diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 8573ae9..d58a54f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
     if: ${{ vars.BUILD_ON != 'github' }}
     runs-on: light
     container:
-      image: golang:1.26-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c # 1.26-bookworm
+      image: golang:1.26-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af # 1.26-bookworm
     steps:
       - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
       - run: go vet ./...
@@ -59,7 +59,7 @@ jobs:
     needs: [test]
     runs-on: light
     container:
-      image: golang:1.26-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c # 1.26-bookworm
+      image: golang:1.26-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af # 1.26-bookworm
     steps:
       # Full history: the ancestry check below cannot be answered from a
       # shallow clone. The checkout also fetches every branch as origin/*.
@@ -125,7 +125,7 @@ jobs:
     runs-on: wait
     timeout-minutes: 150
     container:
-      image: golang:1.26-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c # 1.26-bookworm
+      image: golang:1.26-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af # 1.26-bookworm
     steps:
       - shell: bash
         env:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b2f1b17..aabc37b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -81,8 +81,9 @@ generally means newer tested versions of those.
 
 ihasmail is the exception: a deploy takes its newest release, so a new
 ihasmail needs no new release of this tool. What keeps that safe is the
-end-to-end test, which runs every Monday against ihasmail's newest release, a
-few hours after ihasmail publishes it. Stalwart is never taken this way — an
+end-to-end test, run by hand against ihasmail's newest release after ihasmail
+publishes it (the `e2e` job in `.github/workflows/ci.yml`, on a GitHub runner,
+because it needs a throwaway VM). Stalwart is never taken this way — an
 upgrade migrates its data with no way back, so its version only changes in a
 release of this tool.
 
diff --git a/README.md b/README.md
index 43d98ce..a296475 100644
--- a/README.md
+++ b/README.md
@@ -92,9 +92,23 @@ flows.
 Releases are tagged by date (`v2026.9.15`). Each pins the Stalwart and Caddy
 versions it was tested with. ihasmail is the newest release at deploy time,
 written into `compose.yaml` by its dated tag, and checked by an end-to-end test
-every Monday. Nothing upgrades by itself afterwards. Details in
+run by hand after ihasmail's weekly release. Nothing upgrades by itself afterwards. Details in
 [CONTRIBUTING.md](CONTRIBUTING.md#versions-and-releases).
 
+## Support
+
+| Stalwart | Status |
+| --- | --- |
+| 0.16.27 | Supported, and the default |
+| Other 0.16 releases | Not tested. `--stalwart-image` takes them, at your own risk |
+| 1.0 | Not supported. Its first-run setup changed, and this tool sets up 0.16 only |
+
+The tool gets bug and security fixes. ihasmail itself supports Stalwart
+0.16.27 and 1.0, so a server this tool deploys can be moved to 1.0 later with
+Stalwart's own upgrade tool. If a Stalwart release would need more
+than a bug fix here, the default stays on the last version that works, and
+this table says so.
+
 ## Security
 
 To report a vulnerability, see [SECURITY.md](SECURITY.md). Please don't open a
diff --git a/docs/reference.md b/docs/reference.md
index fc139d2..e856e63 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -81,7 +81,7 @@ ihasmail-oneshot deploy --local [flags]
 | `--user NAME` | none | Create a mailbox `NAME@DOMAIN` with a generated password. Repeat for more |
 | `--dir` | `./PROJECT` | Deployment directory to write. Must be new or empty |
 | `--project` | `ihasmail-DOMAIN` (dots as dashes) | Compose project name, which prefixes containers, network and volumes |
-| `--stalwart-image` | `stalwartlabs/stalwart:v0.16.22` | Stalwart image |
+| `--stalwart-image` | `stalwartlabs/stalwart:v0.16.27` | Stalwart image |
 | `--ihasmail-image` | the newest release | ihasmail image. By default the tool looks up ihasmail's newest release and writes it into `compose.yaml` by its dated tag; name an image to use a particular one |
 | `--caddy-image` | `caddy:2.11.4` | Caddy image |
 | `--webmail-bind` | `127.0.0.1:8080` | Host address for ihasmail's own port, for reaching it without Caddy |
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index d25442c..6d8dda3 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -85,5 +85,6 @@ address, or the webmail name not resolving from the host.
 - **Push by subscription isn't covered by the end-to-end test**, whose lab has no
   public DNS for Stalwart to resolve the webmail's name through. Its fallback,
   the relay, is what the test exercises.
-- Validated against **Stalwart 0.16.22**. Other Stalwart versions may change the
-  registry objects the setup uses.
+- Deploys **Stalwart 0.16.27** by default. The setup steps were worked out on
+  0.16.22. Stalwart 1.0 isn't supported: its first-run setup changed. Other
+  versions may change the registry objects the setup uses.
diff --git a/go.mod b/go.mod
index 527408b..132148c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module github.com/Coffey-Labs/ihasmail-oneshot
 
-go 1.26.9
+go 1.26.10
diff --git a/internal/config/config.go b/internal/config/config.go
index 174721c..2a3db59 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -34,7 +34,7 @@ import (
 // deploy.ResolveIhasmail -- so what a deployment runs is still recorded and
 // nothing moves it afterwards.
 const (
-	DefaultStalwartImage = "stalwartlabs/stalwart:v0.16.22"
+	DefaultStalwartImage = "stalwartlabs/stalwart:v0.16.27"
 	DefaultCaddyImage    = "caddy:2.11.4"
 
 	IhasmailRepository = "registry.coffeylabs.org/coffey-labs/ihasmail"