diff --git a/Dockerfile b/Dockerfile
index 5c76e55..147642b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,7 @@ FROM public.ecr.aws/docker/library/node:20-alpine AS wasm
 
 WORKDIR /tmp/pkgs
 
-# Pinned versions match upstream's CDN_DEFAULTS in wasm-provider.ts at v2.8.4.
+# Pinned versions match upstream's CDN_DEFAULTS in wasm-provider.ts at v2.8.7.
 # Bump these together with the BentoPDF base image tag.
 ARG PYMUPDF_VERSION=0.11.16
 ARG GS_VERSION=0.1.1
@@ -35,7 +35,7 @@ RUN set -eux; \
     mv cpdf/dist/*   cpdf/ && rmdir cpdf/dist
 
 # ---- final stage: layer onto upstream's prebuilt -simple image -------------
-FROM ghcr.io/alam00000/bentopdf-simple:v2.8.4
+FROM ghcr.io/alam00000/bentopdf-simple:v2.8.7
 
 COPY --from=wasm --chown=nginx:nginx /tmp/pkgs/pymupdf/ /usr/share/nginx/html/wasm/pymupdf/
 COPY --from=wasm --chown=nginx:nginx /tmp/pkgs/gs/      /usr/share/nginx/html/wasm/gs/
diff --git a/package-lock.json b/package-lock.json
index e408b37..38c6200 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "name": "bentopdf-startos",
       "dependencies": {
-        "@start9labs/start-sdk": "2.0.5"
+        "@start9labs/start-sdk": "2.0.9"
       },
       "devDependencies": {
         "@types/node": "^22.19.0",
@@ -61,9 +61,9 @@
       "license": "MIT"
     },
     "node_modules/@start9labs/start-sdk": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@start9labs/start-sdk/-/start-sdk-2.0.5.tgz",
-      "integrity": "sha512-g6F4n24MhSb1rLGYnxJTt0EdZ6mZzTyAGiggsPyEqZ59uMoo1NxWWlDV5ico71kR3qMUufr373anCUtpSW/lSQ==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/@start9labs/start-sdk/-/start-sdk-2.0.9.tgz",
+      "integrity": "sha512-HuSYrS10Bb+f6OyAMlCzd5Qyr+rIauiI0dF8MVh5Ny+eU0gF8/DeFAXlHFgL+9wkSv4UAP5q5yOzlBpXzsNbWQ==",
       "bundleDependencies": [
         "@start9labs/start-core",
         "eslint",
@@ -74,7 +74,7 @@
         "@iarna/toml": "^3.0.0",
         "@noble/curves": "^1.9.7",
         "@noble/hashes": "^1.8.0",
-        "@start9labs/start-core": "file:../../shared-libs/ts-modules/start-core/dist",
+        "@start9labs/start-core": "file:./node_modules/@start9labs/start-core",
         "@types/ini": "^4.1.1",
         "deep-equality-data-structures": "^2.0.0",
         "eslint": "^9.39.4",
diff --git a/package.json b/package.json
index 85ddcaf..4551351 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@start9labs/start-sdk": "2.0.5"
+    "@start9labs/start-sdk": "2.0.9"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",
diff --git a/s9pk.mk b/s9pk.mk
index 25538af..7b1606c 100644
--- a/s9pk.mk
+++ b/s9pk.mk
@@ -6,7 +6,12 @@ INGREDIENTS := $(shell start-cli s9pk list-ingredients 2>/dev/null)
 # Resolve the actual git dir so this works inside git worktrees, where .git
 # is a file pointing at <main>/.git/worktrees/<name> rather than a directory.
 GIT_DIR := $(shell git rev-parse --git-dir 2>/dev/null)
-GIT_DEPS := $(if $(GIT_DIR),$(GIT_DIR)/HEAD $(GIT_DIR)/index)
+# These are rebuild triggers (the manifest embeds the commit hash), not build
+# requirements — pack degrades to a null gitHash on its own. $(wildcard) drops
+# whichever don't exist: a freshly `git init`ed repo has no index until the
+# first `git add`, and a hard prerequisite on it halts make with "No rule to
+# make target".
+GIT_DEPS := $(if $(GIT_DIR),$(wildcard $(GIT_DIR)/HEAD $(GIT_DIR)/index))
 ARCHES ?= x86 arm riscv
 # TARGETS is the list of leaf make-targets the build matrix fans out over.
 # Defaults to the arches; variant packages override (e.g. immich, ollama, vllm
@@ -63,12 +68,12 @@ x86 x86_64: arch/x86_64
 arm arm64 aarch64: arch/aarch64
 riscv riscv64: arch/riscv64
 
