diff --git a/.daemonless/baseline-latest.png b/.daemonless/baseline-latest.png
index 6c301e8..6678a05 100644
Binary files a/.daemonless/baseline-latest.png and b/.daemonless/baseline-latest.png differ
diff --git a/.daemonless/compose.yaml b/.daemonless/compose.yaml
index c947bfa..ab7f4da 100644
--- a/.daemonless/compose.yaml
+++ b/.daemonless/compose.yaml
@@ -12,19 +12,10 @@ services:
       - TZ=UTC
       - PAPERLESS_ADMIN_USER=admin
       - PAPERLESS_ADMIN_PASSWORD=secret_password
-
-#    volumes:
-#      - /path/to/containers/paperless-ngx:/config
-
-#    ports:
-#      - 8000:8000
+      - PAPERLESS_SECRET_KEY=df736053ef1d69fb0d513e8a08aca7fe9760093f6f78610c3734a4651dde94d1d60670d1abe10ba91d8b150d0248f6d9c1065e9a8ee79b5de02a7cc02ff2bbc5
+      - PAPERLESS_DBENGINE=sqlite
+      - PAPERLESS_REDIS=redis://localhost:6379
 
   redis:
     image: ghcr.io/daemonless/redis:latest
     restart: unless-stopped
-#    volumes:
-#      - /etc/localtime:/etc/localtime:ro
-#      - redis:/config
-
-#volumes:
-#  redis:
diff --git a/Containerfile b/Containerfile
index 944c6de..f474c03 100644
--- a/Containerfile
+++ b/Containerfile
@@ -12,52 +12,333 @@ ARG TARBALL_JQ=".assets[0].browser_download_url"
 
 FROM ghcr.io/daemonless/base:${BASE_VERSION} AS builder
 
+# Use local package cache
+ARG PKG_CACHE_URL
+RUN <<CMD_EOF
+if [ -z "$PKG_CACHE_URL" ]; then
+    exit 0
+fi
+
+mkdir -p /usr/local/etc/pkg/repos || true
+cat <<EOF >/usr/local/etc/pkg/repos/FreeBSD.conf
+FreeBSD-Ports: {
+  url: "http://${PKG_CACHE_URL}/\${ABI}/latest",
+  mirror_type: "none",
+  signature_type: "fingerprints",
+  fingerprints: "/usr/share/keys/pkg",
+  enabled: yes
+}
+EOF
+CMD_EOF
+
 # Install build tools
-RUN pkg update && pkg install -y FreeBSD-set-devel rust gmake python312 libxslt && \
-    pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+RUN <<CMD_EOF
+pkg update -r FreeBSD-base && pkg install -r FreeBSD-base -y FreeBSD-set-devel
+pkg install -y cmake git py312-pip rust
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
 
 # Install build dependencies
-RUN pkg update && pkg install -y pkgconf cmake gcc14 libxslt mariadb118-client postgresql18-client openblas libheif qpdf poppler && \
-    pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+RUN <<CMD_EOF
+pkg install -y jpeg-turbo pngquant
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
+
+# Build libqpdf
+RUN <<CMD_EOF
+cat > /tmp/freebsd-toolchain.cmake <<'EOF'
+set(CMAKE_C_FLAGS_INIT "-ftls-model=initial-exec")
+set(CMAKE_CXX_FLAGS_INIT "-ftls-model=initial-exec -I/usr/local/include")
+EOF
+
+mkdir src && cd src
+git clone https://github.com/qpdf/qpdf.git --branch v12.4.1
+cd qpdf
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec"
+cmake -S . -B build \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DCMAKE_INSTALL_PREFIX=/usr/local \
+  -DCMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu) \
+  -DCMAKE_TOOLCHAIN_FILE=/tmp/freebsd-toolchain.cmake
+
+cmake --build build --parallel $(sysctl -n hw.ncpu)
+cmake --install build
+
+ldconfig -m /usr/local/lib
+
+cd build
+cpack -G TXZ
+
+# Cleanup to save space
+cd ..
+rm -fr qpdf
+CMD_EOF
+
+# Build pikepdf wheel
+RUN <<CMD_EOF
+cd /
+mkdir /wheels
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export LDFLAGS="-L/usr/local/lib"
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+pip wheel --no-deps --wheel-dir /wheels/ \
+  -Ccmake.define.CMAKE_TOOLCHAIN_FILE=/tmp/freebsd-toolchain.cmake \
+  pikepdf
+
+version=$(ls -1 /wheels/pikepdf*.whl  | sed -E 's/.*-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+mv /wheels/pikepdf*.whl /wheels/pikepdf-${version}-py3-none-any.whl 
+
+# Cleanup to save space
+rm -fr /.cache
+CMD_EOF
+
+# Build uharfbuzz wheel
+RUN <<CMD_EOF
+cd /
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export LDFLAGS="-L/usr/local/lib"
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+pip wheel --wheel-dir wheels/ \
+  -Ccmake.define.CMAKE_TOOLCHAIN_FILE=/tmp/freebsd-toolchain.cmake \
+  uharfbuzz
+
+version=$(ls -1 /wheels/uharfbuzz*.whl  | sed -E 's/.*-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+mv /wheels/uharfbuzz*.whl /wheels/uharfbuzz-${version}-py3-none-any.whl 
+
+# Build ocrmypdf wheel
+rm -fr /.cache
+CMD_EOF
+
+RUN <<CMD_EOF
+cd /
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export LDFLAGS="-L/usr/local/lib"
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+pip wheel --no-deps --wheel-dir wheels/ ocrmypdf
+
+version=$(ls -1 /wheels/ocrmypdf*.whl  | sed -E 's/.*-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+mv /wheels/ocrmypdf*.whl /wheels/ocrmypdf-${version}-py3-none-any.whl 
+
+# Build ocrmypdf wheel
+rm -fr /.cache
+CMD_EOF
+
+# Build tantivy wheel
+RUN <<CMD_EOF
+cd /src
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+python3.12 -m venv /tmp/venv-tantivy
+. /tmp/venv-tantivy/bin/activate
+
+pip install maturin
+git clone https://github.com/quickwit-oss/tantivy-py.git --branch 0.26.0
+cd tantivy-py
+maturin build --release
+
+mv target/wheels/tantivy-*.whl /wheels/tantivy-0.26.0-py3-none-any.whl
+
+rm -fr /.cache /.cargo
+CMD_EOF
+
+
+FROM ghcr.io/daemonless/base:${BASE_VERSION}
+
+
+# Use local package cache
+ARG PKG_CACHE_URL
+RUN <<CMD_EOF
+if [ -z "$PKG_CACHE_URL" ]; then
+    exit 0
+fi
+
+mkdir -p /usr/local/etc/pkg/repos || true
+cat <<EOF >/usr/local/etc/pkg/repos/FreeBSD.conf
+FreeBSD-Ports: {
+  url: "http://${PKG_CACHE_URL}/\${ABI}/latest",
+  mirror_type: "none",
+  signature_type: "fingerprints",
+  fingerprints: "/usr/share/keys/pkg",
+  enabled: yes
+}
+EOF
+CMD_EOF
+
+RUN <<CMD_EOF
+pkg update && pkg install -y uv git zip yq \
+  py312-pip \
+  py312-numpy \
+  py312-scipy \
+  py312-sqlite-vec \
+  py312-pytorch \
+  py312-twisted \
+  py312-pygments \
+  py312-psycopg \
+  py312-psycopg-c \
+  py312-networkx \
+  py312-pdfminer-six \
+  py312-llama-index-core \
+  py312-nltk \
+  py312-Babel \
+  yq libxslt \
+  mariadb118-client postgresql18-client openblas libheif poppler-utils \
+  py312-psycopg-pool \
+  py312-redis5 \
+  py312-hiredis \
+  py312-zope.interface \
+  py312-granian \
+  py312-uvloop \
+  py312-zxing-cpp \
+  py312-celery \
+  py312-msgpack \
+  py312-pyyaml \
+  py312-regex \
+  py312-jiter \
+  py312-safetensors \
+  py312-greenlet \
+  py312-time-machine \
+  py312-cffi \
+  py312-zstandard \
+  py312-cryptography \
+  py312-brotli \
+  py312-ujson \
+  py312-aiohttp \
+  py312-ruff \
+  py312-lxml \
+  py312-pillow-heif \
+  py312-scikit-learn \
+  py312-autobahn \
+  py312-prek \
+  py312-scipy \
+  py312-numpy \
+  py312-pillow \
+  py312-rapidfuzz \
+  py312-zensical \
+  py312-ninja \
+  py312-pywavelets \
+  py312-uharfbuzz \
+  py312-langdetect \
+  py312-tokenizers \
+  py312-tiktoken \
+  py312-tornado \
+  py312-pydantic2 \
+  py312-rpds-py \
+  py312-hf-xet \
+  py312-watchfiles \
+  py312-django52 \
+  py312-django-compression-middleware \
+  py312-pdftotext \
+  tesseract \
+  ghostscript10 \
+  ImageMagick7-nox11 \
+  unpaper \
+  pngquant
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
+
+# Copy artifacts from build stage
+COPY --from=builder /src/qpdf/build/qpdf*.tar.xz /tmp/qpdf.tar.xz
+COPY --from=builder /wheels /app/wheels
+
+RUN <<CMD_EOF
+tar xJvf /tmp/qpdf.tar.xz -C /usr/local --strip-components 1
+ldconfig -m /usr/local/lib
+CMD_EOF
 
 ARG UPSTREAM_URL
 ARG UPSTREAM_JQ
 ARG TARBALL_JQ
 
+ENV UV_PROJECT_ENVIRONMENT=/app/venv \
+    UV_LINK_MODE=copy
+
 # Fetch and extract source tarball
-RUN TARBALL=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${TARBALL_JQ}") && \
-    fetch -qo /tmp/paperless.tar.gz "${TARBALL}" && \
-    mkdir -m 0755 -p /src && \
-    tar -C /src -xzf /tmp/paperless.tar.gz --strip-components 1 && \
-    rm -f /tmp/paperless.tar.gz
+RUN <<CMD_EOF
+export TARBALL=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${TARBALL_JQ}")
+fetch -qo /tmp/paperless.tar.xz "${TARBALL}"
+mkdir -m 0755 -p /app/src
+tar -C /app/src -xJf /tmp/paperless.tar.xz --strip-components 1
+rm -f /tmp/paperless.tar.xz
+CMD_EOF
 
 # Setup bsd user for build
 RUN /etc/cont-init.d/10-usermod
 
-# Install pip
-RUN su -l bsd -c "/usr/local/bin/python3.12 -m ensurepip --user"
-
 # Add python3 symlink
-RUN cd /usr/local/bin && ln -sf python3.12 python3
+RUN cd /usr/local/bin && ln -sf python3.12 python3 && chmod -h a+rx python3
 
-WORKDIR /src
-RUN echo Patching requirements.txt && \
-    sed -i "" 's/sys_platform == '\''darwin'\''/sys_platform == '\''freebsd15'\''/' requirements.txt
-    
-RUN echo Installing requirements && \
-    su -l bsd -c "cd /src && FC=/usr/local/bin/gfortran14 /config/.local/bin/pip3 install -r requirements.txt --user"
+WORKDIR /app/src
 
-RUN echo Installing pdftotext && \
-    su -l bsd -c "/usr/local/bin/python3.12 -m pip install pdftotext --user"
+RUN <<CMD_EOF
+export FC=/usr/local/bin/gfortran14
+export CMAKE_EXECUTABLE=/usr/local/bin/cmake
+export SKBUILD_CMAKE_VERSION=""
+export SKBUILD_NINJA_VERSION=""
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
 
