diff --git a/abra.sh b/abra.sh
index 330b4eb..2fae15c 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,5 +1,5 @@
 export DB_ENTRYPOINT_VERSION=v3
 export PG_BACKUP_VERSION=v2
-export APP_ENTRYPOINT_VERSION=v1
+export APP_ENTRYPOINT_VERSION=v2
 export APP_INSTALL_SSL_VERSION=v1
 export APP_MIGRATE_UPLOADS_VERSION=v1
diff --git a/cc-app-entrypoint.sh b/cc-app-entrypoint.sh
index 02bd5b4..17ab37f 100755
--- a/cc-app-entrypoint.sh
+++ b/cc-app-entrypoint.sh
@@ -1,11 +1,15 @@
 #!/bin/bash
 # Co-op Cloud wrapper around the official image's /sbin/boot.
-# discourse/discourse reads DISCOURSE_DB_PASSWORD from the process env (pups/Ruby;
-# it has no *_FILE support), so inject it from the docker secret before booting.
+# discourse/discourse reads passwords from the process env (pups/Ruby; it has no
+# *_FILE support), so inject them from the docker secrets before booting.
 set -e
 
 if [ -f /run/secrets/db_password ]; then
   export DISCOURSE_DB_PASSWORD="$(cat /run/secrets/db_password)"
 fi
 
+if [ -f /run/secrets/smtp_password ]; then
+  export DISCOURSE_SMTP_PASSWORD="$(cat /run/secrets/smtp_password)"
+fi
+
 exec /sbin/boot
diff --git a/compose.smtpauth.yml b/compose.smtpauth.yml
index f6f92c0..f18470c 100644
--- a/compose.smtpauth.yml
+++ b/compose.smtpauth.yml
@@ -3,8 +3,8 @@ version: "3.8"
 
 services:
   app:
-    environment:
-      - DISCOURSE_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
+    # the wrapper entrypoint reads /run/secrets/smtp_password and exports
+    # DISCOURSE_SMTP_PASSWORD (the official image has no *_FILE support)
     secrets:
       - smtp_password
 
diff --git a/release/1.0.0+3.5.3 b/release/1.0.0+3.5.3
new file mode 100644
index 0000000..26d8514
--- /dev/null
+++ b/release/1.0.0+3.5.3
@@ -0,0 +1,13 @@
+This release switches from the bitnami image to the official discourse/discourse
+image. Some env vars need to be renamed for this migration; everything else
+should happen automatically.
+
+Rename these in your app's .env (the values carry over):
+
+  DISCOURSE_SMTP_HOST     --> DISCOURSE_SMTP_ADDRESS
+  DISCOURSE_SMTP_USER     --> DISCOURSE_SMTP_USER_NAME
+  DISCOURSE_SMTP_AUTH     --> DISCOURSE_SMTP_AUTHENTICATION
+  DISCOURSE_SMTP_PROTOCOL --> DISCOURSE_SMTP_ENABLE_START_TLS
+
+Note: DISCOURSE_SMTP_ENABLE_START_TLS takes a boolean (true/false), not the old
+tls/ssl value, so translate it rather than copying it straight across.