diff --git a/SPECS.md b/SPECS.md
index 03cad87..7a3f1c8 100644
--- a/SPECS.md
+++ b/SPECS.md
@@ -138,6 +138,10 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-26 — Server 2.7.0 image pushed (`git.stinnesbeck.com/nils/mg4-server:2.7.0`, Go 1.27.3,
+  govulncheck clean) and pinned in `k8s/server.yaml` by digest
+  `sha256:e5da9452a9dbdfabe3340766cc51f18bb1418b2588ab534714550470abe1ce29` (checked with skopeo);
+  manifests valid (kubeconform). Not applied yet: the owner applies it.
 - 2026-10-26 — App 2.39.0 and server 2.7.0: **Grid with map**, a new Overview style — the Grid
   over the roads round the car from OpenStreetMap (owner's choice of design: roads through the
   car's own server, drawn as the floor). Server: `POST /v1/map/roads` `{z:14, x, y}` (the tile,
diff --git a/k8s/server.yaml b/k8s/server.yaml
index 3864ffd..660568c 100644
--- a/k8s/server.yaml
+++ b/k8s/server.yaml
@@ -30,7 +30,7 @@ spec:
       containers:
         - name: server
           # 2.6.2, pinned by digest so a re-pushed tag cannot change what runs.
-          image: git.stinnesbeck.com/nils/mg4-server@sha256:e4de1e75958d58ece8430a1913f9c1614d8ea1bf566f2e1ec5b449ef51844f77
+          image: git.stinnesbeck.com/nils/mg4-server@sha256:e5da9452a9dbdfabe3340766cc51f18bb1418b2588ab534714550470abe1ce29
           ports:
             - name: http
               containerPort: 8080