diff --git a/.github/acceptance/expected-failures-10.16.6-full.md b/.github/acceptance/expected-failures-10.16.7-full.md
similarity index 96%
rename from .github/acceptance/expected-failures-10.16.6-full.md
rename to .github/acceptance/expected-failures-10.16.7-full.md
index 485a03f..71fa997 100644
--- a/.github/acceptance/expected-failures-10.16.6-full.md
+++ b/.github/acceptance/expected-failures-10.16.7-full.md
@@ -1,4 +1,4 @@
-# Scenarios of ownCloud core 10.16.6's acceptance tests that are expected to fail against this
+# Scenarios of ownCloud core 10.16.7's acceptance tests that are expected to fail against this
 # image (full run). run.sh fails the job on any other failure, and on a listed
 # scenario that passes. One entry per line, as in core's own lists:
 # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)`
@@ -7,7 +7,7 @@
 
 # Found in this repository's CI; they depend on how the image is set up.
 # 10.16-only: this feature is gone from core's master, so its master link is a 404;
-# the scenario is in the v10.16.6 tag.
+# the scenario is in the v10.16.7 tag.
 - [cliDbConversion/dbConversion.feature:30](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliDbConversion/dbConversion.feature#L30)
 - [cliMain/configKey.feature:81](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/configKey.feature#L81)
 - [cliManageApps/appsPath.feature:18](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L18)
diff --git a/.github/acceptance/expected-failures-10.16.6-smoke.md b/.github/acceptance/expected-failures-10.16.7-smoke.md
similarity index 93%
rename from .github/acceptance/expected-failures-10.16.6-smoke.md
rename to .github/acceptance/expected-failures-10.16.7-smoke.md
index 9690352..4d88706 100644
--- a/.github/acceptance/expected-failures-10.16.6-smoke.md
+++ b/.github/acceptance/expected-failures-10.16.7-smoke.md
@@ -1,4 +1,4 @@
-# Scenarios of ownCloud core 10.16.6's acceptance tests that are expected to fail against this
+# Scenarios of ownCloud core 10.16.7's acceptance tests that are expected to fail against this
 # image (smoke run). run.sh fails the job on any other failure, and on a listed
 # scenario that passes. One entry per line, as in core's own lists:
 # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)`
@@ -7,7 +7,7 @@
 
 # Found in this repository's CI; they depend on how the image is set up.
 # 10.16-only: this feature is gone from core's master, so its master link is a 404;
-# the scenario is in the v10.16.6 tag.
+# the scenario is in the v10.16.7 tag.
 - [cliDbConversion/dbConversion.feature:30](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliDbConversion/dbConversion.feature#L30)
 - [cliMain/configKey.feature:81](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/configKey.feature#L81)
 - [cliManageApps/appsPath.feature:18](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L18)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index eb02c02..9cff461 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -31,9 +31,9 @@ jobs:
       fail-fast: false
       matrix:
         release:
-          - version: 10.16.6
-            tarball: https://github.com/owncloud/core/releases/download/v10.16.6/owncloud-complete-20261006.tar.bz2
-            qa-sha256: 5b1bfa2ffc9b0156bf1cee446e56744883b69415948f634baf2bfa4c2d0ea0df
+          - version: 10.16.7
+            tarball: https://github.com/owncloud/core/releases/download/v10.16.7/owncloud-complete-20261103.tar.bz2
+            qa-sha256: 97371a5b1e1f3fd334aea42e3c67419f002b26260539a15e14e2672471bafb05
             base: v22.04
             php: "7.4"
           - version: 11.0.1
@@ -74,10 +74,10 @@ jobs:
       fail-fast: false
       matrix:
         release:
-          - version: 10.16.6
-            tarball: https://github.com/owncloud/core/releases/download/v10.16.6/owncloud-complete-20261006.tar.bz2
+          - version: 10.16.7
+            tarball: https://github.com/owncloud/core/releases/download/v10.16.7/owncloud-complete-20261103.tar.bz2
             base: v22.04
-            trivy-ignore: v22.04/10.16.6/.trivyignore
+            trivy-ignore: v22.04/10.16.7/.trivyignore
             extra-tags: |
               10.16
               10
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 403637b..74cba2b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 2026-11-03
+
+* Changed
+  * Update 10.16.6 to 10.16.7 built from the GitHub release tarball
+
 ## 2026-10-06
 
 * Changed
diff --git a/README.md b/README.md
index db899ef..9ffde95 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ ownCloud is an open-source file sync, share and content collaboration software t
 
 ## Docker Tags and respective Dockerfile links
 
-- [`10.16.6`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.6`
+- [`10.16.7`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.7`
 - [`11.0.1`, `11.0`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.1`
 
 ## Default volumes
diff --git a/agents.md b/agents.md
index 9f0a5ab..f455a95 100644
--- a/agents.md
+++ b/agents.md
@@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is
 built by `.github/workflows/main.yml`, which calls reusable workflows from
 [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu):
 
-- Matrix builds two releases: `10.16.6` (base `v22.04`) and `11.0.1`
+- Matrix builds two releases: `10.16.7` (base `v22.04`) and `11.0.1`
   (base `v24.04`), each via `<base>/Dockerfile.multiarch`.
 - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no
   version pinned inside the Dockerfile.
diff --git a/v22.04/10.16.6/.trivyignore b/v22.04/10.16.7/.trivyignore
similarity index 84%
rename from v22.04/10.16.6/.trivyignore
rename to v22.04/10.16.7/.trivyignore
index 49d9d6a..93ec2fd 100644
--- a/v22.04/10.16.6/.trivyignore
+++ b/v22.04/10.16.7/.trivyignore
@@ -1,5 +1,5 @@
 # vulnerability is affecting windows only: symfony/process v3.4.47 vendored by updater
-# v1.1.2 (core lib ships v5.4.51, which is already past the 5.4.46 fix). v1.1.2 is the
+# v1.1.2 (core lib ships v5.4.54, which is already past the 5.4.46 fix). v1.1.2 is the
 # newest updater release, so there is nothing to bump to.
 CVE-2024-51736
 
@@ -11,7 +11,7 @@ GHSA-27qh-8cxx-2cr5
 
 # fix requires ownCloud to update bundled guzzlehttp/guzzle (-> 7.15.2) in graphapi
 # v0.3.1 (7.4.5), files_external_dropbox v2.0.2 (7.8.1) and updater v1.1.2 (7.9.2).
-# Core lib is no longer affected: 10.16.5 ships 7.15.5 (owncloud/core#41784). The two
+# Core lib is no longer affected: 10.16.7 ships 7.16.1 (7.15.5 since owncloud/core#41784). The two
 # apps do have fixed releases -- dropbox v2.1.2 and graphapi v0.3.2 -- but both are
 # signed in the G2 envelope, which 10.16's integrity check rejects outright, so the
 # bundle holds the older pins.