diff --git a/group_vars/docker/services.yml b/group_vars/docker/services.yml
index 9c77bb9..dfe9501 100644
--- a/group_vars/docker/services.yml
+++ b/group_vars/docker/services.yml
@@ -21,7 +21,7 @@ services:
     db_user: "dawarich"
 
 # StarPunk image tag, built by CI in the StarPunk repo (bump to deploy a release)
-starpunk_version: "v2.1.0"
+starpunk_version: "v2.2.0"
 
 # StarPunk admin: Pocket ID user ID (sub) of phil
 starpunk_admin_sub: "5754855f-0a30-4755-9609-7294209e40f4"
diff --git a/roles/docker/README.md b/roles/docker/README.md
index ac88b53..2ae6113 100644
--- a/roles/docker/README.md
+++ b/roles/docker/README.md
@@ -58,7 +58,7 @@ Tags: each category file has a category tag, each service its own tag.
 |---|---|---|
 | `gotosocial` | GoToSocial | Pocket ID through env vars. Account domain is the apex; Caddy serves WebFinger there. Daily S3 backup of its volume. |
 | `listmonk` | Listmonk | Postgres 17. On `listmonk.nerder.land`. |
-| `starpunk` | StarPunk | Micropub server for the main site. Image built by the StarPunk repo's Gitea Actions on `vX.Y.Z` tags; deploy a release by bumping `starpunk_version`. Admin login via Pocket ID; issues its own Micropub tokens. Crossposts new notes to GoToSocial (token in `vault_starpunk.gotosocial_token`). |
+| `starpunk` | StarPunk | Micropub server for the main site. Image built by the StarPunk repo's Gitea Actions on `vX.Y.Z` tags; deploy a release by bumping `starpunk_version`. Admin login via Pocket ID; issues its own Micropub tokens. Crossposts new notes to GoToSocial (token in `vault_starpunk.gotosocial_token`) and Bluesky as phil.thesatelliteoflove.com (app password in `vault_starpunk.bluesky_app_password`). |
 
 ### Monitoring (`monitoring`)
 | Tag | Service | Notes |
diff --git a/roles/docker/templates/starpunk-compose.yml.j2 b/roles/docker/templates/starpunk-compose.yml.j2
index 87ce9d2..83d9d3c 100644
--- a/roles/docker/templates/starpunk-compose.yml.j2
+++ b/roles/docker/templates/starpunk-compose.yml.j2
@@ -30,6 +30,8 @@ services:
       # scopes write:statuses write:media)
       GOTOSOCIAL_URL: https://{{ subdomains.social }}
       GOTOSOCIAL_ACCESS_TOKEN: {{ vault_starpunk.gotosocial_token }}
+      BLUESKY_HANDLE: phil.thesatelliteoflove.com
+      BLUESKY_APP_PASSWORD: {{ vault_starpunk.bluesky_app_password }}
       # Production settings
       FLASK_ENV: production
       FLASK_DEBUG: 0