diff --git a/.drone.yml b/.drone.yml
index 97969b8..08029de 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,30 +1,30 @@
----
-kind: pipeline
-name: deploy to swarm-test.autonomic.zone
-steps:
-  - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
-    settings:
-      host: swarm-test.autonomic.zone
-      stack: wordpress
-      generate_secrets: true
-      purge: true
-      deploy_key:
-        from_secret: drone_ssh_swarm_test
-      networks:
-        - proxy
-    environment:
-      DOMAIN: wordpress.swarm-test.autonomic.zone
-      STACK_NAME: wordpress
-      LETS_ENCRYPT_ENV: production
-      SECRET_DB_PASSWORD_VERSION: v1
-      SECRET_DB_ROOT_PASSWORD_VERSION: v1
-      PHP_UPLOADS_CONF_VERSION: v1
-      ENTRYPOINT_CONF_VERSION: v1
-      HTACCESS_CONF_VERSION: v1
-trigger:
-  branch:
-    - main
+# ---
+# kind: pipeline
+# name: deploy to swarm-test.autonomic.zone
+# steps:
+#   - name: deployment
+#     image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+#     settings:
+#       host: swarm-test.autonomic.zone
+#       stack: wordpress
+#       generate_secrets: true
+#       purge: true
+#       deploy_key:
+#         from_secret: drone_ssh_swarm_test
+#       networks:
+#         - proxy
+#     environment:
+#       DOMAIN: wordpress.swarm-test.autonomic.zone
+#       STACK_NAME: wordpress
+#       LETS_ENCRYPT_ENV: production
+#       SECRET_DB_PASSWORD_VERSION: v1
+#       SECRET_DB_ROOT_PASSWORD_VERSION: v1
+#       PHP_UPLOADS_CONF_VERSION: v1
+#       ENTRYPOINT_CONF_VERSION: v1
+#       HTACCESS_CONF_VERSION: v1
+# trigger:
+#   branch:
+#     - main
 ---
 kind: pipeline
 name: generate recipe catalogue
diff --git a/.env.sample b/.env.sample
index 4567330..d74bed7 100644
--- a/.env.sample
+++ b/.env.sample
@@ -1,5 +1,5 @@
 TYPE=wordpress
-TIMEOUT=300
+#TIMEOUT=300
 ENABLE_AUTO_UPDATE=true
 COMPOSE_FILE="compose.yml"
 ENABLE_BACKUPS=true
@@ -28,6 +28,9 @@ LETS_ENCRYPT_ENV=production
 # PHP composer for plugin installation
 #COMPOSE_FILE="$COMPOSE_FILE:compose.composer.yml"
 
+# Self managed Wordpress for automatic updates
+#COMPOSE_FILE="$COMPOSE_FILE:compose.selfmanaged.yml"
+
 #WORDPRESS_DEBUG=true
 
 ## Additional extensions
@@ -81,7 +84,6 @@ SECRET_DB_PASSWORD_VERSION=v1
 # 🚩🚩 dangerous, use only for development sites!
 #CORS_ALLOW_ALL=1
 
-
 # FTP
 #COMPOSE_FILE="$COMPOSE_FILE:compose.ftp.yml"
 #SECRET_FTP_PASS_VERSION=v1
diff --git a/.gitignore b/.gitignore
index 37b52cc..e2e3ed6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,22 @@
+# direnv
 /.envrc
+
+# Environment files (may contain secrets)
+.env
+
+# Logs
+*.log
+
+# OS metadata
+.DS_Store
+Thumbs.db
+
+# Editor/IDE
+*.swp
+*.swo
+*~
+*.bak
+.idea/
+.vscode/
+.project
+.classpath
diff --git a/abra.sh b/abra.sh
index dbd5074..56b78ce 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,8 +1,8 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v7
+export ENTRYPOINT_CONF_VERSION=v9
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v2
+export HTACCESS_CONF_VERSION=v3
 export USERS_CONF_VERSION=v1
 
 wp() {
@@ -31,8 +31,6 @@ core_install(){
     wp "language core install $LOCALE"
     wp "site switch-language $LOCALE"
     wp "rewrite structure '/%year%/%monthnum%/%day%/%postname%/'"
-    wp "plugin install --activate disable-update-notifications"
-    wp "option update disable_notification_setting --format=json '{\"dpun_setting\":false,\"dwtu_setting\":false,\"dwcun_setting\":true}'"
     if [ -n "$DEFAULT_USER_ROLE" ]
     then
         wp "option set default_role $DEFAULT_USER_ROLE"
@@ -40,7 +38,20 @@ core_install(){
         wp "option set default_role subscriber"
     fi
     wp "theme auto-updates enable --all"
-    wp 'plugin auto-updates enable --all' || exit 0
+    wp 'plugin auto-updates enable --all' || true
+}
+
+enable_auto_updates(){
+  wp "plugin deactivate disable-update-notifications --allow-root"
+  wp "plugin uninstall disable-update-notifications --allow-root"
+  wp "option delete disable_notification_setting --allow-root"
+  wp "plugin auto-updates enable --all --allow-root"
+  wp "theme auto-updates enable --all --allow-root"
+}
+
+disable_auto_updates(){
+  wp "plugin install --activate disable-update-notifications"
+  wp "option update disable_notification_setting --format=json '{\"dpun_setting\":false,\"dwtu_setting\":false,\"dwcun_setting\":true}'"
 }
 
