diff --git a/forum/README.md b/forum/README.md
index 173f6664..a968ae73 100644
--- a/forum/README.md
+++ b/forum/README.md
@@ -72,7 +72,7 @@ Installed there on 2026-10-11. Things specific to this server:
 - the forum folder is `/volume2/web/oldcomputers-forum`.
 
 No Composer is needed on the server: `make forum-bundle` builds `forum/import/forum.tar.gz`, a
-complete Flarum 2 tree (PHP 8.4) with the Embed and museum extensions and a top-level
+complete Flarum 2 tree (PHP 8.4) with the Embed, anti-spam and museum extensions and a top-level
 `.htaccess` that routes every request into `public/`, so `config.php`, `storage/` and `vendor/`
 are never served. This layout is tested in the local image.
 
@@ -90,8 +90,8 @@ are never served. This layout is tested in the local image.
    installer first becomes its administrator.
 5. Enable the extensions Nicknames, Embed and "Old-Computers museum" (admin panel, or
    `php flarum extension:enable` with `flarum-nicknames`, `flarum-embed`, `oc-museum`). Tags is enabled by default.
-6. In the admin panel: e-mail settings (registration confirms addresses by e-mail), and a spam
-   filter extension. Schedule a database dump.
+6. In the admin panel: e-mail settings (registration confirms addresses by e-mail). Enable the
+   spam filter (`fof-anti-spam`). Schedule a database dump.
 7. Import, from a shell on the server (SSH, or a one-off Task Scheduler script run as `http`),
    in the forum folder (copy `import/machines.json` there first):
 
@@ -100,9 +100,26 @@ are never served. This layout is tested in the local image.
    then bring `forum.json` back as `data/forum.json`, set `params.forum.url`, `make content`,
    `make deploy`.
 
-To update the forum or the extension later: rebuild the bundle, unpack it over the existing
-folder (it contains no `config.php` and no user data), then `php flarum migrate` and
-`php flarum cache:clear`.
+To update the forum or the extension later: dump the database, rebuild the bundle, unpack it over
+the existing folder (it contains no `config.php`), then `php flarum migrate` and
+`php flarum cache:clear`:
+
+    ssh -p 27 user@host 'cd /volume2/web/oldcomputers-forum && tar xzf - --no-overwrite-dir \
+        --no-same-owner --no-same-permissions --exclude=./storage --exclude=./public/assets' \
+        < forum/import/forum.tar.gz
+
+`--no-overwrite-dir` matters on the Synology: without it tar resets the folders it touches to
+plain Unix permissions, which drops the ACL entry that lets `http` write, and the forum answers
+500. Repair, as the folder's owner (repeat for `public`, `public/assets`, `vendor`, `packages`):
+
+    /usr/syno/bin/synoacltool -add <folder> "user:http:allow:rwxpdDaARWc--:fd--"
+
+and add the same entry for your own account and `group:administrators` right after, or the
+folder is closed to you.
+
+The bundle includes the spam filter `fof/anti-spam` (StopForumSpam check at registration, tools
+to remove a spammer); enable it with `php flarum extension:enable fof-anti-spam` (it needs
+`flarum-flags` and `flarum-approval`).
 
 The forum and the site should share one domain: logging in from the embedded thread relies on
 the forum's cookie, which browsers restrict across domains.
diff --git a/forum/docker/Dockerfile b/forum/docker/Dockerfile
index 0914cb8e..4c91ab1b 100644
--- a/forum/docker/Dockerfile
+++ b/forum/docker/Dockerfile
@@ -8,7 +8,7 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 ENV COMPOSER_ALLOW_SUPERUSER=1
 RUN composer create-project flarum/flarum /var/www/flarum "^2.0" --no-interaction --prefer-dist \
     && cd /var/www/flarum && mkdir packages \
-    && composer require --no-interaction flarum/embed "^2.0" \
+    && composer require --no-interaction flarum/embed "^2.0" "fof/anti-spam:^2.0@RC" \
     && composer config repositories.oc '{"type": "path", "url": "packages/*", "options": {"symlink": true}}' \
     && chown -R www-data:www-data /var/www/flarum
 RUN sed -ri 's#/var/www/html#/var/www/flarum/public#g' /etc/apache2/sites-available/000-default.conf \
diff --git a/forum/docker/entrypoint.sh b/forum/docker/entrypoint.sh
index 241f2ac2..0dc8e52a 100755
--- a/forum/docker/entrypoint.sh
+++ b/forum/docker/entrypoint.sh
@@ -27,7 +27,7 @@ fi
 # the museum extension is mounted from the repository (forum/extension)
 composer require --no-interaction "oc/flarum-museum:*@dev" >/dev/null 2>&1 || composer require --no-interaction "oc/flarum-museum:*@dev"
 php flarum migrate
-for ext in flarum-tags flarum-markdown flarum-nicknames flarum-embed oc-museum; do php flarum extension:enable "$ext" || true; done
+for ext in flarum-tags flarum-markdown flarum-nicknames flarum-embed flarum-flags flarum-approval fof-anti-spam oc-museum; do php flarum extension:enable "$ext" || true; done
 php flarum cache:clear
 chown -R www-data:www-data storage public/assets
 exec docker-php-entrypoint "$@"