diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 2928cfdc..61a09e07 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -1,49 +1,24 @@
-name: NATS Server Nightly
+name: "NATS Server Nightly: DEV"
 on:
   workflow_dispatch: {}
 
   schedule:
     - cron: "40 4 * * *"
 
-
 jobs:
   nightly_release:
     runs-on: ubuntu-latest
-
-    env:
-      GOPATH: /home/runner/work/nats-server
-      GO111MODULE: "on"
-
     steps:
       - name: Checkout code
-        uses: actions/checkout@v1
+        uses: actions/checkout@v3
         with:
           path: src/github.com/nats-io/nats-server
           ref: dev
 
-      - name: Set up Go
-        uses: actions/setup-go@v3
+      - uses: ./src/github.com/nats-io/nats-server/.github/actions/nightly-release
         with:
-          # This should be quoted or use .x, but should not be unquoted.
-          # Remember that a YAML bare float drops trailing zeroes.
-          go-version: '1.19'
-
-      - name: goreleaser
-        uses: goreleaser/goreleaser-action@v3
-        with:
-          version: latest
-          args: release --snapshot --config .goreleaser-nightly.yml
-
-      - name: images
-        run: |
-          docker images
-
-      - name: docker_login
-        run: |
-          docker login -u "${{ secrets.DOCKER_USERNAME }}" -p "${{ secrets.DOCKER_PASSWORD }}"
-
-      - name: docker_push
-        run: |
-          NDATE=$(date +%Y%m%d)
-          docker push synadia/nats-server:nightly-${NDATE}
-          docker push synadia/nats-server:nightly
+          go: "1.19"
+          workdir: src/github.com/nats-io/nats-server
+          label: nightly
+          hub_username: "${{ secrets.DOCKER_USERNAME }}"
+          hub_password: "${{ secrets.DOCKER_PASSWORD }}"
diff --git a/.github/workflows/rc_nightly.yaml b/.github/workflows/rc_nightly.yaml
index 29e16bd8..9dc68f7d 100644
--- a/.github/workflows/rc_nightly.yaml
+++ b/.github/workflows/rc_nightly.yaml
@@ -1,4 +1,4 @@
-name: NATS Server Nightly MAIN
+name: "NATS Server Nightly: MAIN"
 on:
   workflow_dispatch: {}
 
diff --git a/server/filestore.go b/server/filestore.go
index d2067141..b4f75957 100644
--- a/server/filestore.go
+++ b/server/filestore.go
@@ -3993,16 +3993,17 @@ func (mb *msgBlock) flushPendingMsgsLocked() (*LostStreamData, error) {
 
 	// Check if we need to encrypt.
 	if mb.bek != nil && lob > 0 {
-		const rsz = 32 * 1024 // 32k
-		var rdst [rsz]byte
-		var dst []byte
-		if lob > rsz {
-			dst = make([]byte, lob)
-		} else {
-			dst = rdst[:lob]
-		}
 		// Need to leave original alone.
+		var dst []byte
+		if lob <= defaultLargeBlockSize {
+			dst = getMsgBlockBuf(lob)[:lob]
+		} else {
+			dst = make([]byte, lob)
+		}
 		mb.bek.XORKeyStream(dst, buf)
+		if cap(buf) <= defaultLargeBlockSize {
+			recycleMsgBlockBuf(buf)
+		}
 		buf = dst
 	}