diff --git a/.daemonless/logo.svg b/.daemonless/logo.svg
new file mode 100644
index 0000000..5c758ff
--- /dev/null
+++ b/.daemonless/logo.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><path d="M238.8 155.5c33.5 29.7 60.5 61.5 77.9 91.5 29.9-53.4 49.8-116.9 50.1-157.3v-.8c0-59.8-59.7-83.1-111.1-83.1S144.6 29 144.6 88.8V92c28.7 12.8 62.6 35.6 94.2 63.5" style="fill:#fa2921"/><path d="M55.9 318.6c21-23.3 53.1-48.6 89.4-69.9 38.6-22.7 77.2-38.6 111.1-45.8-41.6-44.9-95.8-83.5-134.1-96.2-.3-.1-.5-.2-.7-.2-57-18.7-97.6 30.9-113.5 79.8S-4.1 299.1 52.8 317.6c.8.2 1.8.6 3.1 1" style="fill:#ed79b5"/><path d="M503.9 185.4C488 136.6 447.4 87 390.5 105.5c-.8.3-1.8.6-3.1 1-3.3 31.2-14.4 70.5-31.2 109.1-17.9 41.1-39.8 76.6-62.9 102.4 60 11.9 126.5 11.3 165.1-1 .3-.1.5-.2.7-.2 57-18.6 60.6-82.5 44.8-131.4" style="fill:#ffb400"/><path d="M205 366.3c-9.7-43.7-12.8-85.3-9.3-119.8-55.5 25.7-109 65.3-133 97.8-.2.2-.3.4-.5.6-35.2 48.4-.6 102.3 41 132.5s103.5 46.4 138.7-1.9c.5-.7 1.1-1.5 1.9-2.6-15.6-27.1-29.7-65.5-38.8-106.6" style="fill:#1e83f7"/><path d="M448.8 341.9c-30.7 6.5-71.5 8.1-113.4 4-44.6-4.3-85.1-14.2-116.8-28.2 7.2 60.8 28.4 123.8 51.9 156.7.2.2.3.4.5.6 35.2 48.4 97.1 32.2 138.7 1.9 41.6-30.2 76.2-84.1 41-132.5-.5-.6-1.1-1.4-1.9-2.5" style="fill:#18c249"/></svg>
\ No newline at end of file
diff --git a/Containerfile b/Containerfile
index a9d9faf..5f90c5c 100644
--- a/Containerfile
+++ b/Containerfile
@@ -20,6 +20,8 @@ ARG IMMICH_CLI_VERSION="latest"
 FROM ghcr.io/daemonless/base-core:${BASE_TAG}
 ARG FREEBSD_ARCH=amd64
 ARG IMMICH_CLI_VERSION
+ARG UPSTREAM_URL="https://registry.npmjs.org/@immich/cli/latest"
+ARG UPSTREAM_JQ=".version"
 
 LABEL org.opencontainers.image.title="immich-cli" \
       org.opencontainers.image.description="Immich command-line client (upload/import) on FreeBSD" \
@@ -29,7 +31,9 @@ LABEL org.opencontainers.image.title="immich-cli" \
       org.opencontainers.image.vendor="daemonless" \
       org.opencontainers.image.authors="daemonless" \
       io.daemonless.category="Tools" \
-      io.daemonless.arch="${FREEBSD_ARCH}"
+      io.daemonless.arch="${FREEBSD_ARCH}" \
+      io.daemonless.upstream-url="${UPSTREAM_URL}" \
+      io.daemonless.upstream-jq="${UPSTREAM_JQ}"
 
 # @immich/cli is pure JavaScript — runtime deps are fastq, chokidar, fast-glob,
 # lodash-es, micromatch and @immich/sdk, none of them native — so a global npm
@@ -50,7 +54,7 @@ RUN pkg update && pkg install -y ca_root_nss node22 npm-node22 \
 # Unprivileged runtime. /import is the conventional mount point for the media to
 # upload (mounted read-only at run time). Server URL + key are supplied at run
 # time via env (IMMICH_INSTANCE_URL, IMMICH_API_KEY) or `immich login`.
-RUN chmod -R a+rX /usr/local/lib/node_modules \
+RUN chmod -R a+rX /usr/local/lib/node_modules /app \
     && mkdir -p /import && chown -R bsd:bsd /import
 USER bsd
 WORKDIR /import
diff --git a/Containerfile.j2 b/Containerfile.j2
index 61bf08c..f88ce99 100644
--- a/Containerfile.j2
+++ b/Containerfile.j2
@@ -14,6 +14,8 @@ ARG IMMICH_CLI_VERSION="latest"
 FROM ghcr.io/daemonless/base-core:${BASE_TAG}
 ARG FREEBSD_ARCH=amd64
 ARG IMMICH_CLI_VERSION
+ARG UPSTREAM_URL="https://registry.npmjs.org/@immich/cli/latest"
+ARG UPSTREAM_JQ=".version"
 
 LABEL org.opencontainers.image.title="immich-cli" \
       org.opencontainers.image.description="Immich command-line client (upload/import) on FreeBSD" \
@@ -23,7 +25,9 @@ LABEL org.opencontainers.image.title="immich-cli" \
       org.opencontainers.image.vendor="daemonless" \
       org.opencontainers.image.authors="daemonless" \
       io.daemonless.category="Tools" \
-      io.daemonless.arch="${FREEBSD_ARCH}"
+      io.daemonless.arch="${FREEBSD_ARCH}" \
+      io.daemonless.upstream-url="${UPSTREAM_URL}" \
+      io.daemonless.upstream-jq="${UPSTREAM_JQ}"
 
 # @immich/cli is pure JavaScript — runtime deps are fastq, chokidar, fast-glob,
 # lodash-es, micromatch and @immich/sdk, none of them native — so a global npm
@@ -44,7 +48,7 @@ RUN pkg update && pkg install -y ca_root_nss node22 npm-node22 \
 # Unprivileged runtime. /import is the conventional mount point for the media to
 # upload (mounted read-only at run time). Server URL + key are supplied at run
 # time via env (IMMICH_INSTANCE_URL, IMMICH_API_KEY) or `immich login`.
-RUN chmod -R a+rX /usr/local/lib/node_modules \
+RUN chmod -R a+rX /usr/local/lib/node_modules /app \
     && mkdir -p /import && chown -R bsd:bsd /import
 USER bsd
 WORKDIR /import
diff --git a/README.md b/README.md
index 9719909..29ef599 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,6 @@ Source: dbuild templates
 | **Source** | []() |
 
 ## Version Tags
-
 | Tag | Description | Best For |
 | :--- | :--- | :--- |
 | `latest` | **Upstream Binary**. Built from official release. | Most users. Matches Linux Docker behavior. |
@@ -32,7 +31,7 @@ podman run --rm \
 
 **Architectures:** amd64
 **User:** `bsd` (UID/GID via PUID/PGID, defaults to 1000:1000)
-**Base:** FreeBSD 15.0
+**Base:** FreeBSD 15.1
 
 ---