03d19dc5bec01a1bf7763eb282e3fe14b1e1a6e18b'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-darwin.canister_sandbox]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz'
-sha256 = '9b8e533698cb36c3cad0e08bf31b2317186021f949cfa7f7d6c3a0c6905eaa24'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz'
+sha256 = '4acdd46cf9b1e5be987f6ce72d0118bf9039162e3ff80cd32056da136f753011'
 
 [x86_64-darwin.sandbox_launcher]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz'
-sha256 = '292d446b8556ffd992d424de6c393d2858c8a190cca2b1e9bd2c36a1b015f887'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz'
+sha256 = 'ed0bc2eeaf282012c8475ddf1ca3369488dc80d385e5b194d2823ae84514ff8a'
 
 [x86_64-darwin.sns]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-darwin/sns.gz'
-sha256 = '73a6d72d82025abb58c28d6ada411ac40ed5b482017f409133f7ac5562899990'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sns.gz'
+sha256 = '04d06a093913ef59d9d4c7cdc14a0751cff6465384d60204e03d5f396edfb38b'
 
 [x86_64-darwin.motoko-base]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.2/motoko-base-library.tar.gz'
@@ -64,28 +64,28 @@ url = 'https://download.dfinity.systems/ic-ref/ic-ref-0.0.1-a9f73dba-x86_64-linu
 sha256 = '5c4967764e87d1b2945b1db027422633b48f08cd01d96ba2f622753fcb62c2a4'
 
 [x86_64-linux.icx-proxy]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz'
-sha256 = '6d52dfa48215857a658bca8477869cfec5e85c1a00f19f9fd2af2320cbb55ee4'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz'
+sha256 = '2bff6952a65e2d94f49ffa5ce03bfbd0eef0fb6ca82a839844c84fd3efa8b280'
 
 [x86_64-linux.ic-admin]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-admin.gz'
-sha256 = '5c4852084ffc4699735b2a9c3a511f93fc559371f4ae3cdd59a9da8c4bfe1af8'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-admin.gz'
+sha256 = 'ee6a6d75549bbe355ec4930dd1f6fc1948f973666823d47943adaa2c2bf11902'
 
 [x86_64-linux.ic-btc-adapter]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz'
-sha256 = 'a921cb7b315b143fa4e2919d4f0843441c0d1404784d9c0813ceb663ffd62ded'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz'
+sha256 = 'd31b5adbf91ba4efa910c80d971c08d591dada6b369119f2b1d444d1e58134ea'
 
 [x86_64-linux.ic-https-outcalls-adapter]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz'
-sha256 = '313e43ad29a598afb345153c4e1dd1d7d1b849a51a4fc05ef6bac4b7bbb35f60'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz'
+sha256 = '276faf4aa298c72709076338671fa356a50133ad7996a75748f0a1eabffbfd61'
 
 [x86_64-linux.ic-nns-init]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-nns-init.gz'
-sha256 = '2d5f6aa2677cc5c4692741faefc95da81e09fa36bc1ebfe25fb677230bf8cb47'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-nns-init.gz'
+sha256 = 'd58e8efdb8bcd64572bb8dd21a5e9cdb779c06a2c56f3be8ebe7e5709a516897'
 
 [x86_64-linux.ic-starter]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/ic-starter.gz'
-sha256 = 'eb5ea6cd768fda12d00f370665db132d66c262b35f1a513c2807f78881c1cb7a'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-starter.gz'
+sha256 = '8d8c51033cb2cd20049ca4e048144b895684d7a4fdbd07719476797b53ebafb5'
 
 [x86_64-linux.motoko]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.2/motoko-Linux-x86_64-0.10.2.tar.gz'
@@ -93,21 +93,21 @@ sha256 = 'daa3fb7c739174296711334f0616745bc8839027432538261e05b4cc95d83ea8'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-linux.replica]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/replica.gz'
-sha256 = 'cccdb333843adc72cbf45b69425adb535c6c42342eff9395fc31a57ae353b1da'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/replica.gz'
+sha256 = '2cd30cca1818b86785b3d9b808612b7c286252363806c70d196c2fcfa48d1188'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-linux.canister_sandbox]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/canister_sandbox.gz'
-sha256 = 'ac15f3685bba0085b3a550ad4cfa9cbe1d5061fa50797e42ff230f9b659dd6bd'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/canister_sandbox.gz'
+sha256 = '11849a543a162f0f25b3dc10f17c177ea054e4fdb8a8c86509c7f87988ce2913'
 
 [x86_64-linux.sandbox_launcher]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz'
-sha256 = '266ec0e2ceb9ed9a92452a6558d26f3c5c1ac414d5271e47ce607cf27e632f6f'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz'
+sha256 = '96c416bf98724aa3bf72053d06d559f007f8655261b48f435f9104b605c8f77f'
 
 [x86_64-linux.sns]
-url = 'https://download.dfinity.systems/ic/80a6745673a28ee53d257b3fe19dcd6b7efa93d1/openssl-static-binaries/x86_64-linux/sns.gz'
-sha256 = 'a9e30c500fb108ab5247db0827868fb74914939a04519d08943440f12b020db8'
+url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sns.gz'
+sha256 = '966a84f1e563049e09381b39cbcde24b0c77032ee2cfddb40962eecb70925809'
 
