diff --git a/.release-notes.md b/.release-notes.md
index cb708b22..cd74ba99 100644
--- a/.release-notes.md
+++ b/.release-notes.md
@@ -4,49 +4,49 @@ This release adds a new **HTML to Image** tool (tool #53), full **WCAG 2.2 AA ac
 
 ## New Features
 
-- **HTML to Image** -- Capture screenshots of URLs or raw HTML as PNG/JPEG/WebP. Supports full-page captures, custom viewports, and dark mode. Built on Playwright Chromium with SSRF protection.
-- **Docker _FILE secret convention** -- Mount sensitive environment variables (passwords, API keys, OIDC secrets) as files instead of plain-text env vars. Supported for `DEFAULT_PASSWORD_FILE`, `S3_ACCESS_KEY_ID_FILE`, `S3_SECRET_ACCESS_KEY_FILE`, `OIDC_CLIENT_SECRET_FILE`, `COOKIE_SECRET_FILE`, and `SNAPOTTER_LICENSE_KEY_FILE`. (#205)
-- **Enterprise licensing and S3 storage** -- Optional commercial license key and S3-compatible object storage backend for enterprise deployments.
-- **Shape editor improvements** -- Fill/stroke transparency, RGBA color picker, and dash line styles in the image editor.
-- **Pre-built release archives** -- Download `snapotter-vX.Y.Z-linux-amd64.tar.gz` and `snapotter-vX.Y.Z-linux-arm64.tar.gz` from GitHub Releases for non-Docker installs (Proxmox, bare metal, LXC). (#202)
-- **Community roadmap** -- Feature requests and prioritization now tracked via GitHub Discussions with `now`/`next`/`later` labels.
+- **HTML to Image**: Capture screenshots of URLs or raw HTML as PNG/JPEG/WebP. Supports full-page captures, custom viewports, and dark mode. Built on Playwright Chromium with SSRF protection.
+- **Docker _FILE secret convention**: Mount sensitive environment variables (passwords, API keys, OIDC secrets) as files instead of plain-text env vars. Supported for `DEFAULT_PASSWORD_FILE`, `S3_ACCESS_KEY_ID_FILE`, `S3_SECRET_ACCESS_KEY_FILE`, `OIDC_CLIENT_SECRET_FILE`, `COOKIE_SECRET_FILE`, and `SNAPOTTER_LICENSE_KEY_FILE`. (#205)
+- **Enterprise licensing and S3 storage**: Optional commercial license key and S3-compatible object storage backend for enterprise deployments.
+- **Shape editor improvements**: Fill/stroke transparency, RGBA color picker, and dash line styles in the image editor.
+- **Pre-built release archives**: Download `snapotter-vX.Y.Z-linux-amd64.tar.gz` and `snapotter-vX.Y.Z-linux-arm64.tar.gz` from GitHub Releases for non-Docker installs (Proxmox, bare metal, LXC). (#202)
+- **Community roadmap**: Feature requests and prioritization now tracked via GitHub Discussions with `now`/`next`/`later` labels.
 
 ## Improvements
 
-- **WCAG 2.2 AA accessibility** -- Skip navigation, route announcer, focus trapping on all modals, `aria-live` regions for processing status, `prefers-reduced-motion` support, correct contrast ratios, and 44px minimum touch targets. All 49 hardcoded `aria-label` strings replaced with i18n keys across 25 components. (#209)
-- **Mobile responsiveness** -- Responsive settings dialog, homepage, navigation, and toast notifications. SSE connections now automatically reconnect when returning from a backgrounded mobile tab. (#203, #204)
-- **Background removal quality** -- Edge smoothing, color decontamination, and output format selection added to the remove-background tool.
-- **Italian translation** -- ~145 newly translated strings contributed by @albanobattistella. (#206)
-- **Per-tool API documentation** -- 53 individual VitePress doc pages with accurate parameters, example requests, and response formats. Root `llms.txt` added for LLM-friendly repo browsing.
-- **AI model downloads** -- Retry logic with exponential backoff for HuggingFace model downloads, preventing transient failures from blocking bundle installation. (#201)
+- **WCAG 2.2 AA accessibility**: Skip navigation, route announcer, focus trapping on all modals, `aria-live` regions for processing status, `prefers-reduced-motion` support, correct contrast ratios, and 44px minimum touch targets. All 49 hardcoded `aria-label` strings replaced with i18n keys across 25 components. (#209)
+- **Mobile responsiveness**: Responsive settings dialog, homepage, navigation, and toast notifications. SSE connections now automatically reconnect when returning from a backgrounded mobile tab. (#203, #204)
+- **Background removal quality**: Edge smoothing, color decontamination, and output format selection added to the remove-background tool.
+- **Italian translation**: ~145 newly translated strings contributed by @albanobattistella. (#206)
+- **Per-tool API documentation**: 53 individual VitePress doc pages with accurate parameters, example requests, and response formats. Root `llms.txt` added for LLM-friendly repo browsing.
+- **AI model downloads**: Retry logic with exponential backoff for HuggingFace model downloads, preventing transient failures from blocking bundle installation. (#201)
 
 ## Bug Fixes
 
-- **Docker: fresh containers were completely unusable** -- `RATE_LIMIT_PER_MIN=0` in the Dockerfile caused `@fastify/rate-limit` to block all API requests (including health checks) with HTTP 429. Fixed by treating 0 as unlimited (50,000/min).
-- **Docker: face detection AI tools failed on all platforms** -- blur-faces, red-eye-removal, enhance-faces, and passport-photo failed with "libGLESv2.so.2 not found". Fixed by adding `libgles2` to the Docker image.
-- **Docker: HEIC files broken on ARM** -- `heif-convert` crashed with "undefined symbol: heif_get_plugin_directories" on arm64 due to library version mismatch. Fixed with `LD_LIBRARY_PATH=/usr/local/lib` to prioritize the custom libheif 1.21.2 build.
-- **Docker: upscale and restore-photo AI bundles failed on ARM** -- `basicsr` could not build from source on arm64 because `wheel` and `setuptools` were missing from the Python venv. Fixed by pre-installing both packages.
-- **Docker: OCR used wrong CUDA version on GPU** -- PaddlePaddle resolved from PyPI (CUDA 11) instead of the CUDA 12.6 index, causing symbol errors on GPU containers. Fixed by changing `--extra-index-url` to `--index-url` for the cu126 package source.
-- **SSRF guard bypass via hex IPv4-mapped IPv6** -- The URL-fetch SSRF guard only handled the dotted form of `::ffff:` addresses. Hex-compressed forms like `[::ffff:7f00:1]` (127.0.0.1) bypassed the private IP check, allowing access to internal services and cloud metadata endpoints. (Reported by **tonghuaroot** via coordinated disclosure)
-- **iPhone HEIC support** -- Built libheif 1.21.2 from source to fix decoding of iPhone HEIC files with auxiliary images (depth maps, HDR gain maps). (#183, #199)
-- **Real-ESRGAN CUDA OOM on 8GB GPUs** -- Enabled tiling to prevent out-of-memory crashes when upscaling on GPUs with limited VRAM. (#200)
-- **6 production Sentry errors resolved** -- Fixed crashes from malformed inputs, edge cases in metadata handling, and error response formatting.
-- **7 bugs from QA sweep** -- Selective metadata stripping, meme font mapping, content type detection, and missing i18n keys. (#208)
-- **Cryptographic password generation** -- Replaced `Math.random()` with `crypto.getRandomValues()` for password generation.
-- **Docker Compose image name** -- Corrected the image name in `docker-compose.yml`. (#198)
+- **Docker: fresh containers were completely unusable**: `RATE_LIMIT_PER_MIN=0` in the Dockerfile caused `@fastify/rate-limit` to block all API requests (including health checks) with HTTP 429. Fixed by treating 0 as unlimited (50,000/min).
+- **Docker: face detection AI tools failed on all platforms**: blur-faces, red-eye-removal, enhance-faces, and passport-photo failed with "libGLESv2.so.2 not found". Fixed by adding `libgles2` to the Docker image.
+- **Docker: HEIC files broken on ARM**: `heif-convert` crashed with "undefined symbol: heif_get_plugin_directories" on arm64 due to library version mismatch. Fixed with `LD_LIBRARY_PATH=/usr/local/lib` to prioritize the custom libheif 1.21.2 build.
+- **Docker: upscale and restore-photo AI bundles failed on ARM**: `basicsr` could not build from source on arm64 because `wheel` and `setuptools` were missing from the Python venv. Fixed by pre-installing both packages.
+- **Docker: OCR used wrong CUDA version on GPU**: PaddlePaddle resolved from PyPI (CUDA 11) instead of the CUDA 12.6 index, causing symbol errors on GPU containers. Fixed by changing `--extra-index-url` to `--index-url` for the cu126 package source.
+- **SSRF guard bypass via hex IPv4-mapped IPv6**: The URL-fetch SSRF guard only handled the dotted form of `::ffff:` addresses. Hex-compressed forms like `[::ffff:7f00:1]` (127.0.0.1) bypassed the private IP check, allowing access to internal services and cloud metadata endpoints. (Reported by **@tonghuaroot** via coordinated disclosure)
+- **iPhone HEIC support**: Built libheif 1.21.2 from source to fix decoding of iPhone HEIC files with auxiliary images (depth maps, HDR gain maps). (#183, #199)
+- **Real-ESRGAN CUDA OOM on 8GB GPUs**: Enabled tiling to prevent out-of-memory crashes when upscaling on GPUs with limited VRAM. (#200)
+- **6 production Sentry errors resolved**: Fixed crashes from malformed inputs, edge cases in metadata handling, and error response formatting.
+- **7 bugs from QA sweep**: Selective metadata stripping, meme font mapping, content type detection, and missing i18n keys. (#208)
+- **Cryptographic password generation**: Replaced `Math.random()` with `crypto.getRandomValues()` for password generation.
+- **Docker Compose image name**: Corrected the image name in `docker-compose.yml`. (#198)
 
