diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3bcc14d7..6bf21c1be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,13 @@
+# 2026-09-17
+
+## (Backward Compatibility Break) Continuwuity requires registration challenges and disables legacy media by default
+
+[Continuwuity v26.9.0](https://forgejo.ellis.link/continuwuation/continuwuity/src/tag/v26.9.0/CHANGELOG.md) removes challengeless registration from official images. Remove `matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` from your configuration; validation will report it even if set to `false`. To continue accepting registrations, configure a registration token, ReCAPTCHA, or required email verification as described in [Configuring Continuwuity](docs/configuring-playbook-continuwuity.md#protecting-registration). Existing accounts and admin-managed registration tokens are unaffected. Remove the corresponding upstream option from any custom template or environment override too.
+
+Legacy, unauthenticated media endpoints are now disabled by default. Update clients and integrations that still use them to support authenticated media. Authenticated media endpoints remain enabled. Review any explicit `allow_legacy_media` override, which keeps unauthenticated access enabled despite the new default.
+
+After reviewing these changes, set `matrix_playbook_migration_validated_version: v2026.09.17.0` in your `vars.yml`. If you use another homeserver implementation, these Continuwuity changes do not affect it.
+
 # 2026-08-20
 
 ## MatrixRTC transports are advertised in the client well-known again
diff --git a/docs/configuring-playbook-continuwuity.md b/docs/configuring-playbook-continuwuity.md
index bb4fe3e9b..92748120d 100644
--- a/docs/configuring-playbook-continuwuity.md
+++ b/docs/configuring-playbook-continuwuity.md
@@ -35,6 +35,19 @@ matrix_continuwuity_config_allow_registration: true
 matrix_continuwuity_config_registration_token: ''
 ```
 
+### Protecting registration
+
+Official Continuwuity images require a registration challenge. Set `matrix_continuwuity_config_registration_token` to a strong token, or configure one of these alternatives:
+
+- ReCAPTCHA: set both `matrix_continuwuity_config_recaptcha_site_key` and `matrix_continuwuity_config_recaptcha_private_site_key`.
+- Email verification: configure working SMTP and set `matrix_continuwuity_config_smtp_require_email_for_registration: true`. The playbook enables SMTP through the local Exim relay by default; merely enabling SMTP does not require email verification.
+
+Keep `matrix_continuwuity_config_allow_registration: true` to allow registration. Tokens managed through the admin room remain supported. See the upstream [configuration reference](https://continuwuity.org/configuration) for details.
+
+### Media access
+
+Continuwuity disables legacy, unauthenticated media endpoints by default. Clients and integrations must use authenticated media endpoints. If you previously enabled `CONTINUWUITY_ALLOW_LEGACY_MEDIA` through `matrix_continuwuity_environment_variables_extension`, or set `allow_legacy_media` in a custom template, review that override: it allows anyone who knows a media URL to access the file.
+
 ### Extending the configuration
 
 There are some additional things you may wish to configure about the server.
diff --git a/examples/vars.yml b/examples/vars.yml
index 0b56ee2f5..970761f56 100644
--- a/examples/vars.yml
+++ b/examples/vars.yml
@@ -2,7 +2,7 @@
 # This variable acknowledges that you've reviewed breaking changes up to this version.
 # The playbook will fail if this is outdated, guiding you through what changed.
 # See the changelog: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md
-matrix_playbook_migration_validated_version: v2026.05.18.0
+matrix_playbook_migration_validated_version: v2026.09.17.0
 
 # The bare domain name which represents your Matrix identity.
 # Matrix user IDs for your server will be of the form (`@alice:example.com`).
diff --git a/roles/custom/matrix-continuwuity/defaults/main.yml b/roles/custom/matrix-continuwuity/defaults/main.yml
index 6385bf365..c5ebedd8f 100644
--- a/roles/custom/matrix-continuwuity/defaults/main.yml
+++ b/roles/custom/matrix-continuwuity/defaults/main.yml
@@ -14,7 +14,7 @@ matrix_continuwuity_enabled: true
 matrix_continuwuity_hostname: ''
 
 # renovate: datasource=docker depName=forgejo.ellis.link/continuwuation/continuwuity
-matrix_continuwuity_version: v26.8.1
+matrix_continuwuity_version: v26.9.0
 
 matrix_continuwuity_container_image: "{{ matrix_continuwuity_container_image_registry_prefix }}/continuwuation/continuwuity:{{ matrix_continuwuity_container_image_tag }}"
 matrix_continuwuity_container_image_tag: "{{ matrix_continuwuity_version }}"
@@ -151,16 +151,9 @@ matrix_continuwuity_config_allow_registration: false
 # Controls if newly registered users are automatically suspended, requiring admin approval.
 matrix_continuwuity_config_suspend_on_register: false
 
-# Controls the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting.
-# This is only used when `matrix_continuwuity_config_allow_registration` is set to true and no registration token is configured.
-matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: false
-
 # Controls the `registration_token` setting.
-# When registration is enabled (`matrix_continuwuity_config_allow_registration`) you:
-# - either need to set a token to protect registration from abuse
-# - or you need to enable the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting
-#   (see `matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`),
-#   to allow registration without any form of 2nd-step.
+# When registration is enabled, protect it with a registration token, ReCAPTCHA,
+# or required email verification. Official images do not support challengeless registration.
 matrix_continuwuity_config_registration_token: ''
 
 # Controls the `new_user_displayname_suffix` setting.
diff --git a/roles/custom/matrix-continuwuity/tasks/validate_config.yml b/roles/custom/matrix-continuwuity/tasks/validate_config.yml
index 777f12387..c6206e43e 100644
--- a/roles/custom/matrix-continuwuity/tasks/validate_config.yml
+++ b/roles/custom/matrix-continuwuity/tasks/validate_config.yml
@@ -38,6 +38,16 @@
     - {'old': 'matrix_continuwuity_docker_image_registry_prefix_upstream_default', 'new': 'matrix_continuwuity_container_image_registry_prefix_upstream_default'}
     - {'old': 'matrix_continuwuity_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}
 
+- name: (Deprecation) Catch and report removed Continuwuity challengeless registration setting
+  ansible.builtin.fail:
+    msg: >-
+      Remove `matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
+      from your configuration (vars.yml). Continuwuity's official images no longer support challengeless registration.
+      To keep registration enabled, configure `matrix_continuwuity_config_registration_token`, both ReCAPTCHA keys,
+      or SMTP with `matrix_continuwuity_config_smtp_require_email_for_registration: true`.
+      See docs/configuring-playbook-continuwuity.md for details.
+  when: matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse is defined
+
 - name: Fail if Continuwuity ReCAPTCHA is only partially configured
   ansible.builtin.fail:
     msg: >-
diff --git a/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2 b/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2
index 50f1df78e..0281212a3 100644
--- a/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2
+++ b/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2
@@ -458,9 +458,8 @@ max_request_size = {{ matrix_continuwuity_config_max_request_size }}
 # Enables registration. If set to false, no users can register on this
 # server.
 #
-# If set to true without a token configured, users can register with no
-# form of 2nd-step only if you set the following option to true:
-# `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
+# Registration requires a token, ReCAPTCHA, or email verification.
+# Official images do not support challengeless registration.
 #
 # If you would like registration only via token reg, please configure
 # `registration_token`.
@@ -483,11 +482,6 @@ allow_registration = {{ matrix_continuwuity_config_allow_registration | to_json
 #
 suspend_on_register = {{ matrix_continuwuity_config_suspend_on_register | to_json }}
 
-# Enabling this setting opens registration to anyone without restrictions.
-# This makes your server vulnerable to abuse
-#
-yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = {{ matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse | to_json }}
-
 # A static registration token that new users will have to provide when
 # creating an account. This token does not supersede tokens from other
 # sources, such as the `!admin token` command or the
@@ -1327,10 +1321,9 @@ allow_outgoing_presence = {{ matrix_continuwuity_config_allow_outgoing_presence
 #
 # The authenticated equivalent endpoints are always enabled.
 #
-# Defaults to true for now, but this is highly subject to change, likely
-# in the next release.
+# Defaults to false, as unauthenticated media has been sunsetted.
 #
-#allow_legacy_media = true
+#allow_legacy_media = false
 
 # This item is undocumented. Please contribute documentation for it.
 #
diff --git a/roles/custom/matrix_playbook_migration/defaults/main.yml b/roles/custom/matrix_playbook_migration/defaults/main.yml
index ad6107c41..d390914de 100644
--- a/roles/custom/matrix_playbook_migration/defaults/main.yml
+++ b/roles/custom/matrix_playbook_migration/defaults/main.yml
@@ -14,10 +14,13 @@ matrix_playbook_migration_validated_version: ''
 # The version that the playbook expects the user to have validated against.
 # This is bumped whenever a breaking change is introduced.
 # The value configured here needs to exist in `matrix_playbook_migration_breaking_changes` as well.
-matrix_playbook_migration_expected_version: "v2026.05.18.0"
+matrix_playbook_migration_expected_version: "v2026.09.17.0"
 
 # A list of breaking changes, used to inform users what changed between their validated version and the expected version.
 matrix_playbook_migration_breaking_changes:
+  - version: "v2026.09.17.0"
+    summary: "Continuwuity v26.9.0 requires registration challenges in official images and disables legacy unauthenticated media by default"
+    changelog_url: "https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#2026-09-17"
   - version: "v2026.05.18.0"
     summary: "LiveKit Server has been upgraded to v1.12.0 — TURN no longer relays to restricted peer CIDRs (loopback, link-local, multicast, private, unspecified) by default; TURN credentials now carry a TTL (300s)"
     changelog_url: "https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#2026-05-18"