diff --git a/.gitea/workflows/build-push.yml b/.gitea/workflows/build-push.yml
index 26f54b9..fb9dc20 100644
--- a/.gitea/workflows/build-push.yml
+++ b/.gitea/workflows/build-push.yml
@@ -6,7 +6,7 @@ on:
       flood_version:
         description: 'jesec/flood release tag'
         required: true
-        default: 'v4.7.0'
+        default: 'v4.16.2'
         type: string
 
 jobs:
diff --git a/Dockerfile.client b/Dockerfile.client
index 5d8d108..a879e4b 100644
--- a/Dockerfile.client
+++ b/Dockerfile.client
@@ -2,7 +2,7 @@
 # Build from a clean upstream release checkout using the Gitea workflow.
 
 ARG BUILDPLATFORM=amd64
-ARG NODE_IMAGE=docker.io/node:22-alpine3.24
+ARG NODE_IMAGE=docker.io/node:24-alpine3.24
 
 FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} as nodebuild
 
@@ -11,12 +11,12 @@ WORKDIR /usr/src/app/
 # Copy project files
 COPY . ./
 
-# Flood v4.7.0 uses package-lock.json, not pnpm.
-RUN npm ci --legacy-peer-deps --omit=optional
+# Use the package manager and lockfile declared by the upstream release.
+RUN npm install -g corepack && corepack enable && corepack install
+RUN pnpm install --frozen-lockfile
 
-# The v4.7 Webpack toolchain needs legacy hashing with modern Node/OpenSSL.
-# This option applies only to asset compilation, not the running server.
-RUN NODE_OPTIONS=--openssl-legacy-provider npm run build-assets
+# Build Flood server and client assets.
+RUN npm run build
 
 # Now get the clean Node.js image
 FROM ${NODE_IMAGE} as flood
diff --git a/README.md b/README.md
index e9c5088..e61b475 100644
--- a/README.md
+++ b/README.md
@@ -10,11 +10,11 @@ Git provider. Changes are reviewed and applied by the maintainer on Gitea.
 Gitea Actions publishes `docker.io/k2patel/floodui:latest` only on manual runs.
 Select `main` in Actions → Build and Push Custom Flood Image → Run workflow
 and set the required `flood_version` release tag. The configured release is
-`v4.7.0`. Repository pushes do not trigger builds.
+`v4.16.2`. Repository pushes do not trigger builds.
 
 This is a Flood-only image using the custom `Dockerfile.client`: it runs the
 Flood web UI/API and connects to an external torrent service. It does not bundle
-or start rTorrent. The Dockerfile uses the v4.7 npm lockfile and builds client
+or start rTorrent. The Dockerfile uses the upstream pnpm lockfile and builds the server and client
 assets; changing release families may require updating the build tooling.
 
 Set Actions secrets `DOCKER_USERNAME` and `DOCKER_TOKEN` with Docker Hub write
@@ -24,9 +24,8 @@ runner image store, and the temporary builder and cache are removed afterward.
 No image archives or build records are uploaded to Gitea, and no local container
 builds are required.
 
-Base image: Node.js 22 on Alpine Linux 3.24 stable (`node:22-alpine3.24`),
+Base image: Node.js 24 on Alpine Linux 3.24 stable (`node:24-alpine3.24`),
 including the latest patch updates in those release series.
 
-Flood 4.7 requires Node 22 because its legacy SPDY dependency uses an internal
-HTTP parser removed in Node 24. The image build starts the actual Flood server
-and requires HTTP 200 before publishing; it does not start a torrent daemon.
+The image build starts the actual Flood server and requires HTTP 200 before
+publishing; it does not start a torrent daemon.