diff --git a/docker/chatmail_relay.dockerfile b/docker/chatmail_relay.dockerfile
index 67640d33..285c2451 100644
--- a/docker/chatmail_relay.dockerfile
+++ b/docker/chatmail_relay.dockerfile
@@ -61,6 +61,9 @@ RUN CMDEPLOY_STAGES=install \
 RUN cp -a www/ /opt/chatmail-www/
 
 RUN rm -f /tmp/chatmail.ini
+
+# Record image version for upgrade detection at runtime
+RUN git rev-parse HEAD > /etc/chatmail-image-version 2>/dev/null || echo "unknown" > /etc/chatmail-image-version
 # --- End build-time install ---
 
 ENV CHATMAIL_INI=/etc/chatmail/chatmail.ini
diff --git a/docker/files/setup_chatmail_docker.sh b/docker/files/setup_chatmail_docker.sh
index b8329803..3aa275e0 100755
--- a/docker/files/setup_chatmail_docker.sh
+++ b/docker/files/setup_chatmail_docker.sh
@@ -24,9 +24,33 @@ if [ ! -f "$CHATMAIL_INI" ]; then
     $CMDEPLOY init --config "$CHATMAIL_INI" "$MAIL_DOMAIN"
 fi
 
-export CMDEPLOY_STAGES="${CMDEPLOY_STAGES:-configure,activate}"
+# Auto-detect image upgrades: if the image version changed since last run,
+# include the install stage so new packages/binaries are picked up.
+IMAGE_VERSION_FILE="/etc/chatmail-image-version"
+RUNNING_VERSION_FILE="/home/.chatmail-running-version"
+CMDEPLOY_STAGES="${CMDEPLOY_STAGES:-configure,activate}"
+if [ -f "$IMAGE_VERSION_FILE" ]; then
+    image_ver=$(cat "$IMAGE_VERSION_FILE")
+    running_ver=""
+    if [ -f "$RUNNING_VERSION_FILE" ]; then
+        running_ver=$(cat "$RUNNING_VERSION_FILE")
+    fi
+    if [ "$image_ver" != "$running_ver" ]; then
+        echo "[INFO] Image version changed ($running_ver -> $image_ver), adding install stage."
+        case "$CMDEPLOY_STAGES" in
+            *install*) ;;  # already includes install
+            *) CMDEPLOY_STAGES="install,$CMDEPLOY_STAGES" ;;
+        esac
+    fi
+fi
+export CMDEPLOY_STAGES
 $CMDEPLOY run --config "$CHATMAIL_INI" --ssh-host @local
 
+# Record successful version after deploy
+if [ -f "$IMAGE_VERSION_FILE" ]; then
+    cp "$IMAGE_VERSION_FILE" "$RUNNING_VERSION_FILE"
+fi
+
 # Journald: forward to console for docker logs (idempotent)
 grep -q '^ForwardToConsole=yes' /etc/systemd/journald.conf \
     || echo "ForwardToConsole=yes" >> /etc/systemd/journald.conf