diff --git a/charts/docker-mailserver/Chart.yaml b/charts/docker-mailserver/Chart.yaml
index 1154e6b..55feed8 100644
--- a/charts/docker-mailserver/Chart.yaml
+++ b/charts/docker-mailserver/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: "15.1.0"
+appVersion: "16.0.1"
 description: A fullstack but simple mailserver (smtp, imap, antispam, antivirus, ssl...) using Docker.
 name: docker-mailserver
 version: 5.1.1
@@ -19,6 +19,7 @@ icon: https://avatars.githubusercontent.com/u/76868633?s=400&v=4
 
 annotations:
   artifacthub.io/changes: |
-    - Breaking : Standardized app labels to app.kubernetes.io/name for Istio workload/Cilium compatibility
+    - Breaking : Upgrade to docker-mailserver 16 (Debian 13, Dovecot 2.4)
+    - Breaking : Full text search uses Dovecot flatcurve instead of fts-xapian
 
 dependencies: []
diff --git a/charts/docker-mailserver/README.md b/charts/docker-mailserver/README.md
index bfb6a72..26c87df 100644
--- a/charts/docker-mailserver/README.md
+++ b/charts/docker-mailserver/README.md
@@ -18,6 +18,8 @@
   - [Backing Storage](#backing-storage)
     - [Generic / All](#generic--all)
     - [NFS](#nfs)
+- [Upgrading to Version 6](#upgrading-to-version-6)
+- [Upgrading to Version 5](#upgrading-to-version-5)
 - [Upgrading to Version 3.0.0](#upgrading-to-version-3)
 - [Development](#development)
   - [Testing](#testing)
@@ -295,6 +297,53 @@ DMS utilizes neither group-only chown as nfsnobody/root, fsGroup applied to all
 
 Quirks from the generic section also apply to NFS-backed PersistentVolumes.
 
+## Upgrading to Version 6
+Version 6.0 upgrades docker-mailserver to version 16, which moves from Debian 12 to Debian 13 and from Dovecot 2.3 to Dovecot 2.4. Read the [docker-mailserver v16 changelog](https://github.com/docker-mailserver/docker-mailserver/blob/master/CHANGELOG.md) before upgrading.
+
+### Dovecot 2.4
+
+Dovecot 2.4 does not load configuration written with 2.3 syntax. If you added Dovecot configuration through `configMaps` (for example a custom `15-mailboxes.conf`) or a `dovecot.cf` file, check it before upgrading. You can validate it against the new image with:
+
+```console
+docker run --rm --entrypoint doveconf \
+  -v ./my.conf:/etc/dovecot/conf.d/99-my.conf:ro \
+  mailserver/docker-mailserver:16.0.1 -n
+```
+
+The `dovecot.cf` file the chart generates for PROXY protocol support works with both versions.
+
+### Full Text Search
+
+Full text search now uses Dovecot's [flatcurve](https://doc.dovecot.org/latest/core/plugins/fts_flatcurve.html) plugin instead of fts-xapian, which is no longer supported by docker-mailserver. The configuration file moved from `/etc/dovecot/conf.d/10-plugin.conf` to `/etc/dovecot/conf.d/90-fts-flatcurve.conf`.
+
+The `dovecot.fullTextSearch` values changed:
+
+* `verbose` was replaced by `debug` (true or false)
+* `cron` was removed because flatcurve optimizes its indexes automatically
+* `substringSearch` was added. It defaults to `true`, which matches the partial word matching of the previous xapian configuration
+* `resources.memory` is unchanged
+
+Attachments are no longer indexed because docker-mailserver 16 no longer includes the `decode2text` script.
+
+Existing xapian indexes are not used by flatcurve. After upgrading, build the new indexes and then remove the old ones:
+
+```console
+kubectl exec -it deploy/docker-mailserver -- doveadm index -A -q '*'
+kubectl exec -it deploy/docker-mailserver -- find /var/mail -type d -name xapian-indexes -prune -exec rm -rf {} +
+```
+
+### Environment Variables
+
+`SA_SPAM_SUBJECT` was removed in docker-mailserver 16. Use `SPAM_SUBJECT` instead.
+
+### Pod Security Context
+
+Previously the deployment ignored `deployment.securityContext` and instead read a top-level `securityContext` key that `values.yaml` did not define, so by default no pod security context was set. The deployment now uses `deployment.securityContext`, which defaults to `{}`, so the default behavior is unchanged.
+
+If you set `deployment.securityContext` in your values, it will now be applied. docker-mailserver must run as root because it manages the users its services run as, so don't set `runAsUser`, `runAsGroup` or `runAsNonRoot` (the previous default of `runAsUser: 5000` would stop the pod from starting).
+
+A top-level `securityContext` is still used if `deployment.securityContext` is empty, but move it to `deployment.securityContext` since this fallback may be removed in a future version.
+
 ## Upgrading to Version 5
 Version 5.0 of the chart *does* include backwards incompatible changes.
 
