diff --git a/abra.sh b/abra.sh
index 082bf3c..d1bd4e1 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-export FPM_TUNE_VERSION=v5
+export FPM_TUNE_VERSION=v6
 export NGINX_CONF_VERSION=v9
 export MY_CNF_VERSION=v6
 export ENTRYPOINT_VERSION=v3
diff --git a/compose.yml b/compose.yml
index 4874baf..b491bb0 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=16.2.0+35.0.2-fpm"
+        - "coop-cloud.${STACK_NAME}.version=16.2.1+35.0.2-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"
diff --git a/fpm-tune.ini b/fpm-tune.ini
index af0f58d..1240c6f 100644
--- a/fpm-tune.ini
+++ b/fpm-tune.ini
@@ -3,3 +3,13 @@ pm.max_children = {{ env "FPM_MAX_CHILDREN" }}
 pm.start_servers = {{ env "FPM_START_SERVERS" }}
 pm.min_spare_servers = {{ env "FPM_MIN_SPARE_SERVERS" }}
 pm.max_spare_servers = {{ env "FPM_MAX_SPARE_SERVERS" }}
+
+; Interim mitigations for CVE-2026-109618 / CVE-2026-109619, see
+; https://www.php.net/archive/2026.php#2026-10-21-5
+; Remove once the nextcloud image ships PHP >= 8.5.12 / 8.4.27.
+; php_admin_* cannot be overridden by .user.ini or ini_set().
+php_admin_value[memory_limit] = -1
+php_admin_value[post_max_size] = 32M
+php_admin_value[upload_max_filesize] = 30M
+php_admin_flag[session.upload_progress.enabled] = off
+php_admin_flag[fatal_error_backtraces] = off