diff --git a/.env.example b/.env.example
index c8bd407..bb7b03d 100644
--- a/.env.example
+++ b/.env.example
@@ -4,7 +4,7 @@
 
 # ── General ───────────────────────────────────────────────────────────
 # PocketBase version to build (must match a published release tag, without the leading "v")
-PB_VERSION=0.40.0
+PB_VERSION=0.40.1
 
 # Name of the running container
 CONTAINER_NAME=pocketbase
diff --git a/Dockerfile.root b/Dockerfile.root
index f4ed54b..89caee9 100644
--- a/Dockerfile.root
+++ b/Dockerfile.root
@@ -3,7 +3,7 @@
 # ---- build stage: fetch + verify + unzip PocketBase ----
 FROM alpine:3.22 AS build
 
-ARG PB_VERSION=0.40.0
+ARG PB_VERSION=0.40.1
 # provided automatically by buildx (e.g. amd64, arm64)
 ARG TARGETARCH
 
diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index 09e1cea..9811f66 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -3,7 +3,7 @@
 # ---- build stage: fetch + verify + unzip PocketBase ----
 FROM alpine:3.22 AS build
 
-ARG PB_VERSION=0.40.0
+ARG PB_VERSION=0.40.1
 # provided automatically by buildx (e.g. amd64, arm64)
 ARG TARGETARCH
 
diff --git a/README.md b/README.md
index e179ffd..adfc085 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ Copy `.env.example` to `.env` and adjust. Compose reads `.env` automatically; **
 
 | Variable | Default | Description |
 |---|---|---|
-| `PB_VERSION` | `0.40.0` | PocketBase release to build (published tag without the leading `v`). |
+| `PB_VERSION` | `0.40.1` | PocketBase release to build (published tag without the leading `v`). |
 | `CONTAINER_NAME` | `pocketbase` | Base name for the container. |
 | `PB_PORT` | `8070` | Port for the rootless stack (used inside the container and for the host mapping). |
 | `PB_PORT_ROOT` | `8070` | Port for the root stack. |
@@ -92,14 +92,14 @@ You can also bake `pb_migrations` / `pb_hooks` into the image by uncommenting th
 
 ```bash
 # pin a version
-PB_VERSION=0.40.0 docker compose -f docker-compose.rootless.yml build
+PB_VERSION=0.40.1 docker compose -f docker-compose.rootless.yml build
 
 # multi-arch build with buildx
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
-  --build-arg PB_VERSION=0.40.0 \
+  --build-arg PB_VERSION=0.40.1 \
   -f Dockerfile.rootless \
-  -t pocketbase:0.40.0 .
+  -t pocketbase:0.40.1 .
 ```
 
 ## Health check
diff --git a/docker-compose.root.yml b/docker-compose.root.yml
index 8eb3ddb..9773cf4 100644
--- a/docker-compose.root.yml
+++ b/docker-compose.root.yml
@@ -10,8 +10,8 @@ services:
       dockerfile: Dockerfile.root
       args:
         # PocketBase version to bake into the image (see .env)
-        PB_VERSION: ${PB_VERSION:-0.40.0}
-    image: pocketbase:${PB_VERSION:-0.40.0}-root
+        PB_VERSION: ${PB_VERSION:-0.40.1}
+    image: pocketbase:${PB_VERSION:-0.40.1}-root
     container_name: ${CONTAINER_NAME:-pocketbase}-root
     restart: unless-stopped
     environment:
diff --git a/docker-compose.rootless.yml b/docker-compose.rootless.yml
index 4bbfeb9..50a2258 100644
--- a/docker-compose.rootless.yml
+++ b/docker-compose.rootless.yml
@@ -10,8 +10,8 @@ services:
       dockerfile: Dockerfile.rootless
       args:
         # PocketBase version to bake into the image (see .env)
-        PB_VERSION: ${PB_VERSION:-0.40.0}
-    image: pocketbase:${PB_VERSION:-0.40.0}
+        PB_VERSION: ${PB_VERSION:-0.40.1}
+    image: pocketbase:${PB_VERSION:-0.40.1}
     container_name: ${CONTAINER_NAME:-pocketbase}
     restart: unless-stopped
     environment: