diff --git a/.github/workflows/test-install.yaml b/.github/workflows/test-install.yaml
index af50aec..705b51a 100644
--- a/.github/workflows/test-install.yaml
+++ b/.github/workflows/test-install.yaml
@@ -57,7 +57,7 @@ jobs:
           # and Appwrite's data migration.
           - scenario: default
             kubernetes: v1.37.0
-            upgrade-from: 2.0.0
+            upgrade-from: 2.1.0
           # PostgreSQL, Redis and ClickHouse outside the release.
           - scenario: external-dbs
             kubernetes: v1.37.0
@@ -108,7 +108,7 @@ jobs:
         # instead of as a 15-minute install timeout.
         run: |
           # shellcheck disable=SC2016 # expanded inside the pod
-          kubectl -n appwrite run dns-check --rm -i --restart=Never --image=docker.io/appwrite/appwrite:2.6.1 --command -- sh -c '
+          kubectl -n appwrite run dns-check --rm -i --restart=Never --image=docker.io/appwrite/appwrite:2.6.2 --command -- sh -c '
             cat /etc/resolv.conf
             ok=0
             for host in postgres.external-dbs.svc.cluster.local postgres.external-dbs.svc postgres.external-dbs; do
diff --git a/.github/workflows/upstream-drift.yaml b/.github/workflows/upstream-drift.yaml
index aa1d5f8..3775466 100644
--- a/.github/workflows/upstream-drift.yaml
+++ b/.github/workflows/upstream-drift.yaml
@@ -23,6 +23,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      # gcrunner images ship without PHP, which `make env-defaults` runs.
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: "8.4"
+          tools: none
+          coverage: none
       - name: Compare with the latest Appwrite release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb14f82..74f036b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,14 +10,42 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ### Security
 
-- Update the Console image to 1.2.106-self-hosted, which patches DOMPurify
-  to 3.4.17 for GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr.
+- Appwrite 2.6.2, a security release: its base image patches Brotli for
+  CVE-2026-111497, and it tightens API keys, realtime, GraphQL, storage,
+  VCS and outbound requests ([release notes](https://github.com/appwrite/appwrite/releases/tag/2.6.2)).
+  No schema change: the data migration is 2.6.1's.
+- Update the Console image to 1.2.108-self-hosted, the one Appwrite 2.6.2
+  ships, which patches DOMPurify to 3.4.17 for GHSA-cg2g-xh64-v4q7 and
+  GHSA-mrv2-3pqr-j5jr.
 - Update the images whose base layers the nightly Trivy scan flags to their
   newest patch releases: Redis 7.4.12-alpine, redis_exporter v1.96.0-alpine,
   SeaweedFS 4.51 and Docker 29.9.2-dind.
 
+### Changed
+
+- The browser 0.3.8 and ExifTool 0.1.1 images, as in Appwrite 2.6.2's
+  `docker-compose.yml`.
+- `_APP_MEMORY_LIMIT`, new in Appwrite 2.6.2, sets the PHP memory limit of
+  every Appwrite process (512M, as before). Raise it, with realtime's memory
+  limit, for a realtime that holds thousands of connections ([production.md](docs/production.md#capacity)).
+- Project SMTP, messaging SMTP providers and migration sources on a private
+  or reserved address need it in `_APP_ALLOWED_INTERNAL_ADDRESSES` from
+  Appwrite 2.6.2 on ([networking.md](docs/networking.md#requests-to-private-addresses)).
+  The chart's own `smtp` settings aren't affected.
+- The console offers Entire as a Git provider ([integrations.md](docs/integrations.md#entire)).
+- CI upgrades from the published chart 2.1.0 with default values.
+
+### Added
+
+- The render fails when `compute.secrets.orchestratorSecret` is Appwrite's
+  placeholder `your-secret-key`, which Appwrite 2.6.2 refuses for job
+  callbacks, unless `compute.secrets.existingSecret` supplies the secret
+  instead. An empty value, the default, still generates a random secret.
+
 ### Fixed
 
+- The weekly upstream drift check installs PHP, which the gcrunner image
+  lacks: it found Appwrite 2.6.2 but failed before opening an issue.
 - `make update-images` writes quoted tags such as SeaweedFS's `"4.48"`
   (it reported the bump but left the file unchanged) and runs on macOS's
   bash 3.2, where an anonymous registry pull failed on an unbound variable.
diff --git a/README.md b/README.md
index 20bc157..3d37dde 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ to production, swap each of those for a managed service, one at a time.
 