-$(BASE_NAME).s9pk: $(INGREDIENTS) $(GIT_DEPS)
+$(BASE_NAME).s9pk: $(INGREDIENTS) $(GIT_DEPS) | check-deps
 	@$(MAKE) --no-print-directory ingredients
 	@echo "   Packing '$@'..."
 	start-cli s9pk pack -o $@
 
-$(BASE_NAME)_%.s9pk: $(INGREDIENTS) $(GIT_DEPS)
+$(BASE_NAME)_%.s9pk: $(INGREDIENTS) $(GIT_DEPS) | check-deps
 	@$(MAKE) --no-print-directory ingredients
 	@echo "   Packing '$@'..."
 	start-cli s9pk pack --arch=$* -o $@
@@ -77,33 +82,18 @@ ingredients: $(INGREDIENTS)
 	@echo "   Re-evaluating ingredients..."
 
 install: | check-deps check-init
-	@HOST=$$(awk -F'/' '/^host:/ {print $$3}' ~/.startos/config.yaml); \
-	if [ -z "$$HOST" ]; then \
-		echo "Error: You must define \"host: http://server-name.local\" in ~/.startos/config.yaml"; \
-		exit 1; \
-	fi; \
-	S9PK=$$(ls -t *.s9pk 2>/dev/null | head -1); \
-	if [ -z "$$S9PK" ]; then \
+	@if [ -z "$$(ls *.s9pk 2>/dev/null)" ]; then \
 		echo "Error: No .s9pk file found. Run 'make' first."; \
 		exit 1; \
 	fi; \
-	printf "\n🚀 Installing %s to %s ...\n" "$$S9PK" "$$HOST"; \
+	S9PK=$$(start-cli s9pk select) || exit 1; \
+	printf "\n🚀 Installing %s ...\n" "$$S9PK"; \
 	start-cli package install -s "$$S9PK"
 
 publish: | all
-	@REGISTRY=$$(awk -F'/' '/^registry:/ {print $$3}' ~/.startos/config.yaml); \
-	if [ -z "$$REGISTRY" ]; then \
-		echo "Error: You must define \"registry: https://my-registry.tld\" in ~/.startos/config.yaml"; \
-		exit 1; \
-	fi; \
-	S3BASE=$$(awk -F'/' '/^s9pk-s3base:/ {print $$3}' ~/.startos/config.yaml); \
-	if [ -z "$$S3BASE" ]; then \
-		echo "Error: You must define \"s3base: https://s9pks.my-s3-bucket.tld\" in ~/.startos/config.yaml"; \
-		exit 1; \
-	fi; \
-	command -v s3cmd >/dev/null || \
+	@command -v s3cmd >/dev/null || \
 		(echo "Error: s3cmd not found. It must be installed to publish using s3." && exit 1); \
-	printf "\n🚀 Publishing to %s; indexing on %s ...\n" "$$S3BASE" "$$REGISTRY"; \
+	printf "\n🚀 Publishing ...\n"; \
 	for s9pk in *.s9pk; do \
 		age=$$(( $$(date +%s) - $$(stat -c %Y "$$s9pk") )); \
 		if [ "$$age" -gt 3600 ]; then \
@@ -116,9 +106,13 @@ publish: | all
 
 check-deps:
 	@command -v start-cli >/dev/null || \
-		(echo "Error: start-cli not found. Please see https://docs.start9.com/latest/developer-guide/sdk/installing-the-sdk" && exit 1)
+		(echo "Error: start-cli not found. See https://docs.start9.com/packaging/environment-setup.html" && exit 1)
 	@command -v npm >/dev/null || \
-		(echo "Error: npm not found. Please install Node.js and npm." && exit 1)
+		(echo "Error: npm not found. Install Node.js and npm. See https://docs.start9.com/packaging/environment-setup.html" && exit 1)
+	@command -v git >/dev/null || \
+		(echo "Error: git not found. Install git. See https://docs.start9.com/packaging/environment-setup.html" && exit 1)
+	@command -v jq >/dev/null || \
+		(echo "Error: jq not found. Install jq. See https://docs.start9.com/packaging/environment-setup.html" && exit 1)
 
 check-init:
 	@if [ ! -f ~/.startos/developer.key.pem ]; then \
@@ -128,14 +122,12 @@ check-init:
 
 javascript/index.js: $(shell find startos -type f) tsconfig.json node_modules
 	npm run check
+	@if [ -f node_modules/@start9labs/start-sdk/lint.mjs ]; then node node_modules/@start9labs/start-sdk/lint.mjs; else echo "   ⚠ SDK lint runner not found; skipping (update @start9labs/start-sdk)"; fi
 	npm run build
 
-node_modules: package-lock.json
+node_modules: package-lock.json package.json
 	npm ci
 
-package-lock.json: package.json
-	npm i
-
 clean:
 	@echo "Cleaning up build artifacts..."
 	@rm -rf $(PACKAGE_ID).s9pk $(PACKAGE_ID)_x86_64.s9pk $(PACKAGE_ID)_aarch64.s9pk $(PACKAGE_ID)_riscv64.s9pk javascript node_modules
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index 641fef5..7f04084 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,14 +1,18 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '2.8.4:1',
+  version: '2.8.7:0',
   releaseNotes: {
-    en_US: 'Rebuilt on StartOS SDK 2.0.5. No changes to functionality.',
+    en_US:
+      'Updates BentoPDF to v2.8.7, a security release that fixes vulnerabilities present in all earlier versions — upgrading is strongly recommended. Also brings the v2.8.5–v2.8.6 improvements (custom rotate, alternate/mix pages, split-PDF refactor, multi-tool drag-and-drop) and OCR, HEIC, and email-parsing fixes. Rebuilt on StartOS SDK 2.0.9.',
     es_ES:
-      'Reconstruido con StartOS SDK 2.0.5. Sin cambios en la funcionalidad.',
-    de_DE: 'Neu erstellt mit StartOS SDK 2.0.5. Keine funktionalen Änderungen.',
-    pl_PL: 'Przebudowano na StartOS SDK 2.0.5. Bez zmian w funkcjonalności.',
-    fr_FR: 'Reconstruit avec le SDK StartOS 2.0.5. Aucun changement fonctionnel.',
+      'Actualiza BentoPDF a v2.8.7, una versión de seguridad que corrige vulnerabilidades presentes en todas las versiones anteriores — se recomienda encarecidamente actualizar. También incluye las mejoras de v2.8.5–v2.8.6 (rotación personalizada, páginas alternas/mixtas, refactorización de la división de PDF, arrastrar y soltar en la multiherramienta) y correcciones de OCR, HEIC y análisis de correo. Reconstruido con StartOS SDK 2.0.9.',
+    de_DE:
+      'Aktualisiert BentoPDF auf v2.8.7, eine Sicherheitsversion, die Schwachstellen in allen früheren Versionen behebt — ein Update wird dringend empfohlen. Enthält außerdem die Verbesserungen aus v2.8.5–v2.8.6 (benutzerdefinierte Drehung, alternierende/gemischte Seiten, Split-PDF-Überarbeitung, Multi-Tool-Drag-and-Drop) sowie Korrekturen für OCR, HEIC und E-Mail-Verarbeitung. Neu erstellt mit StartOS SDK 2.0.9.',
+    pl_PL:
+      'Aktualizuje BentoPDF do v2.8.7 — wydania bezpieczeństwa naprawiającego podatności obecne we wszystkich wcześniejszych wersjach; zdecydowanie zalecana aktualizacja. Zawiera też usprawnienia z v2.8.5–v2.8.6 (własny obrót, naprzemienne/mieszane strony, przebudowa dzielenia PDF, przeciąganie i upuszczanie w multinarzędziu) oraz poprawki OCR, HEIC i analizy e-maili. Przebudowano na StartOS SDK 2.0.9.',
+    fr_FR:
+      'Met à jour BentoPDF vers la v2.8.7, une version de sécurité corrigeant des vulnérabilités présentes dans toutes les versions antérieures — la mise à jour est fortement recommandée. Inclut aussi les améliorations des v2.8.5–v2.8.6 (rotation personnalisée, pages alternées/mixtes, refonte de la division de PDF, glisser-déposer multi-outils) et des corrections OCR, HEIC et d’analyse d’e-mails. Reconstruit avec le SDK StartOS 2.0.9.',
   },
   migrations: {
     up: async ({ effects }) => {},