diff --git a/.drone.yml b/.drone.yml
index 97969b8..08029de 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,30 +1,30 @@
----
-kind: pipeline
-name: deploy to swarm-test.autonomic.zone
-steps:
-  - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
-    settings:
-      host: swarm-test.autonomic.zone
-      stack: wordpress
-      generate_secrets: true
-      purge: true
-      deploy_key:
-        from_secret: drone_ssh_swarm_test
-      networks:
-        - proxy
-    environment:
-      DOMAIN: wordpress.swarm-test.autonomic.zone
-      STACK_NAME: wordpress
-      LETS_ENCRYPT_ENV: production
-      SECRET_DB_PASSWORD_VERSION: v1
-      SECRET_DB_ROOT_PASSWORD_VERSION: v1
-      PHP_UPLOADS_CONF_VERSION: v1
-      ENTRYPOINT_CONF_VERSION: v1
-      HTACCESS_CONF_VERSION: v1
-trigger:
-  branch:
-    - main
+# ---
+# kind: pipeline
+# name: deploy to swarm-test.autonomic.zone
+# steps:
+#   - name: deployment
+#     image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+#     settings:
+#       host: swarm-test.autonomic.zone
+#       stack: wordpress
+#       generate_secrets: true
+#       purge: true
+#       deploy_key:
+#         from_secret: drone_ssh_swarm_test
+#       networks:
+#         - proxy
+#     environment:
+#       DOMAIN: wordpress.swarm-test.autonomic.zone
+#       STACK_NAME: wordpress
+#       LETS_ENCRYPT_ENV: production
+#       SECRET_DB_PASSWORD_VERSION: v1
+#       SECRET_DB_ROOT_PASSWORD_VERSION: v1
+#       PHP_UPLOADS_CONF_VERSION: v1
+#       ENTRYPOINT_CONF_VERSION: v1
+#       HTACCESS_CONF_VERSION: v1
+# trigger:
+#   branch:
+#     - main
 ---
 kind: pipeline
 name: generate recipe catalogue
diff --git a/abra.sh b/abra.sh
index d087fa6..0b6a275 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,5 +1,5 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v8
+export ENTRYPOINT_CONF_VERSION=v9
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
 export HTACCESS_CONF_VERSION=v3
diff --git a/compose.selfmanaged.yml b/compose.selfmanaged.yml
index 100308c..4d7795a 100644
--- a/compose.selfmanaged.yml
+++ b/compose.selfmanaged.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:latest"
+    image: "wordpress:7.0.0"
     volumes:
       - "wordpress:/var/www/html/"
     environment:
diff --git a/compose.yml b/compose.yml
index 0fdfb5c..ecb579a 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:6.9.4"
+    image: "wordpress:7.0.0"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -62,10 +62,10 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=2.19.2+6.9.4"
+        - "coop-cloud.${STACK_NAME}.version=3.0.0+7.0.0"
 
   db:
-    image: "mariadb:12.2"
+    image: "mariadb:12.3"
     volumes:
       - "mariadb:/var/lib/mysql"
     networks:
diff --git a/release/3.0.0+7.0.0 b/release/3.0.0+7.0.0
new file mode 100644
index 0000000..780040d
--- /dev/null
+++ b/release/3.0.0+7.0.0
@@ -0,0 +1,6 @@
+- WordPress upgraded from 6.9.4 to 7.0 (major! test before deploying)
+- MariaDB upgraded from 10.x to 11.4 (major! SSL now enabled by default)
+- ENTRYPOINT_CONF_VERSION bumped to v9
+- Breaking: MariaDB 11.4 enables SSL by default — if clients don't support SSL, add --disable-ssl to db command
+- Breaking: WordPress 7.0 introduces new AI features and admin theme changes
+- Backup database and files before upgrading