 | | |
 | --- | --- |
-| Appwrite | 2.6.1 |
+| Appwrite | 2.6.2 |
 | Kubernetes | 1.29 or later |
 | Helm | 4, or 3.18 or later |
 | Chart | `oci://ghcr.io/appwrite/charts/appwrite` |
diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml
index 3ac9a08..80f6dac 100644
--- a/charts/appwrite/Chart.yaml
+++ b/charts/appwrite/Chart.yaml
@@ -3,10 +3,10 @@ name: appwrite
 description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 type: application
 version: 2.1.0
-appVersion: "2.6.1"
+appVersion: "2.6.2"
 kubeVersion: ">=1.29.0-0"
 home: https://github.com/appwrite/helm-chart
-icon: https://raw.githubusercontent.com/appwrite/appwrite/2.6.1/public/images/logos/appwrite-icon.svg
+icon: https://raw.githubusercontent.com/appwrite/appwrite/2.6.2/public/images/logos/appwrite-icon.svg
 sources:
   - https://github.com/appwrite/helm-chart
   - https://github.com/appwrite/appwrite
@@ -73,11 +73,11 @@ annotations:
       description: Troubleshooting for site deployments whose screenshot fails.
   artifacthub.io/images: |
     - name: appwrite
-      image: docker.io/appwrite/appwrite:2.6.1
+      image: docker.io/appwrite/appwrite:2.6.2
     - name: autogravity
       image: ghcr.io/appwrite/autogravity:0.0.11
     - name: browser
-      image: docker.io/appwrite/browser:0.3.6
+      image: docker.io/appwrite/browser:0.3.8
     - name: builds
       image: ghcr.io/open-runtimes/orchestrator/job-sidecar:2.2.4
     - name: builtin
@@ -93,7 +93,7 @@ annotations:
     - name: builtin-exporter
       image: docker.io/oliver006/redis_exporter:v1.96.0-alpine
     - name: console
-      image: docker.io/appwrite/new:1.2.106-self-hosted
+      image: docker.io/appwrite/new:1.2.108-self-hosted
     - name: dind
       image: docker.io/library/docker:29.9.2-dind
     - name: embedding
@@ -101,7 +101,7 @@ annotations:
     - name: executor
       image: docker.io/openruntimes/executor:1.1.2
     - name: exiftool
-      image: ghcr.io/appwrite/exiftool:0.1.0
+      image: ghcr.io/appwrite/exiftool:0.1.1
     - name: geo
       image: docker.io/appwrite/geo:0.3.2
     - name: orchestrator
diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md
index 241b4cf..a149610 100644
--- a/charts/appwrite/README.md
+++ b/charts/appwrite/README.md
@@ -1,6 +1,6 @@
 # Appwrite Helm chart
 
-![Version: 2.1.0](https://img.shields.io/badge/Version-2.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.6.1](https://img.shields.io/badge/AppVersion-2.6.1-informational?style=flat-square)
+![Version: 2.1.0](https://img.shields.io/badge/Version-2.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.6.2](https://img.shields.io/badge/AppVersion-2.6.2-informational?style=flat-square)
 
 Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 
@@ -168,7 +168,7 @@ See the [architecture guide](https://github.com/appwrite/helm-chart/blob/main/do
 - **Highly available datastores.** The built-in ones are single replicas. Use
   managed services or operators in production
   ([guide](https://github.com/appwrite/helm-chart/blob/main/docs/external-databases.md)).
-- **Metrics.** Appwrite 2.6.1 exposes no Prometheus metrics.
+- **Metrics.** Appwrite 2.6.2 exposes no Prometheus metrics.
 
