diff --git a/Containerfile b/Containerfile
index d502dd9..c2a5ba2 100644
--- a/Containerfile
+++ b/Containerfile
@@ -10,6 +10,8 @@ FROM ghcr.io/daemonless/base:${BASE_VERSION}
 WORKDIR /app
 
 ARG FREEBSD_ARCH=amd64
+ARG UPSTREAM_URL="https://api.github.com/repos/bulwarkmail/webmail/releases/latest"
+ARG UPSTREAM_JQ=".tag_name"
 
 LABEL org.opencontainers.image.title="Bulwark Webmail" \
       org.opencontainers.image.description="Modern self-hosted webmail client for Stalwart Mail Server, powered by JMAP." \
@@ -21,6 +23,8 @@ LABEL org.opencontainers.image.title="Bulwark Webmail" \
       io.daemonless.category="Productivity" \
       io.daemonless.port="3000" \
       io.daemonless.arch="${FREEBSD_ARCH}" \
+      io.daemonless.upstream-url="${UPSTREAM_URL}" \
+      io.daemonless.upstream-jq="${UPSTREAM_JQ}" \
       io.daemonless.healthcheck-url="http://localhost:3000/"
 
 ENV NODE_ENV=production
diff --git a/Containerfile.j2 b/Containerfile.j2
index 27c7e76..b239600 100644
--- a/Containerfile.j2
+++ b/Containerfile.j2
@@ -4,6 +4,8 @@ FROM ghcr.io/daemonless/base:${BASE_VERSION}
 WORKDIR /app
 
 ARG FREEBSD_ARCH=amd64
+ARG UPSTREAM_URL="https://api.github.com/repos/bulwarkmail/webmail/releases/latest"
+ARG UPSTREAM_JQ=".tag_name"
 
 LABEL org.opencontainers.image.title="{{ title }}" \
       org.opencontainers.image.description="{{ description }}" \
@@ -15,6 +17,8 @@ LABEL org.opencontainers.image.title="{{ title }}" \
       io.daemonless.category="{{ category }}" \
       io.daemonless.port="{{ ports[0].port }}" \
       io.daemonless.arch="${FREEBSD_ARCH}" \
+      io.daemonless.upstream-url="${UPSTREAM_URL}" \
+      io.daemonless.upstream-jq="${UPSTREAM_JQ}" \
       io.daemonless.healthcheck-url="http://localhost:{{ ports[0].port }}/"
 
 ENV NODE_ENV=production
diff --git a/README.md b/README.md
index 81f48ad..fe79256 100644
--- a/README.md
+++ b/README.md
@@ -18,13 +18,11 @@ Modern self-hosted webmail client for Stalwart Mail Server, powered by JMAP.
 | **Website** | [https://bulwarkmail.org/](https://bulwarkmail.org/) |
 
 ## Version Tags
-
 | Tag | Description | Best For |
 | :--- | :--- | :--- |
 | `latest` | **Upstream Binary**. Built from official release. | Most users. Matches Linux Docker behavior. |
 
 ## Prerequisites
-
 Before deploying, ensure your host environment is ready. See the [Quick Start Guide](https://daemonless.io/guides/quick-start) for host setup instructions.
 
 ## Deployment
@@ -34,25 +32,26 @@ Before deploying, ensure your host environment is ready. See the [Quick Start Gu
 ```yaml
 services:
   bulwark-webmail:
-    image: ghcr.io/daemonless/bulwark-webmail:latest
+    image: "ghcr.io/daemonless/bulwark-webmail:latest"
     container_name: bulwark-webmail
     environment:
       - PUID=1000
       - PGID=1000
-      - TZ=UTC
-      - JMAP_SERVER_URL=https://mail.example.com
+      - TZ=UTC  # Timezone for the container
+      - JMAP_SERVER_URL=https://mail.example.com  # URL of your Stalwart JMAP server (e.g. https://mail.example.com)
     volumes:
       - "/path/to/containers/bulwark-webmail:/config"
     ports:
-      - 3000:3000
+      - "3000:3000"
     restart: unless-stopped
 ```
 
 ### AppJail Director
-
 **.env**:
 
 ```
+# .env
+
 DIRECTOR_PROJECT=bulwark-webmail
 PUID=1000
 PGID=1000
@@ -63,6 +62,8 @@ JMAP_SERVER_URL=https://mail.example.com
 **appjail-director.yml**:
 
 ```yaml
+# appjail-director.yml
+
 options:
   - virtualnet: ':<random> default'
   - nat:
@@ -71,6 +72,7 @@ services:
     name: bulwark_webmail
     options:
       - container: 'boot args:--pull'
+      - expose: '3000:3000 proto:tcp' \
     oci:
       user: root
       environment:
@@ -88,11 +90,14 @@ volumes:
 **Makejail**:
 
 ```
+# Makejail
+
 ARG tag=latest
 
 OPTION overwrite=force
 OPTION from=ghcr.io/daemonless/bulwark-webmail:${tag}
 ```
+**Note**: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
 
 ### Podman CLI
 
@@ -107,13 +112,31 @@ podman run -d --name bulwark-webmail \
   ghcr.io/daemonless/bulwark-webmail:latest
 ```
 
+### AppJail
+
+```bash
+appjail oci run -Pd \
+  -o overwrite=force \
+  -o container="args:--pull" \
+  -o virtualnet=":<random> default" \
+  -o nat \
+  -o expose="3000:3000 proto:tcp" \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  -e TZ=UTC \
+  -e JMAP_SERVER_URL=https://mail.example.com \
+  -o fstab="/path/to/containers/bulwark-webmail /config <pseudofs>" \
+  ghcr.io/daemonless/bulwark-webmail:latest bulwark-webmail
+```
+**Note**: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
+
 ### Ansible
 
 ```yaml
 - name: Deploy bulwark-webmail
   containers.podman.podman_container:
     name: bulwark-webmail
-    image: ghcr.io/daemonless/bulwark-webmail:latest
+    image: "ghcr.io/daemonless/bulwark-webmail:latest"
     state: started
     restart_policy: always
     env:
@@ -127,6 +150,8 @@ podman run -d --name bulwark-webmail \
       - "/path/to/containers/bulwark-webmail:/config"
 ```
 
+Access at: `http://localhost:3000`
+
 ## Parameters
 
 ### Environment Variables
@@ -152,7 +177,7 @@ podman run -d --name bulwark-webmail \
 
 **Architectures:** amd64
 **User:** `bsd` (UID/GID via PUID/PGID, defaults to 1000:1000)
-**Base:** FreeBSD 15.0
+**Base:** FreeBSD 15
 
 ---