diff --git a/charts/docker-mailserver/tests/__snapshot__/configmap_test.yaml.snap b/charts/docker-mailserver/tests/__snapshot__/configmap_test.yaml.snap
index e8bf0c9..f918b82 100644
--- a/charts/docker-mailserver/tests/__snapshot__/configmap_test.yaml.snap
+++ b/charts/docker-mailserver/tests/__snapshot__/configmap_test.yaml.snap
@@ -37,7 +37,7 @@ manifest should match snapshot:
   2: |
     apiVersion: v1
     data:
-      fts-xapian-plugin.conf: ""
+      fts-flatcurve.conf: ""
     kind: ConfigMap
     metadata:
       labels:
@@ -45,14 +45,14 @@ manifest should match snapshot:
         chart: docker-mailserver-0.1.0
         heritage: Helm
         release: RELEASE-NAME
-      name: fts-xapian-plugin-conf
+      name: fts-flatcurve-conf
   3: |
     apiVersion: v1
     data:
       user-patches.sh: |
         #!/bin/bash
         # NOTE: Keep in sync with upstream advice:
-        # https://github.com/docker-mailserver/docker-mailserver/blob/v15.0.0/docs/content/examples/tutorials/mailserver-behind-proxy.md?plain=1#L238-L268
+        # https://github.com/docker-mailserver/docker-mailserver/blob/v16.0.1/docs/content/examples/tutorials/mailserver-behind-proxy.md
 
         # Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
         postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf
diff --git a/charts/docker-mailserver/tests/__snapshot__/deployment_test.yaml.snap b/charts/docker-mailserver/tests/__snapshot__/deployment_test.yaml.snap
index 64cc673..79138cf 100644
--- a/charts/docker-mailserver/tests/__snapshot__/deployment_test.yaml.snap
+++ b/charts/docker-mailserver/tests/__snapshot__/deployment_test.yaml.snap
@@ -303,9 +303,9 @@ manifest should match snapshot:
                 - mountPath: /tmp/docker-mailserver/dovecot.cf
                   name: dovecot-cf
                   subPath: dovecot.cf
-                - mountPath: /etc/dovecot/conf.d/10-plugin.conf
-                  name: fts-xapian-plugin-conf
-                  subPath: fts-xapian-plugin.conf
+                - mountPath: /etc/dovecot/conf.d/90-fts-flatcurve.conf
+                  name: fts-flatcurve-conf
+                  subPath: fts-flatcurve.conf
                 - mountPath: /tmp/docker-mailserver/user-patches.sh
                   name: user-patches-sh
                   subPath: user-patches.sh
@@ -328,8 +328,8 @@ manifest should match snapshot:
                 name: dovecot-cf
               name: dovecot-cf
             - configMap:
-                name: fts-xapian-plugin-conf
-              name: fts-xapian-plugin-conf
+                name: fts-flatcurve-conf
+              name: fts-flatcurve-conf
             - configMap:
                 name: user-patches-sh
               name: user-patches-sh
diff --git a/charts/docker-mailserver/tests/__snapshot__/secret_test.yaml.snap b/charts/docker-mailserver/tests/__snapshot__/secret_test.yaml.snap
index 33c101b..3c4b4f3 100644
--- a/charts/docker-mailserver/tests/__snapshot__/secret_test.yaml.snap
+++ b/charts/docker-mailserver/tests/__snapshot__/secret_test.yaml.snap
@@ -303,9 +303,9 @@ manifest should match snapshot:
                 - mountPath: /tmp/docker-mailserver/dovecot.cf
                   name: dovecot-cf
                   subPath: dovecot.cf
-                - mountPath: /etc/dovecot/conf.d/10-plugin.conf
-                  name: fts-xapian-plugin-conf
-                  subPath: fts-xapian-plugin.conf
+                - mountPath: /etc/dovecot/conf.d/90-fts-flatcurve.conf
+                  name: fts-flatcurve-conf
+                  subPath: fts-flatcurve.conf
                 - mountPath: /tmp/docker-mailserver/user-patches.sh
                   name: user-patches-sh
                   subPath: user-patches.sh
@@ -331,8 +331,8 @@ manifest should match snapshot:
                 name: dovecot-cf
               name: dovecot-cf
             - configMap:
-                name: fts-xapian-plugin-conf
-              name: fts-xapian-plugin-conf
+                name: fts-flatcurve-conf
+              name: fts-flatcurve-conf
             - configMap:
                 name: user-patches-sh
               name: user-patches-sh
diff --git a/charts/docker-mailserver/values.yaml b/charts/docker-mailserver/values.yaml
index 4defca3..8556e5a 100644
--- a/charts/docker-mailserver/values.yaml
+++ b/charts/docker-mailserver/values.yaml
@@ -447,14 +447,17 @@ rspamd:
       secret:
 
