diff --git a/containers/stalwart/stalwart.config b/containers/stalwart/stalwart.config
index 32ff555..d876ce5 100644
--- a/containers/stalwart/stalwart.config
+++ b/containers/stalwart/stalwart.config
@@ -6,6 +6,15 @@
 # COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
 # BACKUP = if true, include this application in backup operations
 # UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
+# VERSION = the Stalwart release line this install tracks; drives the image tag.
+#   The two settings do different jobs and are safe together:
+#     UPDATE_TYPE=auto picks up REBUILDS of the version below (security/bug
+#     patches) — snapshot, pull, recreate. Your data volume is untouched;
+#     nothing is reinstalled.
+#     Changing VERSION is how you move BETWEEN releases (v0.16 -> v0.17).
+#   So patches land on their own, while a version jump stays a decision you
+#   make — which matters while Stalwart is pre-1.0 and still settling its
+#   storage schema.
 # HEALTHCHECK = if true, default docker health checks for that container will be enabled
 # AUTHELIA = if true, use Authelia authentication, if false turned off.
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
@@ -17,7 +26,8 @@ CFG_STALWART_BACKUP=true
 # stop-snapshot-start costs seconds of queued delivery (senders retry — that is
 # what SMTP does) and buys a consistent store.
 CFG_STALWART_BACKUP_STRATEGY=stop-snapshot-start
-CFG_STALWART_UPDATE_TYPE=manual
+CFG_STALWART_UPDATE_TYPE=auto
+CFG_STALWART_VERSION=v0.16
 CFG_STALWART_COMPOSE_FILE=default
 CFG_STALWART_HEALTHCHECK=true
 CFG_STALWART_AUTHELIA=false