+tomlq -t -i --arg new "sys_platform == 'freebsd15'" '.tool.uv.environments += [$new]' pyproject.toml
+tomlq -t -i 'del(.project.dependencies[] | select(test("^(pypdfium2|sqlite-vec|torch)"))) ' pyproject.toml
+tomlq -t -i '.tool.uv."exclude-dependencies" += ["pypdfium2","sqlite-vec","torch"]' pyproject.toml
+tomlq -t -i '.project.dependencies += ["granian[uvloop]~=2.7.6"]' pyproject.toml
+tomlq -t -i '
+  .tool.uv."find-links" += ["/app/wheels/"]
+  | .tool.uv."no-build-package" += ["tantivy"]
+' pyproject.toml
+tomlq -t -i 'del(.tool.uv.sources.torch)' pyproject.toml
+# tomlq -t -i '.tool.uv."no-build-package" += ["pypdfium2","sqlite-vec","pytorch"]' pyproject.toml
+# Replace versions
+tomlq -t -i '
+  .project.dependencies
+  |= map(
+    if test("^celery")                   then "celery~=5.3.1"
+    elif test("^ocrmypdf")               then "ocrmypdf>=17.11.0"
+    else . end
+  )
+# Remove dependencies on some transient dependencies
+' pyproject.toml
+# Replace versions
+tomlq -t -i '
+  .project."optional-dependencies".postgres
+  |= map(
+    if   test("^psycopg\\[c,pool\\]==")  then "psycopg[c,pool]~=3.3.0"
+    elif test("^psycopg-c==")            then "psycopg-c~=3.3.0"
+    elif test("^psycopg-pool==")         then "psycopg-pool~=3.3.1"
+    elif test("^redis\\[hiredis\\]")     then "redis[hiredis]~=5.3.1"
+    else . end
+  )
+# Remove dependencies on some transient dependencies
+' pyproject.toml
+tomlq -t -i '
+  .tool.uv."exclude-dependencies" += ["hiredis","msgpack","pyyaml","regex","jiter","safetensors","greenlet",
+    "zxing-cpp","time-machine","cffi","zstandard","cryptography","brotli","ujson","aiohttp","ruff","pi-heif",
+    "lxml","scikit-learn","autobahn","prek","scipy","numpy","pillow","rapidfuzz","zensical","ninja","uvloop",
+    "granian","pywavelets","uharfbuzz","langdetect","tokenizers","tiktoken","tornado","pydantic",
+    "llama-index-core","rpds-py","hf-xet","watchfiles"]
+' pyproject.toml
+uv venv --system-site-packages || exit 1
+uv lock --upgrade-package ocrmypdf --upgrade-package pikepdf --upgrade-package uharfbuzz --upgrade-package tantivy
+uv sync || exit 1
+uv export -o requirements.txt || exit 1
+uv cache clean
+CMD_EOF
 
-FROM ghcr.io/daemonless/base:${BASE_VERSION}
 
 ARG FREEBSD_ARCH=amd64
-ARG UPSTREAM_URL
-ARG UPSTREAM_JQ
-ARG PACKAGES="python312 py312-sqlite3 libxslt mariadb118-client postgresql18-client openblas libheif qpdf gnupg ImageMagick7-nox11 optipng tesseract unpaper poppler-utils liberation-fonts-ttf"
-ARG APP_VERSION="latest"
 
 LABEL org.opencontainers.image.title="Paperless-ngx" \
       org.opencontainers.image.description="A community-supported open-source document management system that transforms your physical documents into a searchable online archive so you can keep, well, less paper." \
@@ -73,24 +354,14 @@ LABEL org.opencontainers.image.title="Paperless-ngx" \
       io.daemonless.upstream-url="${UPSTREAM_URL}" \
       io.daemonless.upstream-jq="${UPSTREAM_JQ}"
       
-# Update to latest patch level
-RUN pkg update -r FreeBSD-base && \
-    pkg upgrade -y -r FreeBSD-base && \
-    pkg clean -ay && \
-    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
-
-# Install run dependencies
-RUN pkg update && \
-    pkg install -y ${PACKAGES} && \
-    pkg clean -ay && \
-    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
-
-# Add python3 symlink
-RUN cd /usr/local/bin && ln -sf python3.12 python3
-
-COPY --from=builder --chown=bsd:bsd --chmod=755 /config/.local/ /app/.local/
-COPY --from=builder --chown=bsd:bsd --chmod=755 /src/static/ /app/static/
-COPY --from=builder --chown=bsd:bsd --chmod=755 /src/src/ /app/src/
+# Update to latest patch level and install PAM
+RUN <<CMD_EOF
+pkg update -r FreeBSD-base
+pkg upgrade -y -r FreeBSD-base
+pkg install -y -r FreeBSD-base FreeBSD-pam
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -99,11 +370,20 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PNGX_CONTAINERIZED=1 \
     # https://docs.astral.sh/uv/reference/settings/#link-mode
     UV_LINK_MODE=copy \
-    PYTHONPATH=/app/.local/lib/python3.12/site-packages
+    # PYTHONPATH=/app/.local/lib/python3.12/site-packages \
+    NLTK_DATA=/app/nltk_data \
+    UV_PROJECT_ENVIRONMENT=/app/venv \
+    UV_CACHE_DIR=/app/.cache \
+    UV_FROZEN=1
 
 # Install NLTK data
-RUN echo "Installing NLTK_DATA ..." && \
-    su -m bsd -c "mkdir /app/nltk_data && cd /app && /usr/local/bin/python3.12 -m nltk.downloader -d /app/nltk_data snowball_data stopwords punkt punkt_tab"
+RUN <<CMD_EOF
+find /usr/local -type d -exec chmod 755 {} +
+mkdir -p /app/nltk_data
+chown -R bsd:bsd /app
+echo "Installing NLTK_DATA ..."
+su -m bsd -c "cd /app/src && /app/venv/bin/python  -m nltk.downloader -d /app/nltk_data snowball_data stopwords punkt_tab"
+CMD_EOF
 
 ENV PAPERLESS_NLTK_DIR=/app/nltk_data \
     PAPERLESS_ENABLE_NLTK=true \
@@ -115,7 +395,7 @@ ENV PAPERLESS_NLTK_DIR=/app/nltk_data \
     GRANIAN_HOST=0.0.0.0
 
 # Extract version information
-RUN su -m bsd -c "cd /app/src && /usr/local/bin/python3.12 -c 'from paperless import version; print(version.__full_version_str__)' > /app/version"
+RUN su -m bsd -c "cd /app/src/src && uv run python -c 'from paperless import version; print(version.__full_version_str__)' > /app/version"
 
 # Copy root filesystem
 COPY root/ /
@@ -123,8 +403,13 @@ COPY root/ /
 ## Set permissions
 RUN chmod +x /etc/services.d/*/run /etc/cont-init.d/* /healthz 2>/dev/null || true
 
+## Temporary fix for regex timeout
+RUN <<CMD_EOF
+sed -i "" 's/MATCH_REGEX_TIMEOUT_SECONDS", 0.1/MATCH_REGEX_TIMEOUT_SECONDS", 1.0/' /app/src/src/documents/regex.py
+CMD_EOF
+
 # --- Expose (Injected by Generator) ---
 EXPOSE 8000 5555
 
 # --- Volumes (Injected by Generator) ---
-VOLUME /config /config/media/documents
\ No newline at end of file
+VOLUME /config
\ No newline at end of file
diff --git a/Containerfile.j2 b/Containerfile.j2
index c2414df..3c0fe72 100644
--- a/Containerfile.j2
+++ b/Containerfile.j2
@@ -6,52 +6,333 @@ ARG TARBALL_JQ=".assets[0].browser_download_url"
 
