diff --git a/README.md b/README.md
index 4489da3..b246f37 100644
--- a/README.md
+++ b/README.md
@@ -25,11 +25,28 @@ host.
 4. `abra app config YOURAPPDOMAIN` - be sure to change `$WEB_DOMAIN` to something that resolves to
    your Docker swarm box
 5. `abra app deploy YOURAPPDOMAIN`
-9. Create initial user:
+6. Create initial user:
 ```
 abra app run YOURDOMAIN admin flask mailu admin admin YOURDOMAIN YOURPASSWORD
 ```
 
+## Upgrading the recipe
+
+**NOTE** This section is only intended for [recipe maintainers][maintainers]
+
+Minor/patch updates usually work OK with `abra recipe upgrade` and friends. 
+
+For major updates:
+
+1. Go to https://setup.mailu.io/ and generate a new config
+2. Download the new config and compare it to `compose.yml`. Pay attention to:
+  - New / removed services
+  - Added/removed config options
+  - Changes to networking
+3. Test upgrading from the previous version to the new version
+4. `abra recipe sync` / `abra recipe release` as normal
+
 [Mailu]: https://mailu.io/
 [abra]: https://git.autonomic.zone/autonomic-cooperative/abra
 [compose-traefik]: https://git.autonomic.zone/coop-cloud/traefik
+[maintainers]: https://docs.coopcloud.tech/maintainers/
diff --git a/compose.yml b/compose.yml
index 9849210..91c4dc0 100644
--- a/compose.yml
+++ b/compose.yml
@@ -54,7 +54,7 @@ x-environment:
 
 services:
   app:
-    image: ghcr.io/mailu/nginx:2.0.41
+    image: ghcr.io/mailu/nginx:2024.06.27
     logging:
       driver: json-file
     networks:
@@ -98,12 +98,12 @@ services:
         - "coop-cloud.${STACK_NAME}.version=1.1.1+2.0.41"
   
   db:
-    image: redis:7.2.4-alpine
+    image: redis:7.4.1-alpine
     volumes:
       - "redis:/data"
 
   admin:
-    image: ghcr.io/mailu/admin:2.0.41
+    image: ghcr.io/mailu/admin:2024.06.27
     environment: *default-env
     healthcheck:
       disable: true
@@ -116,7 +116,7 @@ services:
       - default
 
   imap:
-    image: ghcr.io/mailu/dovecot:2.0.41
+    image: ghcr.io/mailu/dovecot:2024.06.27
     environment: *default-env
     secrets:
       - secret_key
@@ -130,7 +130,7 @@ services:
       - default
 
   smtp:
-    image: ghcr.io/mailu/postfix:2.0.41
+    image: ghcr.io/mailu/postfix:2024.06.27
     environment: *default-env
     secrets:
       - secret_key
@@ -142,7 +142,7 @@ services:
       - app
 
   antispam:
-    image: ghcr.io/mailu/rspamd:2.0.41
+    image: ghcr.io/mailu/rspamd:2024.06.27
     environment: *default-env
     secrets:
       - secret_key
@@ -153,7 +153,8 @@ services:
       disable: true
 
   webmail:
-    image: ghcr.io/mailu/webmail:2.0.41
+    image: ghcr.io/mailu/webmail:2024.06.27
+    # entrypoint: "tail -f /dev/null"
     environment: *default-env
     networks:
       - default
@@ -167,7 +168,7 @@ services:
       disable: true
 
   certdumper:
-    image: ldez/traefik-certs-dumper:v2.8.3
+    image: ldez/traefik-certs-dumper:v2.9.3
     entrypoint: sh -c '
       apk add jq
       ; while ! [ -e /traefik/${ACME_JSON} ]