 ## Documentation
 
@@ -595,7 +595,7 @@ The SMTP server Appwrite sends mail through.
 | console.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | console.image.registry | string | `"docker.io"` | Image registry. |
 | console.image.repository | string | `"appwrite/new"` | Image repository. |
-| console.image.tag | string | `"1.2.106-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. |
+| console.image.tag | string | `"1.2.108-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. |
 | console.livenessProbe.enabled | bool | `true` | Enable the liveness probe. |
 | console.livenessProbe.failureThreshold | int | `3` | Consecutive failures before the probe counts as failed. |
 | console.livenessProbe.periodSeconds | int | `20` | Seconds between probes. |
@@ -980,7 +980,7 @@ The build orchestrator and the executor.
 | browser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | browser.image.registry | string | `"docker.io"` | Image registry. |
 | browser.image.repository | string | `"appwrite/browser"` | Image repository. |
-| browser.image.tag | string | `"0.3.6"` | Image tag. |
+| browser.image.tag | string | `"0.3.8"` | Image tag. |
 | browser.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. |
 | browser.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. |
 | browser.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. |
@@ -1130,7 +1130,7 @@ Image, security contexts, scheduling defaults, names, labels and extra objects.
 | exiftool.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | exiftool.image.registry | string | `"ghcr.io"` | Image registry. |
 | exiftool.image.repository | string | `"appwrite/exiftool"` | Image repository. |
-| exiftool.image.tag | string | `"0.1.0"` | Image tag. |
+| exiftool.image.tag | string | `"0.1.1"` | Image tag. |
 | exiftool.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. |
 | exiftool.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. |
 | exiftool.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. |
diff --git a/charts/appwrite/README.md.gotmpl b/charts/appwrite/README.md.gotmpl
index f658775..40226b8 100644
--- a/charts/appwrite/README.md.gotmpl
+++ b/charts/appwrite/README.md.gotmpl
@@ -168,7 +168,7 @@ See the [architecture guide](https://github.com/appwrite/helm-chart/blob/main/do
 - **Highly available datastores.** The built-in ones are single replicas. Use
   managed services or operators in production
   ([guide](https://github.com/appwrite/helm-chart/blob/main/docs/external-databases.md)).
-- **Metrics.** Appwrite 2.6.1 exposes no Prometheus metrics.
+- **Metrics.** Appwrite 2.6.2 exposes no Prometheus metrics.
 
 ## Documentation
 
diff --git a/charts/appwrite/files/env-defaults.yaml b/charts/appwrite/files/env-defaults.yaml
index fe57505..f57057c 100644
--- a/charts/appwrite/files/env-defaults.yaml
+++ b/charts/appwrite/files/env-defaults.yaml
@@ -1,4 +1,4 @@
-# Generated by hack/gen-env-defaults.php from Appwrite 2.6.1
+# Generated by hack/gen-env-defaults.php from Appwrite 2.6.2
 # app/config/variables.php. Do not edit by hand; run `make env-defaults`.
 #
 # These are the defaults the Appwrite Docker installer writes to .env.
@@ -45,6 +45,7 @@ _APP_EMAIL_SECURITY: ""
 _APP_EMAIL_CERTIFICATES: ""
 _APP_LOGGING_FORMAT: "pretty"
 _APP_WORKER_PER_CORE: "6"
+_APP_MEMORY_LIMIT: "512M"
 _APP_CONSOLE_SESSION_ALERTS: "disabled"
 _APP_COMPRESSION_ENABLED: "enabled"
 _APP_COMPRESSION_MIN_SIZE_BYTES: "1024"
diff --git a/charts/appwrite/templates/_validate.tpl b/charts/appwrite/templates/_validate.tpl
index 31fa998..fda812e 100644
--- a/charts/appwrite/templates/_validate.tpl
+++ b/charts/appwrite/templates/_validate.tpl
@@ -121,6 +121,9 @@ configmap-env.yaml so it also runs under `helm template`.
 {{- if and (not $e.existingSecret) (or $v.compute.secrets.existingSecret $storage.s3.accessKeyId.secretName $storage.s3.secretAccessKey.secretName) }}
 {{- $errors = append $errors "compute.executor.existingSecret is required when compute.secrets.existingSecret or an S3 secretName (storage.s3.accessKeyId, storage.s3.secretAccessKey) is set: the executor runs in another namespace and can't read them. Create a Secret there with the keys executor-secret, s3-access-key and s3-secret-key." }}
 {{- end }}
+{{- if and (not $v.compute.secrets.existingSecret) (eq $v.compute.secrets.orchestratorSecret "your-secret-key") }}
+{{- $errors = append $errors "compute.secrets.orchestratorSecret is Appwrite's public placeholder, which Appwrite 2.6.2 refuses for job callbacks, so every build would fail. Leave it empty for the chart to generate one, or set a random value." }}
+{{- end }}
 {{- if ne $storage.device "s3" }}
 {{- $errors = append $errors "compute.enabled needs storage.device=s3: builds and the executor exchange code and build output through object storage. Keep the default (s3, with the built-in object store), or set compute.enabled=false to store files on the local volume without Functions and Sites." }}
 {{- end }}
diff --git a/charts/appwrite/tests/executor_test.yaml b/charts/appwrite/tests/executor_test.yaml
index a22684a..53653d1 100644
--- a/charts/appwrite/tests/executor_test.yaml
+++ b/charts/appwrite/tests/executor_test.yaml
@@ -70,6 +70,23 @@ tests:
       - failedTemplate:
           errorPattern: compute.executor.namespace must differ from compute.builds.namespace
 
+  - it: refuses Appwrite's placeholder orchestrator secret
+    template: templates/configmap-env.yaml
+    set:
+      compute.secrets.orchestratorSecret: your-secret-key
+    asserts:
+      - failedTemplate:
+          errorPattern: compute.secrets.orchestratorSecret is Appwrite's public placeholder
+
+  - it: ignores the placeholder when the secrets come from an existing Secret
+    template: templates/configmap-env.yaml
+    set:
+      compute.secrets.orchestratorSecret: your-secret-key
+      compute.secrets.existingSecret: compute
+      compute.executor.existingSecret: executor
+    asserts:
+      - notFailedTemplate: {}
+
   - it: needs its own Secret when credentials come from existing Secrets
     template: templates/configmap-env.yaml
     set:
diff --git a/charts/appwrite/tests/migrations_test.yaml b/charts/appwrite/tests/migrations_test.yaml
index 8899de5..3179f80 100644
--- a/charts/appwrite/tests/migrations_test.yaml
+++ b/charts/appwrite/tests/migrations_test.yaml
@@ -19,7 +19,7 @@ tests:
     asserts:
       - equal:
           path: metadata.annotations["appwrite/version"]
-          value: "2.6.1"
+          value: "2.6.2"
 
   - it: doesn't migrate on install
     templates:
@@ -80,7 +80,7 @@ tests:
             name: aw-appwrite-api
             namespace: appwrite
             annotations:
-              appwrite/version: 2.6.1
+              appwrite/version: 2.6.2
     asserts:
       - hasDocuments:
           count: 0
@@ -102,7 +102,7 @@ tests:
               appwrite/version: 2.7.0
     asserts:
       - failedTemplate:
-          errorPattern: Appwrite 2.7.0 is installed and this would downgrade it to 2.6.1
+          errorPattern: Appwrite 2.7.0 is installed and this would downgrade it to 2.6.2
 
   - it: retries a hook migration that failed
     template: templates/hooks/migrate-hook.yaml
@@ -123,7 +123,7 @@ tests:
             name: aw-appwrite-api
             namespace: appwrite
             annotations:
-              appwrite/version: 2.6.1
+              appwrite/version: 2.6.2
         - kind: Job
           apiVersion: batch/v1
           metadata:
@@ -140,11 +140,11 @@ tests:
     asserts:
       - matchRegex:
           path: metadata.name
-          pattern: ^aw-appwrite-migrate-2-6-1-[0-9a-f]{8}$
+          pattern: ^aw-appwrite-migrate-2-6-2-[0-9a-f]{8}$
       # Pinned so the rename test below compares against this exact render.
       - equal:
           path: metadata.name
-          value: aw-appwrite-migrate-2-6-1-8673ad3d
+          value: aw-appwrite-migrate-2-6-2-8c12e5e9
       - notExists:
           path: metadata.annotations["helm.sh/hook"]
       - notExists:
@@ -158,10 +158,10 @@ tests:
     asserts:
       - notEqual:
           path: metadata.name
-          value: aw-appwrite-migrate-2-6-1-8673ad3d
+          value: aw-appwrite-migrate-2-6-2-8c12e5e9
       - matchRegex:
           path: metadata.name
-          pattern: ^aw-appwrite-migrate-2-6-1-[0-9a-f]{8}$
+          pattern: ^aw-appwrite-migrate-2-6-2-[0-9a-f]{8}$
 