 dovecot:
+  # Full text search using Dovecot's flatcurve plugin. See
+  # https://docker-mailserver.github.io/docker-mailserver/latest/config/advanced/full-text-search/
   fullTextSearch:
     enabled: false
-    verbose: 0 # 0 (silent), 1 (verbose) or 2 (debug)
+    # Match partial words (like the previous xapian partial=3 setting). Makes the index much larger.
+    substringSearch: true
+    # Log flatcurve debug messages
+    debug: false
     resources:
-      memory: 2GB
-    cron:
-      enabled: true       # Optimize index every day
-      schedule: 0 4 * * * # Every day at 4am
+      # Limit the RAM usage of each indexer-worker process, ex: 512M, 1G, 2G
+      memory: 2G
 
 proxyProtocol:
   enabled: true
@@ -576,27 +579,48 @@ configMaps:
         {{- end -}}
       {{- end -}}
 
-  fts-xapian-plugin.conf:
+  fts-flatcurve.conf:
     create: true
-    path: /etc/dovecot/conf.d/10-plugin.conf
+    path: /etc/dovecot/conf.d/90-fts-flatcurve.conf
     data: |
       {{- if .Values.dovecot.fullTextSearch.enabled }}
-        mail_plugins = $mail_plugins fts fts_xapian
+        mail_plugins {
+          fts = yes
+          fts_flatcurve = yes
+        }
+
+        fts_autoindex = yes
 
-        plugin {
-            fts = xapian
-            fts_xapian = partial=3 full=20 verbose={{ .Values.dovecot.fullTextSearch.verbose }}
+        # Don't spend time indexing mail that is about to be deleted
+        namespace inbox {
+          mailbox Trash {
+            fts_autoindex = no
+          }
+          mailbox Junk {
+            fts_autoindex = no
+          }
+        }
 
-            fts_autoindex = yes
-            fts_enforced = yes
+        language_filters = normalizer-icu snowball stopwords
+        language_tokenizers = generic email-address
+        language_tokenizer_generic_algorithm = simple
 
-            # Index attachements
-            fts_decoder = decode2text
+        language en {
+          default = yes
+          filters = lowercase snowball english-possessive stopwords
         }
 
+        fts flatcurve {
+          substring_search = {{ ternary "yes" "no" .Values.dovecot.fullTextSearch.substringSearch }}
+        }
+
+        {{- if .Values.dovecot.fullTextSearch.debug }}
+
+        log_debug = category=fts-flatcurve
+        {{- end }}
+
         service indexer-worker {
-            # limit size of indexer-worker RAM usage, ex: 512MB, 1GB, 2GB
-            vsz_limit = {{ .Values.dovecot.fullTextSearch.resources.memory }}
+          vsz_limit = {{ .Values.dovecot.fullTextSearch.resources.memory }}
         }
       {{- end -}}
 
@@ -608,7 +632,7 @@ configMaps:
 
       {{- if .Values.proxyProtocol.enabled }}
       # NOTE: Keep in sync with upstream advice:
-      # https://github.com/docker-mailserver/docker-mailserver/blob/v15.0.0/docs/content/examples/tutorials/mailserver-behind-proxy.md?plain=1#L238-L268
+      # https://github.com/docker-mailserver/docker-mailserver/blob/v16.0.1/docs/content/examples/tutorials/mailserver-behind-proxy.md
 
       # Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
       postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf