diff --git a/.daemonless/config.yaml b/.daemonless/config.yaml
index ada306b..58c5d40 100644
--- a/.daemonless/config.yaml
+++ b/.daemonless/config.yaml
@@ -10,6 +10,12 @@ build:
       containerfile: Containerfile
       default: true
       tag_desc: "Official upstream Caddy FreeBSD binary (auto-tracks latest release)."
+    - tag: latest-rfc2136
+      containerfile: Containerfile.extras
+      tag_desc: "Official upstream Caddy FreeBSD binary (auto-tracks latest release). Contains the caddy-dns/rfc2136 plugin."
+      args:
+        EXTRA_PLUGINS:
+          - github.com/caddy-dns/rfc2136
     - tag: pkg
       containerfile: Containerfile.pkg
     - tag: pkg-latest
diff --git a/Containerfile.extras b/Containerfile.extras
new file mode 100644
index 0000000..ae6f986
--- /dev/null
+++ b/Containerfile.extras
@@ -0,0 +1,80 @@
+# --------------------------------------------------------------------------
+# THIS FILE IS AUTOGENERATED - DO NOT EDIT MANUALLY
+#
+# Source: Containerfile.extras.j2
+# --------------------------------------------------------------------------
+
+ARG BASE_VERSION=15.1
+FROM ghcr.io/daemonless/base:${BASE_VERSION}
+
+ARG FREEBSD_ARCH=amd64
+ARG PACKAGES="ca_root_nss"
+ARG UPSTREAM_URL="https://api.github.com/repos/caddyserver/caddy/releases/latest"
+ARG UPSTREAM_JQ=".tag_name"
+ARG EXTRA_PLUGINS
+
+LABEL org.opencontainers.image.title="Caddy" \
+      org.opencontainers.image.description="Fast, multi-platform web server and reverse proxy with automatic HTTPS, written in Go." \
+      org.opencontainers.image.source="https://github.com/daemonless/caddy" \
+      org.opencontainers.image.url="https://caddyserver.com" \
+      org.opencontainers.image.documentation="https://caddyserver.com/docs/" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.vendor="daemonless" \
+      org.opencontainers.image.authors="daemonless" \
+      io.daemonless.category="Network" \
+      io.daemonless.port="80" \
+      io.daemonless.volumes="/config,/data" \
+      io.daemonless.arch="${FREEBSD_ARCH}" \
+      io.daemonless.upstream-url="${UPSTREAM_URL}" \
+      io.daemonless.upstream-jq="${UPSTREAM_JQ}" \
+      io.daemonless.packages="${PACKAGES}"
+
+# Install ca_root_nss for HTTPS/ACME
+RUN pkg update && \
+    pkg install -y ${PACKAGES} && \
+    pkg clean -ay && \
+    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+
+# Download and install the official Caddy FreeBSD binary
+# Release asset uses Go arch naming (aarch64 -> arm64) and a v-less version.
+RUN <<CMD_EOF
+CADDY_VERSION=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${UPSTREAM_JQ}")
+FN_VERSION=${CADDY_VERSION#v}
+case "${FREEBSD_ARCH}" in
+  aarch64)
+    CADDY_ARCH=arm64
+    ;;
+  *)
+    CADDY_ARCH=${FREEBSD_ARCH}
+    ;;
+esac
+plugins=""
+plugins_arg=""
+for plugin in $(jq -nr --arg m "$EXTRA_PLUGINS" '[$m | scan("\u0027([^\u0027]*)\u0027") | .[0]][] | @uri'); do
+  plugins="${plugins}$(jq -nr --arg m "${plugin}" '$m | @urid') "
+  plugins_arg="${plugins_arg}&p=${plugin}"
+echo "Installing Caddy ${CADDY_VERSION} (freebsd_${CADDY_ARCH}) with plugins ${plugins}"
+done
+fetch -qo /tmp/caddy.bin "https://caddyserver.com/api/download?os=freebsd&arch=${CADDY_ARCH}${plugins_arg}"
+mkdir -p /usr/local/bin
+mv /tmp/caddy.bin /usr/local/bin/caddy
+chmod +x /usr/local/bin/caddy
+mkdir -p /app && echo $(/usr/local/bin/caddy version | cut -d' ' -f1) > /app/version
+CMD_EOF
+
+# Create directories (certs/ACME state land in /data)
+RUN mkdir -p /config /data && \
+    chown -R bsd:bsd /config /data
+
+COPY root/ /
+
+RUN chmod +x /etc/services.d/caddy/run /etc/cont-init.d/* 2>/dev/null || true
+
+RUN mkdir -p /run/s6/services/caddy && \
+    ln -sf /etc/services.d/caddy/run /run/s6/services/caddy/run
+
+# Expose (443/udp = HTTP/3; 2019 = admin API, localhost only)
+EXPOSE 80 443 2019
+
+# Volumes
+VOLUME /config /data
\ No newline at end of file
