diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6376d7..bad276f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,11 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ## [Unreleased]
 
+### Security
+
+- Update the Console image to 1.2.106-self-hosted, which patches DOMPurify
+  to 3.4.17 for GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr.
+
 ## [2.1.0] - 2026-10-22
 
 Appwrite 2.6.1. Upgrading from 2.0.0: see
diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml
index d4f39d6..ae9bb54 100644
--- a/charts/appwrite/Chart.yaml
+++ b/charts/appwrite/Chart.yaml
@@ -93,7 +93,7 @@ annotations:
     - name: builtin-exporter
       image: docker.io/oliver006/redis_exporter:v1.93.0-alpine
     - name: console
-      image: docker.io/appwrite/new:1.2.97-self-hosted
+      image: docker.io/appwrite/new:1.2.106-self-hosted
     - name: dind
       image: docker.io/library/docker:29.9.0-dind
     - name: embedding
diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md
index 8cbf3d1..25926e2 100644
--- a/charts/appwrite/README.md
+++ b/charts/appwrite/README.md
@@ -595,7 +595,7 @@ The SMTP server Appwrite sends mail through.
 | console.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | console.image.registry | string | `"docker.io"` | Image registry. |
 | console.image.repository | string | `"appwrite/new"` | Image repository. |
-| console.image.tag | string | `"1.2.97-self-hosted"` | Image tag. Pinned to the console that ships with the chart's appVersion. |
+| console.image.tag | string | `"1.2.106-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. |
 | console.livenessProbe.enabled | bool | `true` | Enable the liveness probe. |
 | console.livenessProbe.failureThreshold | int | `3` | Consecutive failures before the probe counts as failed. |
 | console.livenessProbe.periodSeconds | int | `20` | Seconds between probes. |
diff --git a/charts/appwrite/values.schema.json b/charts/appwrite/values.schema.json
index 6cdf627..b7702fb 100644
--- a/charts/appwrite/values.schema.json
+++ b/charts/appwrite/values.schema.json
@@ -1730,7 +1730,7 @@
               "type": "string"
             },
             "tag": {
-              "description": "Image tag. Pinned to the console that ships with the chart's appVersion.",
+              "description": "Image tag. Pinned independently from appVersion so Console security updates can ship separately.",
               "type": "string"
             }
           },
diff --git a/charts/appwrite/values.yaml b/charts/appwrite/values.yaml
index fae1722..8fdb64b 100644
--- a/charts/appwrite/values.yaml
+++ b/charts/appwrite/values.yaml
@@ -1187,8 +1187,8 @@ console:
     registry: docker.io
     # -- Image repository.
     repository: appwrite/new
-    # -- Image tag. Pinned to the console that ships with the chart's appVersion.
-    tag: 1.2.97-self-hosted
+    # -- Image tag. Pinned independently from appVersion so Console security updates can ship separately.
+    tag: 1.2.106-self-hosted
     # -- Image digest.
     digest: ""
     # -- Image pull policy.