diff --git a/Containerfile b/Containerfile
index 08bbc86..8363fac 100644
--- a/Containerfile
+++ b/Containerfile
@@ -6,11 +6,11 @@
 
 ARG BASE_VERSION=15.1
 
-# Pinned upstream release. FileBrowser Quantum ships two parallel lines — a
+# Upstream release tracking. FileBrowser Quantum ships two parallel lines — a
 # v1.5.x-stable line and a v2.0.x-beta line — so a bare "latest release" lookup
-# is NOT safe here. The UPSTREAM_JQ below filters to non-prerelease *-stable tags
-# for drift detection; APP_VERSION is what actually gets built.
-ARG APP_VERSION="v1.5.6-stable"
+# is NOT safe here. The UPSTREAM_JQ below filters to non-prerelease *-stable tags.
+# If APP_VERSION is not provided, the builder stage auto-resolves the latest *-stable release.
+ARG APP_VERSION=""
 ARG UPSTREAM_URL="https://api.github.com/repos/gtsteffaniak/filebrowser/releases"
 ARG UPSTREAM_JQ="[.[] | select(.prerelease == false) | .tag_name | select(endswith(\"-stable\"))][0]"
 
@@ -26,6 +26,8 @@ ARG BUILDER_BASE_VERSION=15.1-latest
 FROM ghcr.io/daemonless/base:${BUILDER_BASE_VERSION} AS builder
 
 ARG APP_VERSION
+ARG UPSTREAM_URL
+ARG UPSTREAM_JQ
 
 # go127 matches backend/go.mod (`go 1.27.0`); node22 matches upstream's
 # `FROM node:jod-slim` (22.x LTS). No C compiler: the build is CGO_ENABLED=0.
@@ -36,8 +38,14 @@ RUN pkg update && \
 
 RUN ln -sf /usr/local/bin/go127 /usr/local/bin/go
 
-# Fetch and extract the pinned source tarball
-RUN fetch -qo /tmp/src.tar.gz \
+# Fetch and extract the source tarball (auto-resolving latest stable release if APP_VERSION not provided)
+RUN if [ -z "${APP_VERSION}" ]; then \
+      APP_VERSION=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${UPSTREAM_JQ}"); \
+    fi && \
+    echo "Building FileBrowser Quantum ${APP_VERSION}" && \
+    echo "${APP_VERSION}" > /tmp/app_version && \
+    echo "${APP_VERSION#v}" > /tmp/version && \
+    fetch -qo /tmp/src.tar.gz \
       "https://github.com/gtsteffaniak/filebrowser/archive/refs/tags/${APP_VERSION}.tar.gz" && \
     mkdir -p /src && \
     tar -C /src -xzf /tmp/src.tar.gz --strip-components 1 && \
@@ -69,6 +77,7 @@ RUN test -n "$(find /src/backend/http/embed -type f -name '*.html' -print -quit)
 WORKDIR /src/backend
 ENV CGO_ENABLED=0
 RUN VERSION_PKG="github.com/gtsteffaniak/filebrowser/backend/common/version" && \
+    APP_VERSION=$(cat /tmp/app_version) && \
     go build -trimpath \
       -ldflags "-w -s -X '${VERSION_PKG}.Version=${APP_VERSION}'" \
       -o /filebrowser-quantum . && \
@@ -97,7 +106,7 @@ LABEL org.opencontainers.image.title="FileBrowser Quantum" \
       org.opencontainers.image.source="https://github.com/daemonless/filebrowser-quantum" \
       org.opencontainers.image.url="https://filebrowserquantum.com" \
       org.opencontainers.image.documentation="https://filebrowserquantum.com/en/docs/" \
-      org.opencontainers.image.version="${APP_VERSION}" \
+      org.opencontainers.image.version="latest" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.vendor="daemonless" \
       org.opencontainers.image.authors="daemonless" \
@@ -131,8 +140,7 @@ RUN mkdir -m 0755 -p /app /config /srv && \
     chmod 0755 /app
 
 COPY --chmod=0755 --chown=bsd:bsd --from=builder /filebrowser-quantum /app/filebrowser-quantum
-RUN echo "${APP_VERSION#v}" > /app/version && \
-    chown bsd:bsd /app/version
+COPY --chmod=0644 --chown=bsd:bsd --from=builder /tmp/version /app/version
 
 # NOTE: deliberately no /app/http/dist on disk.
 # backend/cmd/root.go does os.Stat("http/dist") *relative to the process CWD* and
diff --git a/Containerfile.j2 b/Containerfile.j2
index 478a7d1..a18ecab 100644
--- a/Containerfile.j2
+++ b/Containerfile.j2
@@ -1,10 +1,10 @@
 ARG BASE_VERSION=15.1
 
