diff --git a/group_vars/docker/services.yml b/group_vars/docker/services.yml
index f858c2a..8a4922a 100644
--- a/group_vars/docker/services.yml
+++ b/group_vars/docker/services.yml
@@ -28,3 +28,6 @@ starpunk_admin_sub: "5754855f-0a30-4755-9609-7294209e40f4"
 
 # Gokapi super admin: must match the Pocket ID account email
 gokapi_admin_email: "phil@{{ primary_domain }}"
+
+# Paperless-ngx image tag. v3 can only be reached from 2.20.15.
+paperless_version: "2.20.15"
diff --git a/roles/docker/templates/paperlessngx-compose.yml.j2 b/roles/docker/templates/paperlessngx-compose.yml.j2
index ef37a6e..ab65dc2 100644
--- a/roles/docker/templates/paperlessngx-compose.yml.j2
+++ b/roles/docker/templates/paperlessngx-compose.yml.j2
@@ -6,7 +6,9 @@ services:
       - redisdata:/data
 
   webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    # Pinned: major versions need care (v3 could only be reached from
+    # 2.20.15). Bump deliberately after reading the release notes.
+    image: ghcr.io/paperless-ngx/paperless-ngx:{{ paperless_version }}
     restart: unless-stopped
     labels:
       # Stop during backup so the SQLite database in the data volume is consistent
@@ -29,6 +31,10 @@ services:
       PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
       PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'
+      # Caddy. v3's login rate limiting reads the client IP from it.
+      PAPERLESS_TRUSTED_PROXIES: "{{ docker.hairpin_ip }}"
+      # v3 accepts duplicates by default; keep rejecting them.
+      PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
 
   gotenberg:
     image: docker.io/gotenberg/gotenberg:8.39.0