diff --git a/CHANGELOG.md b/CHANGELOG.md
index 940a4c2..5cb34dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
# Changelog
+## 2026-09-11
+
+* Security
+ * Ship a restrictive ImageMagick policy denying the MSL/MVG/MSVG script
+ coders and the EPHEMERAL/URL/HTTP/HTTPS/FTP delegates, and install
+ `librsvg2-bin` so ImageMagick delegates SVG decoding to `rsvg-convert`
+ instead of falling back to its own coder when the binary is missing
+ (OC10-164)
+
## 2026-07-06
* Added
diff --git a/v22.04/Dockerfile.multiarch b/v22.04/Dockerfile.multiarch
index 9c1922d..461580e 100644
--- a/v22.04/Dockerfile.multiarch
+++ b/v22.04/Dockerfile.multiarch
@@ -50,6 +50,7 @@ RUN apt-get update -y && \
exiftool \
sqlite3 \
librsvg2-common \
+ librsvg2-bin \
ghostscript && \
apt-add-repository -r "https://deb.owncloud.com/php.freexian.com/" -y && \
rm -rf /etc/apache2/envvars /etc/apache2/conf-* /etc/apache2/sites-* /var/log/apache2/* && \
diff --git a/v22.04/overlay/etc/ImageMagick-6/policy.xml b/v22.04/overlay/etc/ImageMagick-6/policy.xml
new file mode 100644
index 0000000..dbce514
--- /dev/null
+++ b/v22.04/overlay/etc/ImageMagick-6/policy.xml
@@ -0,0 +1,45 @@
+
+
+
+
+
+]>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/v24.04/Dockerfile.multiarch b/v24.04/Dockerfile.multiarch
index 4c55072..44b1045 100644
--- a/v24.04/Dockerfile.multiarch
+++ b/v24.04/Dockerfile.multiarch
@@ -40,6 +40,7 @@ RUN apt-get update -y && \
exiftool \
sqlite3 \
librsvg2-common \
+ librsvg2-bin \
ghostscript && \
rm -rf /etc/apache2/envvars /etc/apache2/conf-* /etc/apache2/sites-* /var/log/apache2/* && \
a2enmod rewrite headers env dir mime expires remoteip && \
diff --git a/v24.04/overlay/etc/ImageMagick-6/policy.xml b/v24.04/overlay/etc/ImageMagick-6/policy.xml
new file mode 100644
index 0000000..e0f28f9
--- /dev/null
+++ b/v24.04/overlay/etc/ImageMagick-6/policy.xml
@@ -0,0 +1,45 @@
+
+
+
+
+
+]>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+