-# Pinned upstream release. FileBrowser Quantum ships two parallel lines — a
+# Upstream release tracking. FileBrowser Quantum ships two parallel lines — a
 # v1.5.x-stable line and a v2.0.x-beta line — so a bare "latest release" lookup
-# is NOT safe here. The UPSTREAM_JQ below filters to non-prerelease *-stable tags
-# for drift detection; APP_VERSION is what actually gets built.
-ARG APP_VERSION="v1.5.6-stable"
+# is NOT safe here. The UPSTREAM_JQ below filters to non-prerelease *-stable tags.
+# If APP_VERSION is not provided, the builder stage auto-resolves the latest *-stable release.
+ARG APP_VERSION=""
 ARG UPSTREAM_URL="https://api.github.com/repos/gtsteffaniak/filebrowser/releases"
 ARG UPSTREAM_JQ="[.[] | select(.prerelease == false) | .tag_name | select(endswith(\"-stable\"))][0]"
 
@@ -20,6 +20,8 @@ ARG BUILDER_BASE_VERSION=15.1-latest
 FROM ghcr.io/daemonless/base:${BUILDER_BASE_VERSION} AS builder
 
 ARG APP_VERSION
+ARG UPSTREAM_URL
+ARG UPSTREAM_JQ
 
 # go127 matches backend/go.mod (`go 1.27.0`); node22 matches upstream's
 # `FROM node:jod-slim` (22.x LTS). No C compiler: the build is CGO_ENABLED=0.
@@ -30,8 +32,14 @@ RUN pkg update && \
 
 RUN ln -sf /usr/local/bin/go127 /usr/local/bin/go
 
-# Fetch and extract the pinned source tarball
-RUN fetch -qo /tmp/src.tar.gz \
+# Fetch and extract the source tarball (auto-resolving latest stable release if APP_VERSION not provided)
+RUN if [ -z "${APP_VERSION}" ]; then \
+      APP_VERSION=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${UPSTREAM_JQ}"); \
+    fi && \
+    echo "Building FileBrowser Quantum ${APP_VERSION}" && \
+    echo "${APP_VERSION}" > /tmp/app_version && \
+    echo "${APP_VERSION#v}" > /tmp/version && \
+    fetch -qo /tmp/src.tar.gz \
       "https://github.com/gtsteffaniak/filebrowser/archive/refs/tags/${APP_VERSION}.tar.gz" && \
     mkdir -p /src && \
     tar -C /src -xzf /tmp/src.tar.gz --strip-components 1 && \
@@ -63,6 +71,7 @@ RUN test -n "$(find /src/backend/http/embed -type f -name '*.html' -print -quit)
 WORKDIR /src/backend
 ENV CGO_ENABLED=0
 RUN VERSION_PKG="github.com/gtsteffaniak/filebrowser/backend/common/version" && \
+    APP_VERSION=$(cat /tmp/app_version) && \
     go build -trimpath \
       -ldflags "-w -s -X '${VERSION_PKG}.Version=${APP_VERSION}'" \
       -o /filebrowser-quantum . && \
@@ -95,7 +104,7 @@ LABEL org.opencontainers.image.title="{{ title }}" \
       org.opencontainers.image.source="{{ repo_url }}" \
       org.opencontainers.image.url="{{ web_url }}" \
       org.opencontainers.image.documentation="https://filebrowserquantum.com/en/docs/" \
-      org.opencontainers.image.version="${APP_VERSION}" \
+      org.opencontainers.image.version="latest" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.vendor="daemonless" \
       org.opencontainers.image.authors="daemonless" \
@@ -136,8 +145,7 @@ RUN mkdir -m 0755 -p /app /config /srv && \
     chmod 0755 /app
 
 COPY --chmod=0755 --chown=bsd:bsd --from=builder /filebrowser-quantum /app/filebrowser-quantum
-RUN echo "${APP_VERSION#v}" > /app/version && \
-    chown bsd:bsd /app/version
+COPY --chmod=0644 --chown=bsd:bsd --from=builder /tmp/version /app/version
 