 FROM ghcr.io/daemonless/base:${BASE_VERSION} AS builder
 
+# Use local package cache
+ARG PKG_CACHE_URL
+RUN <<CMD_EOF
+if [ -z "$PKG_CACHE_URL" ]; then
+    exit 0
+fi
+
+mkdir -p /usr/local/etc/pkg/repos || true
+cat <<EOF >/usr/local/etc/pkg/repos/FreeBSD.conf
+FreeBSD-Ports: {
+  url: "http://${PKG_CACHE_URL}/\${ABI}/latest",
+  mirror_type: "none",
+  signature_type: "fingerprints",
+  fingerprints: "/usr/share/keys/pkg",
+  enabled: yes
+}
+EOF
+CMD_EOF
+
 # Install build tools
-RUN pkg update && pkg install -y FreeBSD-set-devel rust gmake python312 libxslt && \
-    pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+RUN <<CMD_EOF
+pkg update -r FreeBSD-base && pkg install -r FreeBSD-base -y FreeBSD-set-devel
+pkg install -y cmake git py312-pip rust
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
 
 # Install build dependencies
-RUN pkg update && pkg install -y pkgconf cmake gcc14 libxslt mariadb118-client postgresql18-client openblas libheif qpdf poppler && \
-    pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+RUN <<CMD_EOF
+pkg install -y jpeg-turbo pngquant
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
+
+# Build libqpdf
+RUN <<CMD_EOF
+cat > /tmp/freebsd-toolchain.cmake <<'EOF'
+set(CMAKE_C_FLAGS_INIT "-ftls-model=initial-exec")
+set(CMAKE_CXX_FLAGS_INIT "-ftls-model=initial-exec -I/usr/local/include")
+EOF
+
+mkdir src && cd src
+git clone https://github.com/qpdf/qpdf.git --branch v12.4.1
+cd qpdf
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec"
+cmake -S . -B build \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DCMAKE_INSTALL_PREFIX=/usr/local \
+  -DCMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu) \
+  -DCMAKE_TOOLCHAIN_FILE=/tmp/freebsd-toolchain.cmake
+
+cmake --build build --parallel $(sysctl -n hw.ncpu)
+cmake --install build
+
+ldconfig -m /usr/local/lib
+
+cd build
+cpack -G TXZ
+
+# Cleanup to save space
+cd ..
+rm -fr qpdf
+CMD_EOF
+
+# Build pikepdf wheel
+RUN <<CMD_EOF
+cd /
+mkdir /wheels
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export LDFLAGS="-L/usr/local/lib"
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+pip wheel --no-deps --wheel-dir /wheels/ \
+  -Ccmake.define.CMAKE_TOOLCHAIN_FILE=/tmp/freebsd-toolchain.cmake \
+  pikepdf
+
+version=$(ls -1 /wheels/pikepdf*.whl  | sed -E 's/.*-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+mv /wheels/pikepdf*.whl /wheels/pikepdf-${version}-py3-none-any.whl 
+
+# Cleanup to save space
+rm -fr /.cache
+CMD_EOF
+
+# Build uharfbuzz wheel
+RUN <<CMD_EOF
+cd /
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export LDFLAGS="-L/usr/local/lib"
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+pip wheel --wheel-dir wheels/ \
+  -Ccmake.define.CMAKE_TOOLCHAIN_FILE=/tmp/freebsd-toolchain.cmake \
+  uharfbuzz
+
+version=$(ls -1 /wheels/uharfbuzz*.whl  | sed -E 's/.*-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+mv /wheels/uharfbuzz*.whl /wheels/uharfbuzz-${version}-py3-none-any.whl 
+
+# Build ocrmypdf wheel
+rm -fr /.cache
+CMD_EOF
+
+RUN <<CMD_EOF
+cd /
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export LDFLAGS="-L/usr/local/lib"
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+pip wheel --no-deps --wheel-dir wheels/ ocrmypdf
+
+version=$(ls -1 /wheels/ocrmypdf*.whl  | sed -E 's/.*-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+mv /wheels/ocrmypdf*.whl /wheels/ocrmypdf-${version}-py3-none-any.whl 
+
+# Build ocrmypdf wheel
+rm -fr /.cache
+CMD_EOF
+
+# Build tantivy wheel
+RUN <<CMD_EOF
+cd /src
+
+export CFLAGS="-ftls-model=initial-exec"
+export CXXFLAGS="-ftls-model=initial-exec -I/usr/local/include"
+export CMAKE_ARGS="-DCMAKE_C_FLAGS=-ftls-model=initial-exec -DCMAKE_CXX_FLAGS=-ftls-model=initial-exec"
+python3.12 -m venv /tmp/venv-tantivy
+. /tmp/venv-tantivy/bin/activate
+
+pip install maturin
+git clone https://github.com/quickwit-oss/tantivy-py.git --branch 0.26.0
+cd tantivy-py
+maturin build --release
+
+mv target/wheels/tantivy-*.whl /wheels/tantivy-0.26.0-py3-none-any.whl
+
+rm -fr /.cache /.cargo
+CMD_EOF
+
+
+FROM ghcr.io/daemonless/base:${BASE_VERSION}
+
+
+# Use local package cache
+ARG PKG_CACHE_URL
+RUN <<CMD_EOF
+if [ -z "$PKG_CACHE_URL" ]; then
+    exit 0
+fi
+
+mkdir -p /usr/local/etc/pkg/repos || true
+cat <<EOF >/usr/local/etc/pkg/repos/FreeBSD.conf
+FreeBSD-Ports: {
+  url: "http://${PKG_CACHE_URL}/\${ABI}/latest",
+  mirror_type: "none",
+  signature_type: "fingerprints",
+  fingerprints: "/usr/share/keys/pkg",
+  enabled: yes
+}
+EOF
+CMD_EOF
+
+RUN <<CMD_EOF
+pkg update && pkg install -y uv git zip yq \
+  py312-pip \
+  py312-numpy \
+  py312-scipy \
+  py312-sqlite-vec \
+  py312-pytorch \
+  py312-twisted \
+  py312-pygments \
+  py312-psycopg \
+  py312-psycopg-c \
+  py312-networkx \
+  py312-pdfminer-six \
+  py312-llama-index-core \
+  py312-nltk \
+  py312-Babel \
+  yq libxslt \
+  mariadb118-client postgresql18-client openblas libheif poppler-utils \
+  py312-psycopg-pool \
+  py312-redis5 \
+  py312-hiredis \
+  py312-zope.interface \
+  py312-granian \
+  py312-uvloop \
+  py312-zxing-cpp \
+  py312-celery \
+  py312-msgpack \
+  py312-pyyaml \
+  py312-regex \
+  py312-jiter \
+  py312-safetensors \
+  py312-greenlet \
+  py312-time-machine \
+  py312-cffi \
+  py312-zstandard \
+  py312-cryptography \
+  py312-brotli \
+  py312-ujson \
+  py312-aiohttp \
+  py312-ruff \
+  py312-lxml \
+  py312-pillow-heif \
+  py312-scikit-learn \
+  py312-autobahn \
+  py312-prek \
+  py312-scipy \
+  py312-numpy \
+  py312-pillow \
+  py312-rapidfuzz \
+  py312-zensical \
+  py312-ninja \
+  py312-pywavelets \
+  py312-uharfbuzz \
+  py312-langdetect \
+  py312-tokenizers \
+  py312-tiktoken \
+  py312-tornado \
+  py312-pydantic2 \
+  py312-rpds-py \
+  py312-hf-xet \
+  py312-watchfiles \
+  py312-django52 \
+  py312-django-compression-middleware \
+  py312-pdftotext \
+  tesseract \
+  ghostscript10 \
+  ImageMagick7-nox11 \
+  unpaper \
+  pngquant
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
+
+# Copy artifacts from build stage
+COPY --from=builder /src/qpdf/build/qpdf*.tar.xz /tmp/qpdf.tar.xz
+COPY --from=builder /wheels /app/wheels
+
+RUN <<CMD_EOF
+tar xJvf /tmp/qpdf.tar.xz -C /usr/local --strip-components 1
+ldconfig -m /usr/local/lib
+CMD_EOF
 
