diff --git a/SPECS.md b/SPECS.md
index e3aab89..69e0bf4 100644
--- a/SPECS.md
+++ b/SPECS.md
@@ -39,8 +39,8 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go)
 
 ### Status
 
-Current: app 2.35.3, server 2.6.1 (pinned by digest in `k8s/server.yaml`; applied and running
-on the cluster since 2026-10-25).
+Current: app 2.35.3; server 2.6.2 pinned by digest in `k8s/server.yaml` (2.6.1 running on the
+cluster until it is applied).
 
 - [x] On the car: QR pairing, values on the Overview, voice-key double press, full screen
       without black bands.
@@ -145,7 +145,9 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   forge address or token in the log (tested: `TestUpdatesAreLogged`). Go 1.27.3 (build image
   and `go.mod` toolchain), up from 1.26.9: `govulncheck` had found GO-2026-6809 (compromised
   intermediate certificates, `crypto/x509`, reached through the server's TLS); now no
-  vulnerabilities, in the source and in the built binary. go vet, tests, podman build.
+  vulnerabilities, in the source and in the built binary. go vet, tests, podman build. Pushed
+  as `mg4-server:2.6.2` (`sha256:e4de1e75…`, checked in the registry) and pinned in
+  `k8s/server.yaml`.
 - 2026-10-25 — `k8s/influxdb.yaml`: the values Kubernetes fills in itself are written out — the
   NetworkPolicy port's `protocol: TCP`, and `apiVersion`, `kind` and `volumeMode: Filesystem` on
   the StatefulSet's volume claim template. Without them every `kubectl apply -k k8s/` reported
diff --git a/k8s/server.yaml b/k8s/server.yaml
index 8c495c3..72b2d94 100644
--- a/k8s/server.yaml
+++ b/k8s/server.yaml
@@ -29,8 +29,8 @@ spec:
           type: RuntimeDefault
       containers:
         - name: server
-          # 2.6.1, pinned by digest so a re-pushed tag cannot change what runs.
-          image: git.stinnesbeck.com/nils/mg4-server@sha256:df1d40e423b7ee365e8379e2eaefb4c0db3a599e6429728a37d46827f83d82cd
+          # 2.6.2, pinned by digest so a re-pushed tag cannot change what runs.
+          image: git.stinnesbeck.com/nils/mg4-server@sha256:e4de1e75958d58ece8430a1913f9c1614d8ea1bf566f2e1ec5b449ef51844f77
           ports:
             - name: http
               containerPort: 8080