   - it: renders nothing in none mode
     templates:
diff --git a/charts/appwrite/tests/serviceaccount_test.yaml b/charts/appwrite/tests/serviceaccount_test.yaml
index 2721184..153b57b 100644
--- a/charts/appwrite/tests/serviceaccount_test.yaml
+++ b/charts/appwrite/tests/serviceaccount_test.yaml
@@ -28,7 +28,7 @@ tests:
             app.kubernetes.io/instance: my-release
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/part-of: appwrite
-            app.kubernetes.io/version: "2.6.1"
+            app.kubernetes.io/version: "2.6.2"
       - matchRegex:
           path: metadata.labels["helm.sh/chart"]
           pattern: ^appwrite-\d+\.\d+\.\d+
diff --git a/charts/appwrite/values.yaml b/charts/appwrite/values.yaml
index e83badd..126fcdf 100644
--- a/charts/appwrite/values.yaml
+++ b/charts/appwrite/values.yaml
@@ -428,7 +428,7 @@ vectorsDb:
 
 # Redis, for queues, cache, pub/sub and locks. `builtin` runs a
 # single-replica StatefulSet; `external` connects to a single endpoint
-# without TLS (Appwrite 2.6.1 has no Redis TLS, Sentinel or Cluster).
+# without TLS (Appwrite 2.6.2 has no Redis TLS, Sentinel or Cluster).
 # See docs/external-databases.md#redis.
 redis:
   # -- `builtin` deploys Redis in the release; `external` uses `redis.external`.
@@ -1188,7 +1188,7 @@ console:
     # -- Image repository.
     repository: appwrite/new
     # -- Image tag. Pinned independently from appVersion so Console security updates can ship separately.
-    tag: 1.2.106-self-hosted
+    tag: 1.2.108-self-hosted
     # -- Image digest.
     digest: ""
     # -- Image pull policy.
@@ -1914,7 +1914,7 @@ browser:
     # -- Image repository.
     repository: appwrite/browser
     # -- Image tag.
-    tag: 0.3.6
+    tag: 0.3.8
     # -- Image digest.
     digest: ""
     # -- Image pull policy.
@@ -2045,7 +2045,7 @@ exiftool:
     # -- Image repository.
     repository: appwrite/exiftool
     # -- Image tag.
-    tag: 0.1.0
+    tag: 0.1.1
     # -- Image digest.
     digest: ""
     # -- Image pull policy.
diff --git a/docs/external-databases.md b/docs/external-databases.md
index ecb087f..a0ad8fb 100644
--- a/docs/external-databases.md
+++ b/docs/external-databases.md
@@ -141,7 +141,7 @@ Set any that differ on yours.
   CREATE EXTENSION IF NOT EXISTS pg_trgm;
   ```
 
-- **Extensions.** Appwrite 2.6.1 uses three, which Appwrite's own image
+- **Extensions.** Appwrite 2.6.2 uses three, which Appwrite's own image
   (`appwrite/postgres`, PostgreSQL 18) ships:
 
   | Extension | Used for |
@@ -309,7 +309,7 @@ database:
 
 - **One host, no TLS.** Appwrite connects to a single host with a username
   and password. It doesn't take connection strings, so SRV records
-  (`mongodb+srv://`) and TLS aren't supported in 2.6.1. That rules out
+  (`mongodb+srv://`) and TLS aren't supported in 2.6.2. That rules out
   MongoDB Atlas.
 
 ## Connections
@@ -396,7 +396,7 @@ redis:
 
 ### Requirements
 
-- **One endpoint, no TLS.** Appwrite 2.6.1 connects to a single Redis
+- **One endpoint, no TLS.** Appwrite 2.6.2 connects to a single Redis
   endpoint in plain text. TLS, Sentinel and Redis Cluster aren't supported.
   Valkey works as a drop-in replacement.
 - **Memory that never runs out.** Redis holds the job queues as well as the
diff --git a/docs/integrations.md b/docs/integrations.md
index ef6d3f9..bf9ca82 100644
--- a/docs/integrations.md
+++ b/docs/integrations.md
@@ -261,8 +261,9 @@ a core other than `https://us.auth.entire.io`, `_APP_VCS_ENTIRE_ENDPOINT` in
 `appwrite.config`, and the plugin's Ed25519 private key (PKCS#8 PEM) as
 `_APP_VCS_ENTIRE_PRIVATE_KEY` in a Secret, as for GitHub. Callbacks go to
 `https://<console domain>/v1/vcs/entire/callback` and events to
-`https://<domain>/v1/vcs/entire/events`. The console that ships with 2.6.1
-keeps Entire behind a feature flag that is off.
+`https://<domain>/v1/vcs/entire/events`. The console offers Entire next to
+the other Git providers from 2.6.2 on; 2.6.1's kept it behind a feature
+flag that is off.
 
 ## Console sign-in with GitHub, GitLab, Bitbucket or Google
 
@@ -321,7 +322,7 @@ appwrite:
     _APP_LOGGING_CONFIG: sentry://<project id>:<key>@<sentry host>/
 ```
 
