diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config
index 8a8d885..b3d17f5 100644
--- a/containers/rocketchat/rocketchat.config
+++ b/containers/rocketchat/rocketchat.config
@@ -14,10 +14,14 @@
 CFG_ROCKETCHAT_APP_NAME=rocketchat
 CFG_ROCKETCHAT_BACKUP=true
 CFG_ROCKETCHAT_BACKUP_STRATEGY=auto
-# Manual, not auto. Rocket.Chat runs schema migrations on boot and refuses to
-# start if the image is more than one major behind the database — an unattended
-# jump across majors can leave the instance down until someone intervenes.
-CFG_ROCKETCHAT_UPDATE_TYPE=manual
+# Auto. Rocket.Chat does run schema migrations on boot and does refuse to start
+# too far behind its database — but an automatic update cannot put it there.
+# Auto only ever applies a REBUILD of the tag already tracked (8.7.0, mongo 8.0);
+# crossing a version line is the stepped Upgrade, which stays a deliberate act.
+# So the majors-jump this once guarded against is not reachable from here, while
+# staying manual meant the app never picked up security rebuilds of its own
+# version — the thing auto exists for.
+CFG_ROCKETCHAT_UPDATE_TYPE=auto
 CFG_ROCKETCHAT_COMPOSE_FILE=default
 CFG_ROCKETCHAT_HEALTHCHECK=true
 # Rocket.Chat's own accounts back its mobile and desktop clients; forward-auth
diff --git a/containers/stoat/stoat.config b/containers/stoat/stoat.config
index 3082eb5..3b65d4b 100644
--- a/containers/stoat/stoat.config
+++ b/containers/stoat/stoat.config
@@ -23,11 +23,14 @@ CFG_STOAT_APP_NAME=stoat
 CFG_STOAT_REQUIRES=""
 CFG_STOAT_BACKUP=true
 CFG_STOAT_BACKUP_STRATEGY=auto
-# Manual, deliberately. This is a sixteen-service stack whose components are
-# released together and expect matching versions; letting them roll forward
-# unattended and independently is how you end up with an API talking to an
-# incompatible events service.
-CFG_STOAT_UPDATE_TYPE=manual
+# Auto. The components of this stack are released together and do expect
+# matching versions — which is exactly why they are all pinned to the same tag
+# (api, events, file-server, proxy, gifbox, crond, pushd, voice-ingress all on
+# one STOAT_*_VERSION_TAG). An automatic update pulls rebuilds of those pinned
+# tags, so the services move together or not at all; they cannot drift apart on
+# their own. Moving the stack to a new release line is the stepped Upgrade and
+# remains a deliberate act.
+CFG_STOAT_UPDATE_TYPE=auto
 CFG_STOAT_COMPOSE_FILE=default
 CFG_STOAT_HEALTHCHECK=true
 # Stoat's own accounts back its clients, and /api must stay reachable without a