diff --git a/.env.sample b/.env.sample
index f15049e..cdd9f64 100644
--- a/.env.sample
+++ b/.env.sample
@@ -54,11 +54,9 @@ DB_PORT=5432
 REDIS_HOST=redis
 REDIS_PORT=6379
 # REDIS_URL=
-# REDIS_NAMESPACE=
 # CACHE_REDIS_HOST=
 # CACHE_REDIS_PORT=
 # CACHE_REDIS_URL=
-# CACHE_REDIS_NAMESPACE=
 
 # ElasticSearch
 # --------------------------------------
@@ -79,6 +77,9 @@ SECRET_VAPID_PRIVATE_KEY_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
 SECRET_SMTP_PASSWORD_VERSION=v1
 SECRET_AWS_SECRET_ACCESS_KEY_VERSION=v1
+SECRET_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY_VERSION=v1
+SECRET_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT_VERSION=v1
+SECRET_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY_VERSION=v1
 
 # Web Push
 # ========
diff --git a/abra.sh b/abra.sh
index a070e6d..bbcc8a3 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-export ENTRYPOINT_CONF_VERSION=v8
+export ENTRYPOINT_CONF_VERSION=v9
 
 file_env() {
   local var="$1"
diff --git a/compose.yml b/compose.yml
index 079bdf6..fdf949c 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: git.coopcloud.tech/coop-cloud-chaos-patchs/hometown:v4.2.17-hometown-1.1.2
+    image: git.coopcloud.tech/coop-cloud-chaos-patchs/hometown:v4.5.6-hometown-1.2.0
     command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rake db:migrate; bundle exec rails s -p 3000"
     networks: &bothNetworks
       - proxy
@@ -19,7 +19,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}_web.rule=Host(`${DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}_web.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}_web.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=2.0.2+v4.2.17-hometown-1.1.2"
+        - "coop-cloud.${STACK_NAME}.version=3.0.0+v4.5.6-hometown-1.2.0"
     configs: &configs
       - source: entrypoint_sh
         target: /usr/local/bin/entrypoint.sh
@@ -33,12 +33,17 @@ services:
       - secret_key_base
       - smtp_password
       - vapid_private_key
+      - enc_det_key
+      - enc_salt
+      - enc_pri_key
     environment: &env
+      - ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY_FILE=/run/secrets/enc_det_key
+      - ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT_FILE=/run/secrets/enc_salt
+      - ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY_FILE=/run/secrets/enc_pri_key
       - ALLOW_ACCESS_TO_HIDDEN_SERVICE
       - ALTERNATE_DOMAINS
       - AUTHORIZED_FETCH
       - CACHE_REDIS_HOST
-      - CACHE_REDIS_NAMESPACE
       - CACHE_REDIS_PORT
       - CACHE_REDIS_URL
       - DB_HOST
@@ -97,7 +102,6 @@ services:
       - RAILS_ENV
       - RAILS_SERVE_STATIC_FILES
       - REDIS_HOST
-      - REDIS_NAMESPACE
       - REDIS_PORT
       - REDIS_URL
       - SAML_ACS_URL
@@ -143,7 +147,7 @@ services:
       - WEB_DOMAIN
 
   streaming:
-    image: git.coopcloud.tech/coop-cloud-chaos-patchs/hometown:v4.2.17-hometown-1.1.2
+    image: git.coopcloud.tech/coop-cloud-chaos-patchs/hometown:v4.5.6-hometown-1.2.0-streaming
     command: node ./streaming
     configs: *configs
     entrypoint: *entrypoint
@@ -164,7 +168,7 @@ services:
     volumes: *appVolume # used to make sure this volume is created
 
   sidekiq:
-    image: git.coopcloud.tech/coop-cloud-chaos-patchs/hometown:v4.2.17-hometown-1.1.2
+    image: git.coopcloud.tech/coop-cloud-chaos-patchs/hometown:v4.5.6-hometown-1.2.0
     secrets: *secrets
     command: bundle exec sidekiq
     configs: *configs
@@ -222,6 +226,15 @@ secrets:
   smtp_password:
     name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
     external: true
+  enc_det_key:
+    name: ${STACK_NAME}_enc_det_key_${SECRET_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY_VERSION}
+    external: true
+  enc_salt:
+    name: ${STACK_NAME}_enc_salt_${SECRET_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT_VERSION}
+    external: true
+  enc_pri_key:
+    name: ${STACK_NAME}_enc_pri_key_${SECRET_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY_VERSION}
+    external: true
 
 volumes:
   app:
diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
index fb0b345..ce9814c 100644
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@@ -30,6 +30,9 @@ file_env "SECRET_KEY_BASE"
 file_env "SMTP_PASSWORD"
 file_env "VAPID_PRIVATE_KEY"
 file_env "AWS_SECRET_ACCESS_KEY"
+file_env "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"
+file_env "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"
+file_env "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"
 
 {{ if eq (env "OIDC_ENABLED") "true" }}
 file_env "OIDC_CLIENT_SECRET"
diff --git a/release/3.0.0+v4.5.6-hometown-1.2.0 b/release/3.0.0+v4.5.6-hometown-1.2.0
new file mode 100644
index 0000000..59c62ce
--- /dev/null
+++ b/release/3.0.0+v4.5.6-hometown-1.2.0
@@ -0,0 +1,20 @@
+!!! It is recommended to update to this version before moving on to later updates !!!
+
+- Redis Namespaces are no longer supported! If you use REDIS_NAMESPACE or CACHE_REDIS_NAMESPACE in your config, you'll have to remove it.
+
+- Three new secrets have been introduced:
+  * Add the keys to your env:
+SECRET_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY_VERSION=v1
+SECRET_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT_VERSION=v1
+SECRET_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY_VERSION=v1
+  * Create the keys, e.g. with `abra app secret generate -a your.app.domain`
+
+- As with every mastodon upgrade, you'll need to migrate databases by running:
+```
+abra app run your.app.domain app bash -c "SKIP_POST_DEPLOYMENT_MIGRATIONS=true rails db:migrate"
+abra app undeploy your.app.domain
+abra app deploy your.app.domain
+abra app run your.app.domain app rails db:migrate
+```
+
+See the full release notes for details: https://github.com/hometown-fork/hometown/releases/tag/v4.5.6%2Bhometown-1.2.0