-Sentry is the only provider Appwrite 2.6.1 supports. When the DSN is
+Sentry is the only provider Appwrite 2.6.2 supports. When the DSN is
 invalid, the pods log `Invalid _APP_LOGGING_CONFIG, error reporting is
 disabled` at start-up. Logs go to stdout regardless, as JSON by default
 (`appwrite.logFormat`), ready for your log pipeline.
diff --git a/docs/migrating-from-docker.md b/docs/migrating-from-docker.md
index 66ed155..dc84d7e 100644
--- a/docs/migrating-from-docker.md
+++ b/docs/migrating-from-docker.md
@@ -5,8 +5,8 @@ keeping all data.
 
 Before you start:
 
-- **Same Appwrite version.** The chart deploys Appwrite 2.6.1. Upgrade the
-  Docker install to 2.6.1 first, including its data migration. A Docker
+- **Same Appwrite version.** The chart deploys Appwrite 2.6.2. Upgrade the
+  Docker install to 2.6.2 first, including its data migration. A Docker
   install on 2.2.0 can also move as it is: install the chart with
   `--set image.tag=2.2.0` in step 3 and drop it in step 5, which then runs
   the migration; give that upgrade a `--timeout` long enough for it
diff --git a/docs/networking.md b/docs/networking.md
index bc928c5..204f686 100644
--- a/docs/networking.md
+++ b/docs/networking.md
@@ -190,9 +190,11 @@ Make sure your controller sets the header, and that clients can't spoof it.
 
 Appwrite refuses to fetch a URL that resolves to a private or reserved
 address: OAuth2 and OIDC providers, webhooks, messaging webhooks, migration
-sources and avatar URLs. That includes every pod and Service in the cluster.
-To use an identity provider or webhook receiver that runs in the cluster,
-list its addresses (IPs or CIDRs, comma-separated) in
+sources and avatar URLs. From 2.6.2 on, it refuses the same addresses for
+the SMTP servers projects and messaging providers set (not the chart's own
+`smtp`). That includes every pod and Service in the cluster. To use an
+identity provider, webhook receiver or mail server that runs in the
+cluster, list its addresses (IPs or CIDRs, comma-separated) in
 `_APP_ALLOWED_INTERNAL_ADDRESSES`, for example your Service range:
 
 ```yaml
@@ -202,10 +204,10 @@ appwrite:
 ```
 
 Migrations from this Appwrite itself are allowed already
-(`_APP_MIGRATION_HOST`). Before fetching a migration source or an avatar
-URL, Appwrite also checks its host through the resolvers in
-`_APP_DNS_EXTERNAL` (by default `_APP_DNS`, `8.8.8.8`) rather than the
-cluster's DNS. With `networkPolicy.egress.enabled`, that resolver needs the
+(`_APP_MIGRATION_HOST`). Before connecting to a migration source, an avatar
+URL or a project's SMTP server, Appwrite also checks its host through the
+resolvers in `_APP_DNS_EXTERNAL` (by default `_APP_DNS`, `8.8.8.8`) rather
+than the cluster's DNS. With `networkPolicy.egress.enabled`, that resolver needs the
 same egress rule as custom domains below.
 