 set_authentik(){
@@ -63,6 +74,8 @@ set_authentik(){
         \"endpoint_userinfo\":\"https://$AUTHENTIK_DOMAIN/application/o/userinfo/\",
         \"endpoint_token\":\"https://$AUTHENTIK_DOMAIN/application/o/token/\",
         \"endpoint_end_session\":\"https://$AUTHENTIK_DOMAIN/application/o/wordpress/end-session/\",
+        \"endpoint_jwks\":\"https://$AUTHENTIK_DOMAIN/application/o/wordpress/jwks/\",
+        \"issuer\":\"https://$AUTHENTIK_DOMAIN/application/o/wordpress/\",
         \"acr_values\":\"\",
         \"identity_key\":\"preferred_username\",
         \"no_sslverify\":\"0\",
diff --git a/compose.ftp.yml b/compose.ftp.yml
index 1365923..48d02aa 100644
--- a/compose.ftp.yml
+++ b/compose.ftp.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   ftp:
-    image: atmoz/sftp
+    image: atmoz/sftp:alpine
     secrets:
       - ftp_pass
     volumes:
diff --git a/compose.selfmanaged.yml b/compose.selfmanaged.yml
new file mode 100644
index 0000000..4d7795a
--- /dev/null
+++ b/compose.selfmanaged.yml
@@ -0,0 +1,21 @@
+---
+version: "3.8"
+
+services:
+  app:
+    image: "wordpress:7.0.0"
+    volumes:
+      - "wordpress:/var/www/html/"
+    environment:
+      WORDPRESS_CONFIG_EXTRA: |
+        define( 'AUTOMATIC_UPDATER_DISABLED', false );
+        define( 'WP_AUTO_UPDATE_CORE', true );
+        define( 'FS_METHOD', 'direct' );
+        ${WORDPRESS_CONFIG_EXTRA}
+
+  ftp:
+    volumes:
+      - "wordpress:/home/ftp_user/"
+
+volumes:
+  wordpress:
diff --git a/compose.yml b/compose.yml
index 4e68cb5..ecb579a 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:6.9.0"
+    image: "wordpress:7.0.0"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -48,7 +48,7 @@ services:
         order: start-first
       labels:
         - "traefik.enable=true"
-        - "traefik.docker.network=proxy"
+        - "traefik.swarm.network=proxy"
         - "traefik.http.routers.${STACK_NAME}.tls=true"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
@@ -61,11 +61,11 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
-        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=2.17.0+6.9.0"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
+        - "coop-cloud.${STACK_NAME}.version=3.0.0+7.0.0"
 
   db:
-    image: "mariadb:12.1"
+    image: "mariadb:12.3"
     volumes:
       - "mariadb:/var/lib/mysql"
     networks:
diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
index 035fbf1..6548983 100644
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@@ -42,6 +42,20 @@ define('FORCE_SSL_ADMIN', true );
 define('COOKIE_DOMAIN', \$_SERVER['HTTP_HOST']);"
 {{ end }}
 
+
+UPLOADS_HTACCESS=/var/www/html/wp-content/uploads/.htaccess
+if [ ! -f "$UPLOADS_HTACCESS" ]; then
+    mkdir -p /var/www/html/wp-content/uploads
+    cat > "$UPLOADS_HTACCESS" <<'EOF'
+# Prevent PHP execution in uploads directory
+<FilesMatch "\.(?i:php|phtml|phar)$">
+    Require all denied
+</FilesMatch>
+EOF
+fi
+
+chown -R --from=root:root www-data:www-data /var/www/html/wp-content/
+
 if [ -n "$@" ]; then
 	"$@"
 fi
diff --git a/htaccess.tmpl b/htaccess.tmpl
index 24739f8..a71a625 100644
--- a/htaccess.tmpl
+++ b/htaccess.tmpl
@@ -1,3 +1,8 @@
+# Protect sensitive files from direct access
+<FilesMatch "^(wp-config\.php|\.htaccess|\.htpasswd|readme\.html|license\.txt)$">
+    Require all denied
+</FilesMatch>
+
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress
 
diff --git a/release/2.17.1+6.9.0 b/release/2.17.1+6.9.0
new file mode 100644
index 0000000..e7d8de1
--- /dev/null
+++ b/release/2.17.1+6.9.0
@@ -0,0 +1 @@
+Breaking change for openid plugin: The issuer must be provided, thus the set_authentik function now includes issuer and endpoint_jwks.
\ No newline at end of file
diff --git a/release/3.0.0+7.0.0 b/release/3.0.0+7.0.0
new file mode 100644
index 0000000..780040d
--- /dev/null
+++ b/release/3.0.0+7.0.0
@@ -0,0 +1,6 @@
+- WordPress upgraded from 6.9.4 to 7.0 (major! test before deploying)
+- MariaDB upgraded from 10.x to 11.4 (major! SSL now enabled by default)
+- ENTRYPOINT_CONF_VERSION bumped to v9
+- Breaking: MariaDB 11.4 enables SSL by default — if clients don't support SSL, add --disable-ssl to db command
+- Breaking: WordPress 7.0 introduces new AI features and admin theme changes
+- Backup database and files before upgrading
diff --git a/renovate.json b/renovate.json
index 39a2b6e..5db72dd 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base"
+    "config:recommended"
   ]
 }