 ARG UPSTREAM_URL
 ARG UPSTREAM_JQ
 ARG TARBALL_JQ
 
+ENV UV_PROJECT_ENVIRONMENT=/app/venv \
+    UV_LINK_MODE=copy
+
 # Fetch and extract source tarball
-RUN TARBALL=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${TARBALL_JQ}") && \
-    fetch -qo /tmp/paperless.tar.gz "${TARBALL}" && \
-    mkdir -m 0755 -p /src && \
-    tar -C /src -xzf /tmp/paperless.tar.gz --strip-components 1 && \
-    rm -f /tmp/paperless.tar.gz
+RUN <<CMD_EOF
+export TARBALL=$(fetch -qo - "${UPSTREAM_URL}" | jq -r "${TARBALL_JQ}")
+fetch -qo /tmp/paperless.tar.xz "${TARBALL}"
+mkdir -m 0755 -p /app/src
+tar -C /app/src -xJf /tmp/paperless.tar.xz --strip-components 1
+rm -f /tmp/paperless.tar.xz
+CMD_EOF
 
 # Setup bsd user for build
 RUN /etc/cont-init.d/10-usermod
 
-# Install pip
-RUN su -l bsd -c "/usr/local/bin/python3.12 -m ensurepip --user"
-
 # Add python3 symlink
-RUN cd /usr/local/bin && ln -sf python3.12 python3
+RUN cd /usr/local/bin && ln -sf python3.12 python3 && chmod -h a+rx python3
 
-WORKDIR /src
-RUN echo Patching requirements.txt && \
-    sed -i "" 's/sys_platform == '\''darwin'\''/sys_platform == '\''freebsd15'\''/' requirements.txt
-    
-RUN echo Installing requirements && \
-    su -l bsd -c "cd /src && FC=/usr/local/bin/gfortran14 /config/.local/bin/pip3 install -r requirements.txt --user"
+WORKDIR /app/src
 
-RUN echo Installing pdftotext && \
-    su -l bsd -c "/usr/local/bin/python3.12 -m pip install pdftotext --user"
+RUN <<CMD_EOF
+export FC=/usr/local/bin/gfortran14
+export CMAKE_EXECUTABLE=/usr/local/bin/cmake
+export SKBUILD_CMAKE_VERSION=""
+export SKBUILD_NINJA_VERSION=""
+export CMAKE_BUILD_PARALLEL_LEVEL=$(sysctl -n hw.ncpu)
 
+tomlq -t -i --arg new "sys_platform == 'freebsd15'" '.tool.uv.environments += [$new]' pyproject.toml
+tomlq -t -i 'del(.project.dependencies[] | select(test("^(pypdfium2|sqlite-vec|torch)"))) ' pyproject.toml
+tomlq -t -i '.tool.uv."exclude-dependencies" += ["pypdfium2","sqlite-vec","torch"]' pyproject.toml
+tomlq -t -i '.project.dependencies += ["granian[uvloop]~=2.7.6"]' pyproject.toml
+tomlq -t -i '
+  .tool.uv."find-links" += ["/app/wheels/"]
+  | .tool.uv."no-build-package" += ["tantivy"]
+' pyproject.toml
+tomlq -t -i 'del(.tool.uv.sources.torch)' pyproject.toml
+# tomlq -t -i '.tool.uv."no-build-package" += ["pypdfium2","sqlite-vec","pytorch"]' pyproject.toml
+# Replace versions
+tomlq -t -i '
+  .project.dependencies
+  |= map(
+    if test("^celery")                   then "celery~=5.3.1"
+    elif test("^ocrmypdf")               then "ocrmypdf>=17.11.0"
+    else . end
+  )
+# Remove dependencies on some transient dependencies
+' pyproject.toml
+# Replace versions
+tomlq -t -i '
+  .project."optional-dependencies".postgres
+  |= map(
+    if   test("^psycopg\\[c,pool\\]==")  then "psycopg[c,pool]~=3.3.0"
+    elif test("^psycopg-c==")            then "psycopg-c~=3.3.0"
+    elif test("^psycopg-pool==")         then "psycopg-pool~=3.3.1"
+    elif test("^redis\\[hiredis\\]")     then "redis[hiredis]~=5.3.1"
+    else . end
+  )
+# Remove dependencies on some transient dependencies
+' pyproject.toml
+tomlq -t -i '
+  .tool.uv."exclude-dependencies" += ["hiredis","msgpack","pyyaml","regex","jiter","safetensors","greenlet",
+    "zxing-cpp","time-machine","cffi","zstandard","cryptography","brotli","ujson","aiohttp","ruff","pi-heif",
+    "lxml","scikit-learn","autobahn","prek","scipy","numpy","pillow","rapidfuzz","zensical","ninja","uvloop",
+    "granian","pywavelets","uharfbuzz","langdetect","tokenizers","tiktoken","tornado","pydantic",
+    "llama-index-core","rpds-py","hf-xet","watchfiles"]
+' pyproject.toml
+uv venv --system-site-packages || exit 1
+uv lock --upgrade-package ocrmypdf --upgrade-package pikepdf --upgrade-package uharfbuzz --upgrade-package tantivy
+uv sync || exit 1
+uv export -o requirements.txt || exit 1
+uv cache clean
+CMD_EOF
 
