diff --git a/app-catalog/catalog.json b/app-catalog/catalog.json
index 145f7cd3..610fabac 100644
--- a/app-catalog/catalog.json
+++ b/app-catalog/catalog.json
@@ -109,12 +109,12 @@
     {
       "id": "botfights",
       "title": "BotFights",
-      "version": "1.1.0",
+      "version": "1.2.1",
       "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.1.0",
+      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.1",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [
diff --git a/apps/botfights/manifest.yml b/apps/botfights/manifest.yml
index 3fcb25cf..0f22ad5e 100644
--- a/apps/botfights/manifest.yml
+++ b/apps/botfights/manifest.yml
@@ -1,13 +1,24 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.1.0
+  version: 1.2.1
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.1.0
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.1
     pull_policy: always
+    # Auto-generated on first install (random hex, 0600, rootless-owned). The
+    # 1.2.x image's server/src/middleware/jwt.ts throws at module import when
+    # JWT_SECRET is unset and NODE_ENV=production, so a fresh install without
+    # this crash-loops immediately. hex32 (not base64, unlike netbird) because
+    # jwt.ts uses the value directly as an HMAC key with no decode step.
+    generated_secrets:
+      - name: botfights-jwt-secret
+        kind: hex32
+    secret_env:
+      - key: JWT_SECRET
+        secret_file: botfights-jwt-secret
 
   dependencies:
     - storage: 500Mi
@@ -41,6 +52,14 @@ app:
 
   environment:
     - NODE_ENV=production
+    - PORT=9100
+    # Default-on shared public arena federation (BOT-03/D-03): this node's
+    # BotFights becomes a thin client of the Foundation's well-known arena —
+    # all nodes see all fighters, fights cross nodes. This is a rendezvous,
+    # not an authority: any node can host its own arena (same image, just
+    # without this var set), and an operator can remove this line entirely to
+    # run a fully standalone, node-local arena instead.
+    - ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org
 
   health_check:
     type: http
diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh
index aa5e91a7..cf66d77e 100644
--- a/scripts/image-versions.sh
+++ b/scripts/image-versions.sh
@@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
 
 # Community / Gaming
-BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.1.0"
+BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.1"
 
 # IndeedHub stack
 INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"