 [x86_64-linux.motoko-base]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.2/motoko-base-library.tar.gz'
diff --git a/src/dfx/src/commands/canister/install.rs b/src/dfx/src/commands/canister/install.rs
index 0b01dd243d..4a00c18d48 100644
--- a/src/dfx/src/commands/canister/install.rs
+++ b/src/dfx/src/commands/canister/install.rs
@@ -203,7 +203,9 @@ pub async fn exec(
                     Principal::from_text(canister).or_else(|_| canister_id_store.get(canister))?;
                 let canister_info = CanisterInfo::load(&config, canister, Some(canister_id))?;
 
-                let install_args = || Ok(vec![]);
+                let idl_path = canister_info.get_constructor_idl_path();
+                let init_type = get_candid_init_type(&idl_path);
+                let install_args = || blob_from_arguments(None, None, None, &init_type);
 
                 install_canister(
                     env,
diff --git a/src/dfx/src/lib/operations/canister/install_canister.rs b/src/dfx/src/lib/operations/canister/install_canister.rs
index c8be2ea47a..1bd13cd42b 100644
--- a/src/dfx/src/lib/operations/canister/install_canister.rs
+++ b/src/dfx/src/lib/operations/canister/install_canister.rs
@@ -107,9 +107,13 @@ pub async fn install_canister(
     let wasm_path: PathBuf = if let Some(wasm_override) = wasm_path_override {
         wasm_override.into()
     } else {
-        canister_info
+        let build_wasm_path = canister_info
             .map(|info| info.get_build_wasm_path())
-            .context("Failed to find wasm")?
+            .context("Failed to find wasm")?;
+        if !build_wasm_path.exists() {
+            bail!("The canister must be built before install. Please run `dfx build`.");
+        }
+        build_wasm_path
     };
     let wasm_module = std::fs::read(&wasm_path)
         .with_context(|| format!("Failed to read {}.", &wasm_path.display()))?;
diff --git a/src/dfx/src/util/clap/parsers.rs b/src/dfx/src/util/clap/parsers.rs
index 290e3da662..9b7184dffc 100644
--- a/src/dfx/src/util/clap/parsers.rs
+++ b/src/dfx/src/util/clap/parsers.rs
@@ -1,5 +1,33 @@
 use byte_unit::{Byte, ByteUnit};
-use std::path::PathBuf;
+use rust_decimal::Decimal;
+use std::{path::PathBuf, str::FromStr};
+
+/// Removes `_`, interprets `k`, `m`, `b`, `t` suffix (case-insensitive)
+fn decimal_with_suffix_parser(input: &str) -> Result<Decimal, String> {
+    let input = input.replace('_', "").to_lowercase();
+    let (number, suffix) = if input
+        .chars()
+        .last()
+        .map(|char| char.is_alphabetic())
+        .unwrap_or(false)
+    {
+        input.split_at(input.len() - 1)
+    } else {
+        (input.as_str(), "")
+    };
+    let multiplier: u64 = match suffix {
+        "" => Ok(1),
+        "k" => Ok(1_000),
+        "m" => Ok(1_000_000),
+        "b" => Ok(1_000_000_000),
+        "t" => Ok(1_000_000_000_000),
+        other => Err(format!("Unknown amount specifier: '{}'", other)),
+    }?;
+    let number = Decimal::from_str(number).map_err(|err| err.to_string())?;
+    Decimal::from(multiplier)
+        .checked_mul(number)
+        .ok_or_else(|| "Amount too large.".to_string())
+}
 
 pub fn request_id_parser(v: &str) -> Result<String, String> {
     // A valid Request Id starts with `0x` and is a series of 64 hexadecimals.
@@ -18,9 +46,10 @@ pub fn request_id_parser(v: &str) -> Result<String, String> {
     }
 }
 
-pub fn e8s_parser(e8s: &str) -> Result<u64, String> {
-    e8s.parse::<u64>()
-        .map_err(|_| "Must specify a non negative whole number.".to_string())
+pub fn e8s_parser(input: &str) -> Result<u64, String> {
+    decimal_with_suffix_parser(input)?
+        .try_into()
+        .map_err(|_| "Must specify a non-negative whole number.".to_string())
 }
 
 pub fn memo_parser(memo: &str) -> Result<u64, String> {
@@ -28,10 +57,14 @@ pub fn memo_parser(memo: &str) -> Result<u64, String> {
         .map_err(|_| "Must specify a non negative whole number.".to_string())
 }
 
