diff --git a/.github/ISSUE_TEMPLATE/release_checklist.md b/.github/ISSUE_TEMPLATE/release_checklist.md
index f4e887e797..e308c6a1b4 100644
--- a/.github/ISSUE_TEMPLATE/release_checklist.md
+++ b/.github/ISSUE_TEMPLATE/release_checklist.md
@@ -16,6 +16,8 @@ Refer to the [Deployment](https://data-safe-haven.readthedocs.io/en/latest/deplo
 
 - [ ] Consult the `data-safe-haven/VERSIONING.md` guide and determine the version number of the new release. Record it in the title of this issue
 - [ ] Create a release branch called e.g. `release-v0.0.1`
+    - If this is a hotfix release then this branch should be based off `latest`
+    - In all other cases it should be based off `develop`
 - [ ] Draft a changelog for the release similar to our [previous releases](https://github.com/alan-turing-institute/data-safe-haven/releases)
 
 ### For patch releases only
@@ -50,6 +52,7 @@ Refer to the [Deployment](https://data-safe-haven.readthedocs.io/en/latest/deplo
 - [ ] Ensure docs for the latest version are built and deployed on ReadTheDocs
 - [ ] Push a build to PyPI
 - [ ] Announce release on communications channels
+- [ ] Create a PR from `latest` into `develop` to ensure that release-specific changes are not lost
 
 ## :deciduous_tree: Deployment problems
 
diff --git a/data_safe_haven/administration/users/guacamole_users.py b/data_safe_haven/administration/users/guacamole_users.py
index 8c0c5381a0..997ef7e138 100644
--- a/data_safe_haven/administration/users/guacamole_users.py
+++ b/data_safe_haven/administration/users/guacamole_users.py
@@ -23,7 +23,10 @@ def __init__(
             pulumi_config=pulumi_config,
         )
         # Read the SRE database secret from key vault
-        azure_sdk = AzureSdk(context.subscription_name)
+        azure_sdk = AzureSdk(subscription_name=context.subscription_name)
+        sre_subscription_name = azure_sdk.get_subscription_name(
+            config.azure.subscription_id
+        )
         connection_db_server_password = azure_sdk.get_keyvault_secret(
             sre_stack.output("data")["key_vault_name"],
             sre_stack.output("data")["password_user_database_admin_secret"],
@@ -33,7 +36,7 @@ def __init__(
             connection_db_server_password,
             sre_stack.output("remote_desktop")["connection_db_server_name"],
             sre_stack.output("remote_desktop")["resource_group_name"],
-            context.subscription_name,
+            sre_subscription_name,
         )
         self.users_: Sequence[ResearchUser] | None = None
         self.postgres_script_path: pathlib.Path = (
diff --git a/data_safe_haven/infrastructure/programs/sre/remote_desktop.py b/data_safe_haven/infrastructure/programs/sre/remote_desktop.py
index ba1e8b9816..5bafaa4ae8 100644
--- a/data_safe_haven/infrastructure/programs/sre/remote_desktop.py
+++ b/data_safe_haven/infrastructure/programs/sre/remote_desktop.py
@@ -285,7 +285,7 @@ def __init__(
                     ),
                 ),
                 containerinstance.ContainerArgs(
-                    image="ghcr.io/alan-turing-institute/guacamole-user-sync:v0.6.0",
+                    image="ghcr.io/alan-turing-institute/guacamole-user-sync:v0.7.0",
                     name="guacamole-user-sync"[:63],
                     environment_variables=[
                         containerinstance.EnvironmentVariableArgs(
diff --git a/data_safe_haven/version.py b/data_safe_haven/version.py
index e5ca1b74a8..d6627715f5 100644
--- a/data_safe_haven/version.py
+++ b/data_safe_haven/version.py
@@ -1,2 +1,2 @@
-__version__ = "5.2.0"
+__version__ = "5.2.1"
 __version_info__ = tuple(__version__.split("."))