diff --git a/compose.yml b/compose.yml
index d20575c..44d89bc 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: plausible/analytics:v2.0.0
+    image: ghcr.io/plausible/community-edition:v2.1.5
     command: sh -c "sleep 10 && /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
     depends_on:
       - db
@@ -11,6 +11,7 @@ services:
     environment:
       - BASE_URL=https://$DOMAIN
       - SECRET_KEY_BASE
+      - TOTP_VAULT_KEY
       - DATABASE_URL=postgres://plausible:plausible@${STACK_NAME}_db:5432/plausible
       - SMTP_HOST_ADDR
       - MAILER_EMAIL
@@ -32,9 +33,9 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - coop-cloud.${STACK_NAME}.version=3.0.1+v2.0.0
+        - coop-cloud.${STACK_NAME}.version=4.0.0+v2.1.5
   db:
-    image: postgres:13.12
+    image: postgres:16
     configs:
       - source: db_entrypoint
         target: /docker-entrypoint.sh
@@ -59,7 +60,7 @@ services:
         backupbot.restore.post-hook: sh -c 'gzip -d /postgres.dump.gz && pg_restore --clean -U "$$POSTGRES_USER" --dbname="$$PLAUSIBLE_DB" < /postgres.dump && rm -f /postgres.dump'
 
   plausible_events_db:
-    image: clickhouse/clickhouse-server:23.4.2.11-alpine
+    image: clickhouse/clickhouse-server:24.3.3.102-alpine
     volumes:
       - event-data:/var/lib/clickhouse
     entrypoint: /custom-entrypoint.sh
diff --git a/release/4.0.0+v2.1.5 b/release/4.0.0+v2.1.5
new file mode 100644
index 0000000..9b4bb78
--- /dev/null
+++ b/release/4.0.0+v2.1.5
@@ -0,0 +1,19 @@
+⚠ OPERATOR ACTION REQUIRED ⚠
+
+This major version upgrade changes:
+
+1. TOTP_VAULT_KEY is now REQUIRED. Generate with:
+   openssl rand -base64 32
+   Add to your app environment config before deploying.
+
+2. Plausible image moved from Docker Hub (plausible/analytics)
+   to GitHub Container Registry (ghcr.io/plausible/community-edition).
+
+3. PostgreSQL upgraded from 13 → 16 (major version jump).
+   The recipe handles this automatically via pg_upgrade on first boot.
+   Take a volume backup before upgrading!
+
+4. ClickHouse upgraded from 23.4 → 24.3 (data-compatible upgrade).
+
+See upstream upgrade notes:
+https://github.com/plausible/analytics/releases/tag/v2.1.0