-pub fn cycle_amount_parser(cycles: &str) -> Result<u128, String> {
-    cycles
-        .parse::<u128>()
-        .map_err(|_| "Must be a non negative amount.".to_string())
+pub fn cycle_amount_parser(input: &str) -> Result<u128, String> {
+    let removed_cycle_suffix = if input.to_lowercase().ends_with('c') {
+        &input[..input.len() - 1]
+    } else {
+        input
+    };
+
+    decimal_with_suffix_parser(removed_cycle_suffix)?.try_into().map_err(|_| "Failed to parse amount. Please use digits only or something like 3.5TC, 2t, or 5_000_000.".to_string())
 }
 
 pub fn file_parser(path: &str) -> Result<PathBuf, String> {
@@ -52,9 +85,15 @@ pub fn file_or_stdin_parser(path: &str) -> Result<PathBuf, String> {
     }
 }
 
-pub fn trillion_cycle_amount_parser(cycles: &str) -> Result<u128, String> {
-    format!("{}000000000000", cycles).parse::<u128>()
-        .map_err(|_| "Must be a non negative amount. Currently only accepts whole numbers. Use --cycles otherwise.".to_string())
+pub fn trillion_cycle_amount_parser(input: &str) -> Result<u128, String> {
+    if let Ok(cycles) = format!("{}000000000000", input.replace('_', "")).parse::<u128>() {
+        Ok(cycles)
+    } else {
+        decimal_with_suffix_parser(input)?
+            .checked_mul(1_000_000_000_000_u64.into())
+            .and_then(|total| total.try_into().ok())
+            .ok_or_else(|| "Amount too large.".to_string())
+    }
 }
 
 pub fn compute_allocation_parser(compute_allocation: &str) -> Result<u64, String> {
@@ -130,3 +169,42 @@ pub fn hsm_key_id_parser(key_id: &str) -> Result<String, String> {
         Ok(key_id.to_string())
     }
 }
+
+#[test]
+fn test_cycle_amount_parser() {
+    assert_eq!(cycle_amount_parser("900c"), Ok(900));
+    assert_eq!(cycle_amount_parser("9_887K"), Ok(9_887_000));
+    assert_eq!(cycle_amount_parser("0.1M"), Ok(100_000));
+    assert_eq!(cycle_amount_parser("0.01b"), Ok(10_000_000));
+    assert_eq!(cycle_amount_parser("10T"), Ok(10_000_000_000_000));
+    assert_eq!(cycle_amount_parser("10TC"), Ok(10_000_000_000_000));
+    assert_eq!(cycle_amount_parser("1.23t"), Ok(1_230_000_000_000));
+
+    assert!(cycle_amount_parser("1ffff").is_err());
+    assert!(cycle_amount_parser("1MT").is_err());
+    assert!(cycle_amount_parser("-0.1m").is_err());
+    assert!(cycle_amount_parser("T100").is_err());
+    assert!(cycle_amount_parser("1.1k0").is_err());
+    assert!(cycle_amount_parser(&format!("{}0", u128::MAX)).is_err());
+}
+
+#[test]
+fn test_trillion_cycle_amount_parser() {
+    const TRILLION: u128 = 1_000_000_000_000;
+    assert_eq!(trillion_cycle_amount_parser("3"), Ok(3 * TRILLION));
+    assert_eq!(trillion_cycle_amount_parser("5_555"), Ok(5_555 * TRILLION));
+    assert_eq!(trillion_cycle_amount_parser("1k"), Ok(1_000 * TRILLION));
+    assert_eq!(trillion_cycle_amount_parser("0.3"), Ok(300_000_000_000));
+    assert_eq!(trillion_cycle_amount_parser("0.3k"), Ok(300 * TRILLION));
+
+    assert!(trillion_cycle_amount_parser("-0.1m").is_err());
+    assert!(trillion_cycle_amount_parser("1TC").is_err()); // ambiguous in combination with --t
+}
+
+#[test]
+fn test_e8s_parser() {
+    assert_eq!(e8s_parser("1"), Ok(1));
+    assert_eq!(e8s_parser("1_000"), Ok(1_000));
+    assert_eq!(e8s_parser("1k"), Ok(1_000));
+    assert_eq!(e8s_parser("1M"), Ok(1_000_000));
+}
diff --git a/src/distributed/assetstorage.did b/src/distributed/assetstorage.did
index d607712e01..51bb1a235b 100644
--- a/src/distributed/assetstorage.did
+++ b/src/distributed/assetstorage.did
@@ -139,7 +139,25 @@ type ListPermitted = record { permission: Permission };
 
 type ValidationResult = variant { Ok : text; Err : text };
 
-service: {
+type AssetCanisterArgs = variant {
+  Init: InitArgs;
+  Upgrade: UpgradeArgs;
+};
+
+type InitArgs = record {};
+
+type UpgradeArgs = record {
+  set_permissions: opt SetPermissions;
+};
+
+/// Sets the list of principals granted each permission.
+type SetPermissions = record {
+  prepare: vec principal;
+  commit: vec principal;
+  manage_permissions: vec principal;
+};
+
+service: (asset_canister_args: opt AssetCanisterArgs) -> {
   api_version: () -> (nat16) query;
 
   get: (record {
diff --git a/src/distributed/assetstorage.wasm.gz b/src/distributed/assetstorage.wasm.gz
index 77024d108d..eb402f7605 100755
Binary files a/src/distributed/assetstorage.wasm.gz and b/src/distributed/assetstorage.wasm.gz differ