diff --git a/containers/pihole/docker-compose.yml b/containers/pihole/docker-compose.yml
index 2cd4586..6e725c5 100755
--- a/containers/pihole/docker-compose.yml
+++ b/containers/pihole/docker-compose.yml
@@ -5,7 +5,7 @@ networks:
 services:
   pihole-service: #LIBREPORTAL|SERVICE_TAG_1|pihole-service
     container_name: pihole-service
-    image: cbcrowe/pihole-unbound:latest #LIBREPORTAL|PIHOLE_VERSION_TAG|latest
+    image: pihole/pihole:latest #LIBREPORTAL|PIHOLE_VERSION_TAG|latest
     restart: unless-stopped
     hostname: pihole
     # GLUETUN_OFF_BEGIN
@@ -28,24 +28,33 @@ services:
       traefik.http.services.pihole-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
       traefik.http.routers.pihole-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
       # TRAEFIK_PORT_1_END
+    # Pi-hole v6 replaced almost every v5 variable with an FTLCONF_ equivalent
+    # matching its new TOML config. The old names are accepted by the container
+    # and then ignored, so a v5-style block looks fine and silently configures
+    # nothing — including the admin password.
     environment:
-      - FTLCONF_LOCAL_IPV4=PUBLIC_IP_DATA #LIBREPORTAL|PUBLIC_IP_TAG|PUBLIC_IP_DATA
       - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
-      - WEBPASSWORD=PIHOLE_ADMIN_PASSWORD_DATA #LIBREPORTAL|PIHOLE_ADMIN_PASSWORD_TAG|PIHOLE_ADMIN_PASSWORD_DATA
-      - WEBTHEME=PIHOLE_WEB_THEME_DATA #LIBREPORTAL|PIHOLE_WEB_THEME_TAG|PIHOLE_WEB_THEME_DATA
-      - REV_SERVER=true
-      - REV_SERVER_TARGET=PIHOLE_REV_SERVER_TARGET_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_TARGET_TAG|PIHOLE_REV_SERVER_TARGET_DATA
-      - REV_SERVER_DOMAIN=local
-      - REV_SERVER_CIDR=PIHOLE_REV_SERVER_CIDR_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_CIDR_TAG|PIHOLE_REV_SERVER_CIDR_DATA
-      - PIHOLE_DNS_=127.0.0.1#PORT_INTERNAL_DATA_5 #LIBREPORTAL|PORT_INTERNAL_TAG_5|PORT_INTERNAL_DATA_5
-      - DNSSEC="true"
-      - DNSMASQ_LISTENING=single
+      - FTLCONF_webserver_api_password=PIHOLE_ADMIN_PASSWORD_DATA #LIBREPORTAL|PIHOLE_ADMIN_PASSWORD_TAG|PIHOLE_ADMIN_PASSWORD_DATA
+      - FTLCONF_webserver_interface_theme=PIHOLE_WEB_THEME_DATA #LIBREPORTAL|PIHOLE_WEB_THEME_TAG|PIHOLE_WEB_THEME_DATA
+      # Upstream resolver. The old image bundled unbound and pointed here at
+      # 127.0.0.1#5335; the official image bundles nothing, so this must be a
+      # real resolver. Set it to the unbound app's address for full recursion
+      # (no third party sees your queries) — see PIHOLE_UPSTREAM_DNS in the config.
+      - FTLCONF_dns_upstreams=PIHOLE_UPSTREAM_DNS_DATA #LIBREPORTAL|PIHOLE_UPSTREAM_DNS_TAG|PIHOLE_UPSTREAM_DNS_DATA
+      - FTLCONF_dns_dnssec=true
+      # ALL, not single: in a bridge network the queries arrive from the docker
+      # gateway rather than the container's own interface, and "single" drops them.
+      - FTLCONF_dns_listeningMode=ALL
+      # One combined value in v6: <enabled>,<cidr>,<target>,<domain>
+      - FTLCONF_dns_revServers=true,PIHOLE_REV_SERVER_CIDR_DATA,PIHOLE_REV_SERVER_TARGET_DATA,local #LIBREPORTAL|PIHOLE_REV_SERVER_CIDR_TAG|PIHOLE_REV_SERVER_CIDR_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_TARGET_TAG|PIHOLE_REV_SERVER_TARGET_DATA
     healthcheck:
       disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
     volumes:
       - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
-      - "./pihole-dnsmasq-unbound:/etc/pihole:rw"
-      - "./pihole-unbound:/etc/dnsmasq:rw"
+      # v6 keeps everything (config, databases, gravity) under /etc/pihole. The
+      # old /etc/dnsmasq mount belonged to the bundled-unbound image and is no
+      # longer read — v6 ignores /etc/dnsmasq.d unless explicitly re-enabled.
+      - "./etc-pihole:/etc/pihole:rw"
     # GLUETUN_OFF_BEGIN
     networks:
       DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
diff --git a/containers/pihole/pihole.config b/containers/pihole/pihole.config
index 62bf8f0..092e569 100755
--- a/containers/pihole/pihole.config
+++ b/containers/pihole/pihole.config
@@ -29,6 +29,7 @@ CFG_PIHOLE_MONITORING=false
 #
 CFG_PIHOLE_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1
 CFG_PIHOLE_WEB_THEME=default-dark
+CFG_PIHOLE_UPSTREAM_DNS=9.9.9.9;149.112.112.112
 #
 # =============================================================================
 # METADATA
@@ -75,5 +76,5 @@ CFG_PIHOLE_PORT_1="pihole-service|webui|random:80|private|tcp|false|false|true|A
 CFG_PIHOLE_PORT_2="pihole-service|dns-tcp|53:53|private|tcp|false|false|false|DNS Server (TCP)|"
 CFG_PIHOLE_PORT_3="pihole-service|dns-udp|53:53|private|udp|false|false|false|DNS Server (UDP)|"
 CFG_PIHOLE_PORT_4="pihole-service|https|random:443|disabled|tcp|false|false|false|HTTPS Interface|"
-CFG_PIHOLE_PORT_5="pihole-service|unbound|random:5335|private|tcp|false|false|false|Unbound DNS Access|"
+CFG_PIHOLE_PORT_5="pihole-service|dhcp|67:67|disabled|udp|false|false|false|DHCP Server (enable to let Pi-hole hand out leases)|"
 CFG_PIHOLE_PORT_6="pihole-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"