diff --git a/stalwart/Chart.yaml b/stalwart/Chart.yaml
index 736e150..2c97412 100644
--- a/stalwart/Chart.yaml
+++ b/stalwart/Chart.yaml
@@ -18,18 +18,27 @@ type: application
 # all three of latest / v0.16 / v0.16.24 resolved to one digest pushed seconds
 # apart, so either floating name would change the running image with no commit
 # in this repository and nothing to report it.
-# MINOR, not major, and the evidence is a diff rather than a judgement. That
-# held for the per-group spread constraint and PodDisruptionBudget of Gitea #96
-# (both gated on the COMPUTED replica count being >= 2, and the chart ships
-# full: 1 / mx: 0) and it holds again for the MTA-STS routes of Gitea #123: the
-# list is the switch and it ships EMPTY, so no object is added and no value
-# becomes required in either routing mode. `helm template` against the previous
-# version renders byte-for-byte identically for the defaults AND for
-# ci/stalwart/test-values.yaml as it stands on origin/main - measured, both
-# empty diffs. New optional values with unchanged defaults is exactly the minor
-# case (README, "Versioning").
-version: 2.0.0+upv0.16.25
-appVersion: "v0.16.25"
+# MAJOR for Gitea #5, and the reason is that the test the two MINOR rounds
+# below passed is the one this round FAILS. Those rounds argued from a diff:
+# the spread constraint and PodDisruptionBudget of #96 (both gated on the
+# COMPUTED replica count being >= 2, with the chart shipping full: 1 / mx: 0)
+# and the MTA-STS routes of #123 (the list is the switch and it ships EMPTY)
+# added no object and made no value required, so `helm template` against the
+# previous version rendered byte-for-byte identically for the defaults AND for
+# ci/stalwart/test-values.yaml - measured, both empty diffs. New optional
+# values with unchanged defaults is exactly the minor case.
+#
+# #5 is the opposite on every count. networkPolicy.ingressController is new,
+# the policy's rendered form changes, and - the part that decides it - the
+# object reaches a RUNNING release on the next upgrade and changes what can
+# reach the pod. A wrong source there makes a service mute, which is precisely
+# the breaking-change case (README, "Versioning"). The app-version patch
+# Renovate landed as 1.3.1 is absorbed by this major rather than added to it.
+#
+# Note for whoever bumps this next: the suffix tracks appVersion, so a major
+# here keeps the +up<appVersion> it was merged with.
+version: 2.0.0+upv0.16.26
+appVersion: "v0.16.26"
 
 maintainers:
   - name: jklein