diff --git a/server-ce/hotfix/3.5.6/Dockerfile b/server-ce/hotfix/3.5.6/Dockerfile
new file mode 100644
index 0000000000..e59890fd9f
--- /dev/null
+++ b/server-ce/hotfix/3.5.6/Dockerfile
@@ -0,0 +1,8 @@
+FROM sharelatex/sharelatex:3.5.5
+
+# Patch: support trustProxyIps in Server CE/Pro
+COPY trusted_proxy_ips.patch .
+RUN patch -p0 --directory=/etc/sharelatex < trusted_proxy_ips.patch
+
+# Patch: add script to cleanup legacy history data
+ADD clean_sl_history_data.js /overleaf/services/web/scripts/history/clean_sl_history_data.js
diff --git a/server-ce/hotfix/3.5.6/clean_sl_history_data.js b/server-ce/hotfix/3.5.6/clean_sl_history_data.js
new file mode 100644
index 0000000000..1800692cbe
--- /dev/null
+++ b/server-ce/hotfix/3.5.6/clean_sl_history_data.js
@@ -0,0 +1,60 @@
+const { waitForDb, db } = require('../../app/src/infrastructure/mongodb')
+
+async function main() {
+  await checkAllProjectsAreMigrated()
+  await setAllowDowngradeToFalse()
+  await deleteHistoryCollections()
+  console.log('Legacy history data cleaned up successfully')
+  process.exit(0)
+}
+
+async function checkAllProjectsAreMigrated() {
+  console.log('checking all projects are migrated to Full Project History')
+
+  const count = await db.projects.countDocuments({
+    'overleaf.history.display': { $ne: true },
+  })
+
+  if (count === 0) {
+    console.log('All projects are migrated to Full Project History')
+  } else {
+    console.error(
+      `There are ${count} projects that are not migrated to Full Project History` +
+        ` please complete the migration before running this script again.`
+    )
+    process.exit(1)
+  }
+}
+
+async function setAllowDowngradeToFalse() {
+  console.log('unsetting `allowDowngrade` flag in all projects')
+  await db.projects.updateMany(
+    {
+      'overleaf.history.id': { $exists: true },
+      'overleaf.history.allowDowngrade': true,
+    },
+    { $unset: { 'overleaf.history.allowDowngrade': 1 } }
+  )
+  console.log('unsetting `allowDowngrade` flag in all projects - Done')
+}
+
+async function deleteHistoryCollections() {
+  console.log('removing `docHistory` data')
+  await db.docHistory.deleteMany({})
+  console.log('removing `docHistory` data - Done')
+
+  console.log('removing `docHistoryIndex` data')
+  await db.docHistoryIndex.deleteMany({})
+  console.log('removing `docHistoryIndex` data - Done')
+
+  console.log('removing `projectHistoryMetaData` data')
+  await db.projectHistoryMetaData.deleteMany({})
+  console.log('removing `projectHistoryMetaData` data - Done')
+}
+
+waitForDb()
+  .then(main)
+  .catch(err => {
+    console.error(err)
+    process.exit(1)
+  })
diff --git a/server-ce/hotfix/3.5.6/trusted_proxy_ips.patch b/server-ce/hotfix/3.5.6/trusted_proxy_ips.patch
new file mode 100644
index 0000000000..cdba9e3c8c
--- /dev/null
+++ b/server-ce/hotfix/3.5.6/trusted_proxy_ips.patch
@@ -0,0 +1,10 @@
+--- settings.js
++++ settings.js
+@@ -245,6 +245,7 @@ const settings = {
+   // address and http/https protocol information.
+
+   behindProxy: process.env.SHARELATEX_BEHIND_PROXY || false,
++  trustedProxyIps: process.env.SHARELATEX_TRUSTED_PROXY_IPS,
+
+   i18n: {
+     subdomainLang: {