-FROM ghcr.io/daemonless/base:${BASE_VERSION}
 
 ARG FREEBSD_ARCH=amd64
-ARG UPSTREAM_URL
-ARG UPSTREAM_JQ
-ARG PACKAGES="python312 py312-sqlite3 libxslt mariadb118-client postgresql18-client openblas libheif qpdf gnupg ImageMagick7-nox11 optipng tesseract unpaper poppler-utils liberation-fonts-ttf"
-ARG APP_VERSION="latest"
 
 LABEL org.opencontainers.image.title="Paperless-ngx" \
       org.opencontainers.image.description="A community-supported open-source document management system that transforms your physical documents into a searchable online archive so you can keep, well, less paper." \
@@ -69,24 +350,14 @@ LABEL org.opencontainers.image.title="Paperless-ngx" \
       io.daemonless.upstream-url="${UPSTREAM_URL}" \
       io.daemonless.upstream-jq="${UPSTREAM_JQ}"
       
-# Update to latest patch level
-RUN pkg update -r FreeBSD-base && \
-    pkg upgrade -y -r FreeBSD-base && \
-    pkg clean -ay && \
-    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
-
-# Install run dependencies
-RUN pkg update && \
-    pkg install -y ${PACKAGES} && \
-    pkg clean -ay && \
-    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
-
-# Add python3 symlink
-RUN cd /usr/local/bin && ln -sf python3.12 python3
-
-COPY --from=builder --chown=bsd:bsd --chmod=755 /config/.local/ /app/.local/
-COPY --from=builder --chown=bsd:bsd --chmod=755 /src/static/ /app/static/
-COPY --from=builder --chown=bsd:bsd --chmod=755 /src/src/ /app/src/
+# Update to latest patch level and install PAM
+RUN <<CMD_EOF
+pkg update -r FreeBSD-base
+pkg upgrade -y -r FreeBSD-base
+pkg install -y -r FreeBSD-base FreeBSD-pam
+pkg clean -ay
+rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
+CMD_EOF
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -95,11 +366,20 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PNGX_CONTAINERIZED=1 \
     # https://docs.astral.sh/uv/reference/settings/#link-mode
     UV_LINK_MODE=copy \
-    PYTHONPATH=/app/.local/lib/python3.12/site-packages
+    # PYTHONPATH=/app/.local/lib/python3.12/site-packages \
+    NLTK_DATA=/app/nltk_data \
+    UV_PROJECT_ENVIRONMENT=/app/venv \
+    UV_CACHE_DIR=/app/.cache \
+    UV_FROZEN=1
 
 # Install NLTK data
-RUN echo "Installing NLTK_DATA ..." && \
-    su -m bsd -c "mkdir /app/nltk_data && cd /app && /usr/local/bin/python3.12 -m nltk.downloader -d /app/nltk_data snowball_data stopwords punkt punkt_tab"
+RUN <<CMD_EOF
+find /usr/local -type d -exec chmod 755 {} +
+mkdir -p /app/nltk_data
+chown -R bsd:bsd /app
+echo "Installing NLTK_DATA ..."
+su -m bsd -c "cd /app/src && /app/venv/bin/python  -m nltk.downloader -d /app/nltk_data snowball_data stopwords punkt_tab"
+CMD_EOF
 
 ENV PAPERLESS_NLTK_DIR=/app/nltk_data \
     PAPERLESS_ENABLE_NLTK=true \
@@ -111,7 +391,7 @@ ENV PAPERLESS_NLTK_DIR=/app/nltk_data \
     GRANIAN_HOST=0.0.0.0
 
 # Extract version information
-RUN su -m bsd -c "cd /app/src && /usr/local/bin/python3.12 -c 'from paperless import version; print(version.__full_version_str__)' > /app/version"
+RUN su -m bsd -c "cd /app/src/src && uv run python -c 'from paperless import version; print(version.__full_version_str__)' > /app/version"
 
 # Copy root filesystem
 COPY root/ /
@@ -119,6 +399,11 @@ COPY root/ /
 ## Set permissions
 RUN chmod +x /etc/services.d/*/run /etc/cont-init.d/* /healthz 2>/dev/null || true
 
+## Temporary fix for regex timeout
+RUN <<CMD_EOF
+sed -i "" 's/MATCH_REGEX_TIMEOUT_SECONDS", 0.1/MATCH_REGEX_TIMEOUT_SECONDS", 1.0/' /app/src/src/documents/regex.py
+CMD_EOF
+
 # --- Expose (Injected by Generator) ---
 {%- if ports %}
 EXPOSE {{ ports | map(attribute='target') | join(' ') }}
diff --git a/README.md b/README.md
index ee7d10d..07e1377 100644
--- a/README.md
+++ b/README.md
@@ -18,13 +18,11 @@ A community-supported open-source document management system that transforms you
 | **Website** | [https://paperless-ngx.org/](https://paperless-ngx.org/) |
 
 ## Version Tags
-
 | Tag | Description | Best For |
 | :--- | :--- | :--- |
-| `latest` | **Upstream Binary**. Built from official release. | Most users. Matches Linux Docker behavior. |
+| `latest` | Built from latest upstream release and latest FreeBSD packages. | Most users — recommended. |
 
 ## Prerequisites
-
 Before deploying, ensure your host environment is ready. See the [Quick Start Guide](https://daemonless.io/guides/quick-start) for host setup instructions.
 
 ## Deployment
@@ -34,23 +32,84 @@ Before deploying, ensure your host environment is ready. See the [Quick Start Gu
 ```yaml
 services:
   paperless-ngx:
-    image: ghcr.io/daemonless/paperless-ngx:latest
+    image: "ghcr.io/daemonless/paperless-ngx:latest"
     container_name: paperless-ngx
     environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=UTC
-      - PAPERLESS_ADMIN_USER=admin
-      - PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD>
+      - PUID=1000  # User ID for the application process
+      - PGID=1000  # Group ID for the application process
+      - TZ=UTC  # Timezone for the container
+      - PAPERLESS_ADMIN_USER=admin  # Optional - Set name of the admin user on first start
+      - PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD>  # Optional - Set password of the admin user on first start
     volumes:
       - "/path/to/containers/paperless-ngx:/config"
-      - "/path/to/containers/paperless-ngx/config/media/documents:/config/media/documents"
     ports:
-      - 8000:8000
-      - 5555:5555
-    restart: unless-stopped
+      - "8000:8000"
+      - "5555:5555"
+    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
+    restart: always
+```
+
+Save as `compose.yaml`, then run `podman-compose up -d`.
+
+### AppJail Director
+**.env**:
+
+```
+# .env
+
+DIRECTOR_PROJECT=paperless-ngx
+PUID=1000
+PGID=1000
+TZ=UTC
+PAPERLESS_ADMIN_USER=admin
+PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD>
+```
+
+**appjail-director.yml**:
+
+```yaml
+# appjail-director.yml
+
+options:
+  - virtualnet: ':<random> default'
+  - nat:
+services:
+  paperless-ngx:
+    name: paperless_ngx
+    options:
+      - container: 'boot args:--pull'
+      - expose: '8000:8000 proto:tcp'
+      - expose: '5555:5555 proto:tcp'
+    oci:
+      user: root
+      environment:
+        - PUID: !ENV '${PUID}'
+        - PGID: !ENV '${PGID}'
+        - TZ: !ENV '${TZ}'
+        - PAPERLESS_ADMIN_USER: !ENV '${PAPERLESS_ADMIN_USER}'
+        - PAPERLESS_ADMIN_PASSWORD: !ENV '${PAPERLESS_ADMIN_PASSWORD}'
+    volumes:
+      - paperless-ngx: /config
+volumes:
+  paperless-ngx:
+    device: '/path/to/containers/paperless-ngx'
 ```
 
+**Makejail**:
+
+```
+# Makejail
+
+ARG tag=latest
+
+OPTION overwrite=force
+OPTION from=ghcr.io/daemonless/paperless-ngx:${tag}
+```
+
+Save the files above, then run `appjail-director up`.
+
+**Note**: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
+
 ### Podman CLI
 
 ```bash
@@ -63,17 +122,73 @@ podman run -d --name paperless-ngx \
   -e PAPERLESS_ADMIN_USER=admin \
   -e PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD> \
   -v /path/to/containers/paperless-ngx:/config \
-  -v /path/to/containers/paperless-ngx/config/media/documents:/config/media/documents \
   ghcr.io/daemonless/paperless-ngx:latest
 ```
 
+Save as `run.sh`, then run `sh run.sh`.
+
+### AppJail
+
+```bash
+appjail oci run -Pd \
+  -o overwrite=force \
+  -o container="args:--pull" \
+  -o virtualnet=":<random> default" \
+  -o nat \
+  -o expose="8000:8000 proto:tcp" \
+  -o expose="5555:5555 proto:tcp" \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  -e TZ=UTC \
+  -e PAPERLESS_ADMIN_USER=admin \
+  -e PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD> \
+  -o fstab="/path/to/containers/paperless-ngx /config <pseudofs>" \
+  ghcr.io/daemonless/paperless-ngx:latest paperless-ngx
+```
+
+Save as `run.sh`, then run `sh run.sh`.
+
+**Note**: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
+
+### Bastille
+
+> [!WARNING]
+> Bastille's OCI support is **experimental**. It requires `buildah`, shares the host network stack (`inherit`), and persists image-declared volumes under `--data-path`.
+
+```yaml
+services:
+  paperless-ngx:
+    image: "ghcr.io/daemonless/paperless-ngx:latest"
+    container_name: paperless-ngx
+    network_mode: host  # jail shares host networking
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+      - PAPERLESS_ADMIN_USER=admin
+      - PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD>
+```
+
+Save as `podman-compose.yml`, then run `bastille up`. Or via CLI:
+
+```bash
+bastille create -O \
+  --env PUID=1000 \
+  --env PGID=1000 \
+  --env TZ=UTC \
+  --env PAPERLESS_ADMIN_USER=admin \
+  --env PAPERLESS_ADMIN_PASSWORD=<PAPERLESS_ADMIN_PASSWORD> \
+  --data-path /path/to/containers/paperless-ngx \
+  paperless-ngx ghcr.io/daemonless/paperless-ngx:latest inherit
+```
+
 ### Ansible
 
 ```yaml
 - name: Deploy paperless-ngx
   containers.podman.podman_container:
     name: paperless-ngx
-    image: ghcr.io/daemonless/paperless-ngx:latest
+    image: "ghcr.io/daemonless/paperless-ngx:latest"
     state: started
     restart_policy: always
     env:
@@ -87,9 +202,12 @@ podman run -d --name paperless-ngx \
       - "5555:5555"
     volumes:
       - "/path/to/containers/paperless-ngx:/config"
-      - "/path/to/containers/paperless-ngx/config/media/documents:/config/media/documents"
 ```
 
+Save as `paperless-ngx-deploy.yaml`, then run `ansible-playbook paperless-ngx-deploy.yaml`.
+
+Access at: `http://localhost:8000`
+
 ## Parameters
 
 ### Environment Variables
@@ -107,7 +225,6 @@ podman run -d --name paperless-ngx \
 | Path | Description |
 |------|-------------|
 | `/config` | Configuration directory |
-| `/config/media/documents` | Optional - the actual document store (originals, archive and thumbnails) |
 
 ### Ports
 
@@ -116,6 +233,14 @@ podman run -d --name paperless-ngx \
 | `8000` | TCP | Web UI |
 | `5555` | TCP | Flower monitoring UI available at '/flower', optional |
 
+## Upgrade to v3
+### Pre-Requisites
+Upgrading to Paperless-ngx v3 can only be performed from version 2.20.15. If you are running an older version, please upgrade to v2.20.15 before proceeding with the v3 upgrade.
+### Breaking Changes
+Paperless-ngx v3 introduced some changes to the configuration.  
+Read the official [v3 Migration Guide](https://docs.paperless-ngx.com/migration-v3/) to make sure you adapt your configuration so that it works with v3.
+### Database migration
+The DB migration will run automatically when the container starts.
 ## First time setup
 To configure the admin user with a password during the first startup, you can define some
 additional environment variables in your container file:
@@ -145,7 +270,7 @@ This directoru should contain these 3 directories:
 
 **Architectures:** amd64
 **User:** `bsd` (UID/GID via PUID/PGID, defaults to 1000:1000)
-**Base:** FreeBSD 15.0
+**Base:** FreeBSD 15
 