diff --git a/Containerfile.extras.j2 b/Containerfile.extras.j2
new file mode 100644
index 0000000..764782c
--- /dev/null
+++ b/Containerfile.extras.j2
@@ -0,0 +1,74 @@
+ARG BASE_VERSION=15.1
+FROM ghcr.io/daemonless/base:${BASE_VERSION}
+
+ARG FREEBSD_ARCH=amd64
+ARG PACKAGES="ca_root_nss"
+ARG UPSTREAM_URL="https://api.github.com/repos/caddyserver/caddy/releases/latest"
+ARG UPSTREAM_JQ=".tag_name"
+ARG EXTRA_PLUGINS
+
+LABEL org.opencontainers.image.title="Caddy" \
+      org.opencontainers.image.description="Fast, multi-platform web server and reverse proxy with automatic HTTPS, written in Go." \
+      org.opencontainers.image.source="https://github.com/daemonless/caddy" \
+      org.opencontainers.image.url="https://caddyserver.com" \
+      org.opencontainers.image.documentation="https://caddyserver.com/docs/" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.vendor="daemonless" \
+      org.opencontainers.image.authors="daemonless" \
+      io.daemonless.category="Network" \
+      io.daemonless.port="80" \
+      io.daemonless.volumes="/config,/data" \
+      io.daemonless.arch="${FREEBSD_ARCH}" \
+      io.daemonless.upstream-url="${UPSTREAM_URL}" \
+      io.daemonless.upstream-jq="${UPSTREAM_JQ}" \
+      io.daemonless.packages="${PACKAGES}"
+
+# Install ca_root_nss for HTTPS/ACME
+RUN pkg update && \
+    pkg install -y ${PACKAGES} && \
+    pkg clean -ay && \
+    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+
+# Download and install the official Caddy FreeBSD binary
+# Release asset uses Go arch naming (aarch64 -> arm64) and a v-less version.
+RUN <<CMD_EOF
+CADDY_VERSION=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${UPSTREAM_JQ}")
+FN_VERSION=${CADDY_VERSION#v}
+case "${FREEBSD_ARCH}" in
+  aarch64)
+    CADDY_ARCH=arm64
+    ;;
+  *)
+    CADDY_ARCH=${FREEBSD_ARCH}
+    ;;
+esac
+plugins=""
+plugins_arg=""
+for plugin in $(jq -nr --arg m "$EXTRA_PLUGINS" '[$m | scan("\u0027([^\u0027]*)\u0027") | .[0]][] | @uri'); do
+  plugins="${plugins}$(jq -nr --arg m "${plugin}" '$m | @urid') "
+  plugins_arg="${plugins_arg}&p=${plugin}"
+echo "Installing Caddy ${CADDY_VERSION} (freebsd_${CADDY_ARCH}) with plugins ${plugins}"
+done
+fetch -qo /tmp/caddy.bin "https://caddyserver.com/api/download?os=freebsd&arch=${CADDY_ARCH}${plugins_arg}"
+mkdir -p /usr/local/bin
+mv /tmp/caddy.bin /usr/local/bin/caddy
+chmod +x /usr/local/bin/caddy
+mkdir -p /app && echo $(/usr/local/bin/caddy version | cut -d' ' -f1) > /app/version
+CMD_EOF
+
+# Create directories (certs/ACME state land in /data)
+RUN mkdir -p /config /data && \
+    chown -R bsd:bsd /config /data
+
+COPY root/ /
+
+RUN chmod +x /etc/services.d/caddy/run /etc/cont-init.d/* 2>/dev/null || true
+
+RUN mkdir -p /run/s6/services/caddy && \
+    ln -sf /etc/services.d/caddy/run /run/s6/services/caddy/run
+
+# Expose (443/udp = HTTP/3; 2019 = admin API, localhost only)
+EXPOSE 80 443 2019
+
+# Volumes
+VOLUME /config /data
diff --git a/README.md b/README.md
index 4d9c9c0..164e132 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,7 @@ Fast, multi-platform web server and reverse proxy with automatic HTTPS, written
 | Tag | Description | Best For |
 | :--- | :--- | :--- |
 | `latest` | Official upstream Caddy FreeBSD binary (auto-tracks latest release). | Most users — recommended. |
+| `latest-rfc2136` | Official upstream Caddy FreeBSD binary (auto-tracks latest release). Contains the caddy-dns/rfc2136 plugin. | Alternative build. |
 | `pkg` | **FreeBSD Quarterly**. Uses stable, tested packages. | Production stability. |
 | `pkg-latest` | **FreeBSD Latest**. Rolling package updates. | Staying current. |
 
@@ -132,8 +133,7 @@ services:
 ```
 
 Save as `bastille-compose.yml`, then run `bastille up`.
-
-Access at: `http://localhost:80`
+Open `http://<server>:80` from another machine (the server's own browser can't use a published port).
 
 ## Parameters