diff --git a/changelog.md b/changelog.md
index ce9f6b82..7a37bdfa 100644
--- a/changelog.md
+++ b/changelog.md
@@ -218,3 +218,4 @@
 - BO : Fixed issue when the "Could not reach your Saferpay account" warning kept showing after payment methods had loaded successfully
 - Fixed issue when files removed in this version stayed on disk after an upgrade, leaving obsolete iframe checkout controllers reachable and re-creating obsolete menu tabs on module reset
 - BO : Fixed issue when a saved API password offered no visible way to enter a new one, and browser password manager icons covered the show/hide password control
+- API update to V1.53: all payment and lookup calls now declare the current Saferpay API version
diff --git a/src/Config/SaferPayConfig.php b/src/Config/SaferPayConfig.php
index 9b36ad36..7cc3f75e 100644
--- a/src/Config/SaferPayConfig.php
+++ b/src/Config/SaferPayConfig.php
@@ -49,7 +49,7 @@ class SaferPayConfig
     const RESTRICT_REFUND_AMOUNT_TO_CAPTURED_AMOUNT = 'SAFERPAY_RESTRICT_REFUND_AMOUNT_TO_CAPTURED_AMOUNT';
     const CONFIGURATION_NAME = 'SAFERPAY_CONFIGURATION_NAME';
     const TEST_SUFFIX = '_TEST';
-    const API_VERSION = '1.50';
+    const API_VERSION = '1.53';
 
     const HOOKS = [
         'paymentOptions',
@@ -431,8 +431,6 @@ public static function getBaseUrl()
     public static function getDefaultConfiguration()
     {
         return [
-            RequestHeader::SPEC_VERSION => SaferPayConfig::API_VERSION,
-            RequestHeader::SPEC_REFUND_VERSION => SaferPayConfig::API_VERSION,
             RequestHeader::RETRY_INDICATOR => 0,
             SaferPayConfig::PAYMENT_BEHAVIOR => 1,
             SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D => 0,
diff --git a/src/DTO/Request/Refund/RefundRequest.php b/src/DTO/Request/Refund/RefundRequest.php
index 72daf3c5..73a9cd07 100644
--- a/src/DTO/Request/Refund/RefundRequest.php
+++ b/src/DTO/Request/Refund/RefundRequest.php
@@ -73,7 +73,7 @@ public function getAsArray()
     {
         $return = [
             'RequestHeader' => [
-                'SpecVersion' => (string) Configuration::get(RequestHeader::SPEC_REFUND_VERSION),
+                'SpecVersion' => (string) $this->requestHeader->getSpecVersions(),
                 'CustomerId' => $this->requestHeader->getCustomerId(),
                 'RequestId' => $this->requestHeader->getRequestId(),
                 'RetryIndicator' => $this->requestHeader->getRetryIndicator(),
diff --git a/src/Service/Request/RequestObjectCreator.php b/src/Service/Request/RequestObjectCreator.php
index 65aa0f9c..5815e8ee 100644
--- a/src/Service/Request/RequestObjectCreator.php
+++ b/src/Service/Request/RequestObjectCreator.php
@@ -90,7 +90,7 @@ public function __construct(
 
     public function createRequestHeader(): RequestHeader
     {
-        $specVersion = Configuration::get(RequestHeader::SPEC_VERSION);
+        $specVersion = SaferPayConfig::API_VERSION;
         $customerId = Configuration::get(RequestHeader::CUSTOMER_ID . SaferPayConfig::getConfigSuffix());
         $requestId = $this->idempotencyProvider->getIdempotencyKey();
         $retryIndicator = Configuration::get(RequestHeader::RETRY_INDICATOR);
diff --git a/upgrade/install-2.1.0.php b/upgrade/install-2.1.0.php
index 1fbb4f6d..78f51eaf 100644
--- a/upgrade/install-2.1.0.php
+++ b/upgrade/install-2.1.0.php
@@ -150,7 +150,15 @@ function saferpayofficial_2_1_0_delete_empty_directory($directory, $moduleDir)
     }
 }
 
+/**
+ * The API spec version is no longer stored in configuration, it now comes straight from
+ * SaferPayConfig::API_VERSION, so the HTTP header and the request body cannot disagree.
+ * Upgraded shops still carry the old rows, and the refund one was never migrated past the
+ * version it was first written at, so both are removed here to stop them being trusted.
+ */
 function saferpayofficial_2_1_0_delete_removed_configuration()
 {
     Configuration::deleteByName('SAFERPAY_HOSTED_FIELDS_TEMPLATE');
+    Configuration::deleteByName('SAFERPAY_SPEC_VERSION');
+    Configuration::deleteByName('SAFERPAY_SPEC_REFUND_VERSION');
 }