 ### cert-manager
diff --git a/docs/optional-components.md b/docs/optional-components.md
index d2774b5..106df05 100644
--- a/docs/optional-components.md
+++ b/docs/optional-components.md
@@ -172,8 +172,8 @@ with `mqtt.replicaCount`. `_APP_MQTT_REPLAY_DEPTH` (5) and
 | Component | Image | Requests | Memory limit | Replicas |
 | --- | --- | --- | --- | --- |
 | Geo | `docker.io/appwrite/geo:0.3.2` | 20m CPU, 128Mi | 512Mi | `geo.replicaCount` (1) |
-| Browser | `docker.io/appwrite/browser:0.3.6` | 100m CPU, 512Mi | 2Gi | `browser.replicaCount` (1) |
-| ExifTool | `ghcr.io/appwrite/exiftool:0.1.0` | 20m CPU, 128Mi | 512Mi | `exiftool.replicaCount` (1) |
+| Browser | `docker.io/appwrite/browser:0.3.8` | 100m CPU, 512Mi | 2Gi | `browser.replicaCount` (1) |
+| ExifTool | `ghcr.io/appwrite/exiftool:0.1.1` | 20m CPU, 128Mi | 512Mi | `exiftool.replicaCount` (1) |
 | Autogravity | `ghcr.io/appwrite/autogravity:0.0.11` | 100m CPU, 512Mi | 2Gi | 1 |
 | Embedding | `docker.io/appwrite/embedding:0.3.1` | 250m CPU, 1Gi | 4Gi | 1 |
 | MQTT | the Appwrite image | 50m CPU, 128Mi | 512Mi | `mqtt.replicaCount` (1) |
diff --git a/docs/production.md b/docs/production.md
index 5e78aad..da9dd93 100644
--- a/docs/production.md
+++ b/docs/production.md
@@ -44,6 +44,10 @@ to the guide that explains it.
       ([architecture.md](architecture.md#why-_app_cpu_num-matters)).
 - [ ] **Replicas and autoscaling** for the API, console and realtime
       (`replicaCount`, `autoscaling.enabled`).
+- [ ] **PHP memory limit** raised for a realtime that holds thousands of
+      connections: `appwrite.config._APP_MEMORY_LIMIT` (512M per PHP
+      process, `-1` for none) applies to every Appwrite pod, so raise
+      `realtime.resources.limits.memory` with it.
 - [ ] **Function and site specifications capped** with
       `appwrite.config._APP_COMPUTE_CPUS` and `_APP_COMPUTE_MEMORY`, if you
       run Functions and Sites. Without a cap, Appwrite offers up to 8 CPUs and
@@ -102,7 +106,7 @@ to the guide that explains it.
 
 ## Monitoring
 
-Appwrite 2.6.1 exposes no Prometheus metrics. You have its logs, its health
+Appwrite 2.6.2 exposes no Prometheus metrics. You have its logs, its health
 API, and the metrics of Kubernetes and your datastores.
 