 ## Security
 
-- **Penetration test hardening** -- 10 findings from external security testing addressed: XFF rate-limit bypass (PT-01), malformed JSON 500 errors (PT-03), unbounded pipeline steps DoS (PT-04), clientJobId validation (PT-06), missing security headers on SSE streams (PT-07), audit log XSS (PT-08), TRACE method enabled (PT-10), missing 429 in OpenAPI spec (PT-12), unbounded SVGZ decompression (PT-13). (#207)
-- **SSRF hex IPv6 bypass** -- Blocked hex-compressed IPv4-mapped IPv6 addresses in the URL-fetch guard. (Credit: **tonghuaroot**)
-- **SVG XXE protection** -- Added test fixtures and validation for SVG XML external entity attacks.
-- **Dockerfile base images pinned by digest** -- Prevents supply chain attacks from mutable tags.
+- **Penetration test hardening**: 10 findings from external security testing addressed: XFF rate-limit bypass (PT-01), malformed JSON 500 errors (PT-03), unbounded pipeline steps DoS (PT-04), clientJobId validation (PT-06), missing security headers on SSE streams (PT-07), audit log XSS (PT-08), TRACE method enabled (PT-10), missing 429 in OpenAPI spec (PT-12), unbounded SVGZ decompression (PT-13). (#207)
+- **SSRF hex IPv6 bypass**: Blocked hex-compressed IPv4-mapped IPv6 addresses in the URL-fetch guard. (Credit: **@tonghuaroot**)
+- **SVG XXE protection**: Added test fixtures and validation for SVG XML external entity attacks.
+- **Dockerfile base images pinned by digest**: Prevents supply chain attacks from mutable tags.
 
 ## Acknowledgements
 
-- **tonghuaroot** -- For responsibly disclosing the SSRF guard bypass via hex IPv4-mapped IPv6 addresses. The detailed proof-of-concept and suggested fix made for a quick turnaround.
-- **@rudedog7106** -- For reporting HEIC decoding failures on TrueNAS/Docker. (#183)
-- **@albanobattistella** -- For contributing ~145 Italian translation strings. (#206)
+- **@tonghuaroot**: For responsibly disclosing the SSRF guard bypass via hex IPv4-mapped IPv6 addresses. The detailed proof-of-concept and suggested fix made for a quick turnaround.
+- **@rudedog7106**: For reporting HEIC decoding failures on TrueNAS/Docker. (#183)
+- **@albanobattistella**: For contributing ~145 Italian translation strings. (#206)
 
 ## Upgrade
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 00f09556..29f2ee7f 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -126,7 +126,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libde265-dev libx265-dev libjpeg-dev libpng-dev \
     && rm -rf /var/lib/apt/lists/*
 
-RUN curl -fsSL "https://github.com/strukturag/libheif/releases/download/v${LIBHEIF_VERSION}/libheif-${LIBHEIF_VERSION}.tar.gz" \
+RUN curl -fsSL --retry 3 --retry-delay 5 "https://github.com/strukturag/libheif/releases/download/v${LIBHEIF_VERSION}/libheif-${LIBHEIF_VERSION}.tar.gz" \
       | tar xz \
     && cmake -B build -S "libheif-${LIBHEIF_VERSION}" \
       -DCMAKE_INSTALL_PREFIX=/opt/libheif \