 # NOTE: deliberately no /app/http/dist on disk.
 # backend/cmd/root.go does os.Stat("http/dist") *relative to the process CWD* and
diff --git a/README.md b/README.md
index dea7108..514af42 100644
--- a/README.md
+++ b/README.md
@@ -41,8 +41,8 @@ services:
       - TZ=UTC  # Timezone for the container
       - FILEBROWSER_CONFIG=  # Path to config.yaml. Defaults to /config/config.yaml; the container writes a minimal starter there on first boot if absent.
     volumes:
-      - "/path/to/containers/filebrowser-quantum:/config"
-      - "/path/to/containers/filebrowser-quantum/srv:/srv"
+      - "/containers/filebrowser-quantum:/config"
+      - "/containers/filebrowser-quantum/srv:/srv"
     ports:
       - "8080:8080"
     # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
@@ -90,9 +90,9 @@ services:
       - filebrowser-quantum_srv: /srv
 volumes:
   filebrowser-quantum:
-    device: '/path/to/containers/filebrowser-quantum'
+    device: '/containers/filebrowser-quantum'
   filebrowser-quantum_srv:
-    device: '/path/to/containers/filebrowser-quantum/srv'
+    device: '/containers/filebrowser-quantum/srv'
 ```
 
 **Makejail**:
@@ -110,49 +110,6 @@ OPTION from=ghcr.io/daemonless/filebrowser-quantum:${tag}
 Save the files above, then run `appjail-director up`.
 
 
-> [!WARNING]
-> Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.
->
-> To avoid exposing ports, just remove the `expose` option in your `appjail-director.yml` or from your command-line arguments.
-
-### Podman CLI
-
-```bash
-podman run -d --name filebrowser-quantum \
-  -p 8080:8080 \
-  -e PUID=1000 \
-  -e PGID=1000 \
-  -e TZ=UTC \
-  -e FILEBROWSER_CONFIG= \
-  -v /path/to/containers/filebrowser-quantum:/config \
-  -v /path/to/containers/filebrowser-quantum/srv:/srv \
-  ghcr.io/daemonless/filebrowser-quantum:latest
-```
-
-Save as `run.sh`, then run `sh run.sh`.
-
-### AppJail
-
-
-```bash
-appjail oci run -Pd \
-  -o overwrite=force \
-  -o container="args:--pull" \
-  -o virtualnet=":<random> default" \
-  -o nat \
-  -o expose="8080:8080 proto:tcp" \
-  -e PUID=1000 \
-  -e PGID=1000 \
-  -e TZ=UTC \
-  -e FILEBROWSER_CONFIG= \
-  -o fstab="/path/to/containers/filebrowser-quantum /config <pseudofs>" \
-  -o fstab="/path/to/containers/filebrowser-quantum/srv /srv <pseudofs>" \
-  ghcr.io/daemonless/filebrowser-quantum:latest filebrowser-quantum
-```
-
-Save the files above, then run `sh run.sh`.
-
-
 > [!WARNING]
 > Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.
 >
@@ -176,45 +133,11 @@ services:
       - TZ=UTC
       - FILEBROWSER_CONFIG=
     volumes:
-      - "/path/to/containers/filebrowser-quantum:/config"
-      - "/path/to/containers/filebrowser-quantum/srv:/srv"
-```
-
-Save as `bastille-compose.yml`, then run `bastille up`. Or via CLI:
-
-```bash
-bastille create -O \
-  --env PUID=1000 \
-  --env PGID=1000 \
-  --env TZ=UTC \
-  --env FILEBROWSER_CONFIG= \
-  --volume /path/to/containers/filebrowser-quantum /config \
-  --volume /path/to/containers/filebrowser-quantum/srv /srv \
-  filebrowser-quantum ghcr.io/daemonless/filebrowser-quantum:latest inherit
-```
-
-### Ansible
-
-```yaml
-- name: Deploy filebrowser-quantum
-  containers.podman.podman_container:
-    name: filebrowser-quantum
-    image: "ghcr.io/daemonless/filebrowser-quantum:latest"
-    state: started
-    restart_policy: always
-    env:
-      PUID: "1000"
-      PGID: "1000"
-      TZ: "UTC"
-      FILEBROWSER_CONFIG: ""
-    ports:
-      - "8080:8080"
-    volumes:
-      - "/path/to/containers/filebrowser-quantum:/config"
-      - "/path/to/containers/filebrowser-quantum/srv:/srv"
+      - "/containers/filebrowser-quantum:/config"
+      - "/containers/filebrowser-quantum/srv:/srv"
 ```
 
-Save as `filebrowser-quantum-deploy.yaml`, then run `ansible-playbook filebrowser-quantum-deploy.yaml`.
+Save as `bastille-compose.yml`, then run `bastille up`.
 
 Access at: `http://localhost:8080`