 | Watch | How | Alert when |
diff --git a/docs/storage.md b/docs/storage.md
index 988c10f..f8d9db5 100644
--- a/docs/storage.md
+++ b/docs/storage.md
@@ -299,7 +299,7 @@ appwrite:
 ```
 
 Run ClamAV separately (for example with its official image as a Deployment).
-Appwrite 2.6.1 scans only:
+Appwrite 2.6.2 scans only:
 
 - with `device: local`. Files stored in S3 aren't scanned.
 - files up to 20 MB.
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 0b9d195..ebdcd84 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -207,7 +207,7 @@ The server requires TLS, which Appwrite's MySQL client doesn't use. Turn off
 ### Redis: connection resets or timeouts against a managed Redis
 
 The service expects TLS (ElastiCache with in-transit encryption, ElastiCache
-Serverless, Azure's TLS port, Upstash). Appwrite 2.6.1 connects in plain text
+Serverless, Azure's TLS port, Upstash). Appwrite 2.6.2 connects in plain text
 only; use a plain-text endpoint on a private network
 ([Redis](external-databases.md#redis)).
 
@@ -402,7 +402,7 @@ it.
 
 ### Does it expose Prometheus metrics?
 
-Appwrite 2.6.1 has no metrics endpoint. Watch its health API, its queues and
+Appwrite 2.6.2 has no metrics endpoint. Watch its health API, its queues and
 its logs, plus the metrics of Kubernetes and the datastores. The built-in
 datastores can run exporters (`database.builtin.metrics`,
 `redis.builtin.metrics`, `clickhouse.builtin.metrics`) with ServiceMonitors
diff --git a/docs/upgrading.md b/docs/upgrading.md
index daaf81f..f9b237c 100644
--- a/docs/upgrading.md
+++ b/docs/upgrading.md
@@ -16,7 +16,7 @@ The [changelog](../CHANGELOG.md) lists what changed in each chart version,
 and [version notes](#version-notes) what you have to do about it.
 
 What CI tests: a fresh install of the `appVersion`, and an upgrade from the
-published chart 2.0.0 (Appwrite 2.5.0) with default values, including the
+published chart 2.1.0 (Appwrite 2.6.1) with default values, including the
 data migration.
 
 ## What happens during an upgrade
@@ -53,11 +53,11 @@ the Job as soon as the manifests are applied.
    for breaking API changes your apps depend on.
 4. **Don't skip a data migration.** `migrate` applies only the migration of
    the version it runs and doesn't replay those of the versions in between.
-   Several releases share a migration: every version from 1.9.6 to 2.6.1
+   Several releases share a migration: every version from 1.9.6 to 2.6.2
    uses the same one, so 2.0 → 2.6 is a single step. 1.8 → 2.6 isn't: go to
    a release from 1.9.0 to 1.9.5 first, whose migration 2.6 doesn't repeat.
    The table is in Appwrite's
-   [`src/Appwrite/Migration/Migration.php`](https://github.com/appwrite/appwrite/blob/2.6.1/src/Appwrite/Migration/Migration.php).
+   [`src/Appwrite/Migration/Migration.php`](https://github.com/appwrite/appwrite/blob/2.6.2/src/Appwrite/Migration/Migration.php).
 
 ```console
 helm upgrade appwrite oci://ghcr.io/appwrite/charts/appwrite \
diff --git a/examples/aws.yaml b/examples/aws.yaml
index 999698a..6e7f988 100644
--- a/examples/aws.yaml
+++ b/examples/aws.yaml
@@ -15,7 +15,7 @@
 #     CREATE EXTENSION postgis; CREATE EXTENSION vector; CREATE EXTENSION pg_trgm;
 #   rds.force_ssl can stay on: Appwrite connects with TLS when offered.
 # - ElastiCache for Valkey or Redis OSS, node-based, cluster mode disabled,
-#   in-transit encryption off (Appwrite 2.6.1 has no Redis TLS). ElastiCache
+#   in-transit encryption off (Appwrite 2.6.2 has no Redis TLS). ElastiCache
 #   only allows an AUTH token with in-transit encryption, so there's no
 #   password: restrict it with a security group.
 # - An S3 bucket and an IAM user with an access key for it. Appwrite doesn't
diff --git a/examples/azure.yaml b/examples/azure.yaml
index f1e2836..68c34ec 100644
--- a/examples/azure.yaml
+++ b/examples/azure.yaml
@@ -28,7 +28,7 @@
 #   require_secure_transport can stay on: Appwrite connects with TLS when
 #   offered.
 # - Azure Cache for Redis, Standard tier or higher for a replica, with the
-#   non-TLS port (6379) turned on: it's off by default, and Appwrite 2.6.1 has
+#   non-TLS port (6379) turned on: it's off by default, and Appwrite 2.6.2 has
 #   no Redis TLS. An access key is the password. Keep it on a private
 #   endpoint. Azure Cache for Redis retires on 30 September 2028; for Azure
 #   Managed Redis, choose the Non-clustered policy, turn on Non-TLS access and
diff --git a/examples/gcp.yaml b/examples/gcp.yaml
index 3ce5b08..a7cbc3d 100644
--- a/examples/gcp.yaml
+++ b/examples/gcp.yaml
@@ -20,7 +20,7 @@
 #   "Allow only SSL connections" can stay on: Appwrite connects with TLS when
 #   offered.
 # - Memorystore for Redis (not Redis Cluster), Standard tier for a replica
-#   with automatic failover, with in-transit encryption off (Appwrite 2.6.1
+#   with automatic failover, with in-transit encryption off (Appwrite 2.6.2
 #   has no Redis TLS). AUTH can stay on: its AUTH string goes in the Secret.
 # - A Cloud Storage bucket, and an HMAC key (Cloud Storage > Settings >
 #   Interoperability) for a service account with Storage Object Admin on the