 ---
 
diff --git a/compose.yaml b/compose.yaml
index 1645e26..19ae577 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -27,6 +27,14 @@ x-daemonless:
       8000: "Web UI"
       5555: "Flower monitoring UI available at '/flower', optional"
   notes: |
+    ## Upgrade to v3
+    ### Pre-Requisites
+    Upgrading to Paperless-ngx v3 can only be performed from version 2.20.15. If you are running an older version, please upgrade to v2.20.15 before proceeding with the v3 upgrade.
+    ### Breaking Changes
+    Paperless-ngx v3 introduced some changes to the configuration.  
+    Read the official [v3 Migration Guide](https://docs.paperless-ngx.com/migration-v3/) to make sure you adapt your configuration so that it works with v3.
+    ### Database migration
+    The DB migration will run automatically when the container starts.
     ## First time setup
     To configure the admin user with a password during the first startup, you can define some
     additional environment variables in your container file:
@@ -73,7 +81,7 @@ services:
 
     volumes:
       - /path/to/containers/paperless-ngx:/config
-      - /path/to/documents:/config/media/documents
+#      - /path/to/documents:/config/media/documents
 
     ports:
       - 8000:8000
diff --git a/root/etc/cont-init.d/20-paperlessngx b/root/etc/cont-init.d/20-paperlessngx
old mode 100755
new mode 100644
index 354d1e8..f985a36
--- a/root/etc/cont-init.d/20-paperlessngx
+++ b/root/etc/cont-init.d/20-paperlessngx
@@ -8,11 +8,11 @@ chown -R bsd:bsd /config
 # Run a DB migration to make sure the database is initialized
 # and updated to the latest schema.
 echo [paperlessngx-migration] Running DB migration
-s6-setuidgid bsd cd /app/src /usr/local/bin/python3.12 manage.py migrate
+s6-setuidgid bsd cd /app/src/src uv run python manage.py migrate
 
 # Create superuser if env variable is defined
 if [ "x${PAPERLESS_ADMIN_USER}" != "x" ]; then
-  s6-setuidgid bsd cd /app/src /usr/local/bin/python3.12 manage.py manage_superuser
+  s6-setuidgid bsd cd /app/src/src uv run python manage.py manage_superuser
 
   echo "[paperlessngx-superuser] Superuser creation done"
 
diff --git a/root/etc/services.d/consumer/run b/root/etc/services.d/consumer/run
old mode 100755
new mode 100644
index 34ca64c..31ebe39
--- a/root/etc/services.d/consumer/run
+++ b/root/etc/services.d/consumer/run
@@ -5,8 +5,9 @@ readonly log_prefix="[cosumer]"
 
 echo "${log_prefix} Starting consumer..."
 
+HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
 
 # Standard start command for consumer
-exec /usr/local/bin/s6-setuidgid bsd cd /app/src \
-     /usr/local/bin/python3.12 manage.py document_consumer
+exec /usr/local/bin/s6-setuidgid bsd cd /app/src/src \
+     /app/venv/bin/python manage.py document_consumer
diff --git a/root/etc/services.d/flower/run b/root/etc/services.d/flower/run
old mode 100755
new mode 100644
index 79518bd..e0fe22b
--- a/root/etc/services.d/flower/run
+++ b/root/etc/services.d/flower/run
@@ -5,6 +5,7 @@ readonly log_prefix="[flower]"
 
 echo "${log_prefix} Starting flower..."
 
+HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
 
 # Standard start command for paperless-ngx
@@ -13,8 +14,8 @@ if [ "x${PAPERLESS_ENABLE_FLOWER}" != "x" ]; then
     echo "${log_prefix} Starting flower in 5s"
     sleep 5
 
-    exec /usr/local/bin/s6-setuidgid bsd cd /app/src \
-         /app/.local/bin/celery --app paperless flower --url-prefix=flower --loglevel INFO
+    exec /usr/local/bin/s6-setuidgid bsd cd /app/src/src \
+         /app/venv/bin/python -m celery --app paperless flower --url-prefix=flower --loglevel INFO
 else
     echo "${log_prefix} Not starting flower"
     # https://skarnet.org/software/s6/s6-svc.html
diff --git a/root/etc/services.d/paperlessngx/run b/root/etc/services.d/paperlessngx/run
old mode 100755
new mode 100644
index 0b2c56d..068cf82
--- a/root/etc/services.d/paperlessngx/run
+++ b/root/etc/services.d/paperlessngx/run
@@ -5,10 +5,10 @@ readonly log_prefix="[paperlessngx]"
 
 echo "${log_prefix} Starting paperless-ngx..."
 
+HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
 
 # Standard start command for paperless-ngx
-#/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd
 exec /usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd \
-     cd /app/src /app/.local/bin/granian --interface asginl \
-     --ws --loop uvloop paperless.asgi:application
+     cd /app/src/src /app/venv/bin/python -m granian \
+     --interface asginl --ws --loop uvloop paperless.asgi:application
\ No newline at end of file
diff --git a/root/etc/services.d/scheduler/run b/root/etc/services.d/scheduler/run
old mode 100755
new mode 100644
index 9ef60ab..e7f851e
--- a/root/etc/services.d/scheduler/run
+++ b/root/etc/services.d/scheduler/run
@@ -5,9 +5,10 @@ readonly log_prefix="[scheduler]"
 
 echo "${log_prefix} Starting schduler..."
 
+HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
 
 # Standard start command for scheduler
 #/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd
-exec /usr/local/bin/s6-setuidgid bsd cd /app/src \
-     /app/.local/bin/celery --app paperless beat --loglevel DEBUG -s /config/data/celerybeat-schedule
+exec /usr/local/bin/s6-setuidgid bsd cd /app/src/src \
+     /app/venv/bin/python -m celery --app paperless beat --loglevel DEBUG -s /config/data/celerybeat-schedule
diff --git a/root/etc/services.d/worker/run b/root/etc/services.d/worker/run
old mode 100755
new mode 100644
index c52f4c2..7ac2fa3
--- a/root/etc/services.d/worker/run
+++ b/root/etc/services.d/worker/run
@@ -5,9 +5,10 @@ readonly log_prefix="[worker]"
 
 echo "${log_prefix} Starting worker..."
 
+HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
 
 # Standard start command for worker
 #/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd
-exec /usr/local/bin/s6-setuidgid bsd cd /app/src \
-     /app/.local/bin/celery --app paperless worker --loglevel INFO --without-mingle --without-gossip
+exec /usr/local/bin/s6-setuidgid bsd cd /app/src/src \
+     /app/venv/bin/python -m celery --app paperless worker --loglevel INFO --without-mingle --without-gossip