diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8374900..9eb8387 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.52.2 - 2026-08-09
+
+- Updated Docker runtime packages to match the current Kaizoku provider downloader and include `openssl` explicitly.
+- Added Compose defaults for state root and remote browse roots.
+- Refreshed README setup, Docker, environment, and data-safety notes for the current provider-bridge project state.
+
 ## 0.52.1 - 2026-08-09
 
 - Removed the Queue page “What you can do here” sidebar section.
diff --git a/Dockerfile b/Dockerfile
index ae1c758..4526167 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,21 +6,17 @@ ENV DEBIAN_FRONTEND=noninteractive \
     KAIZOKU_HOST=0.0.0.0 \
     KAIZOKU_PORT=8421 \
     KAIZOKU_JOB_STDOUT=true \
-    UPDATE_ON_START=false \
     USER_UID= \
     USER_GID=
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-        aria2 \
         bash \
-        botan \
         ca-certificates \
-        curl \
         ffmpeg \
         nodejs \
         npm \
-        sudo \
+        openssl \
         util-linux \
     && rm -rf /var/lib/apt/lists/*
 
diff --git a/README.md b/README.md
index df843ae..7a4fd5b 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,7 @@ Kaizoku is a local web app for searching, tracking, and downloading anime from A
 - Python 3.12 or newer.
 - Node.js and npm for the provider bridge.
 - `ffmpeg` available in `PATH`.
+- `openssl` available in `PATH` for AES-128 encrypted HLS segments.
 
 Install Node dependencies once:
 
@@ -49,12 +50,13 @@ Useful environment variables:
 
 - `KAIZOKU_HOST=0.0.0.0`
 - `KAIZOKU_PORT=8421`
-- `KAIZOKU_ALLOW_REMOTE=1`
-- `KAIZOKU_AUTH_USERNAME=admin`
-- `KAIZOKU_AUTH_PASSWORD=choose-a-long-random-password`
-- `KAIZOKU_JOB_STDOUT=true`
-- `KAIZOKU_STATE_ROOT=/path/to/state`
-- `KAIZOKU_DOWNLOAD_DIR=/downloads`
+- `KAIZOKU_ALLOW_REMOTE=1` to allow non-loopback clients.
+- `KAIZOKU_AUTH_USERNAME=admin` and `KAIZOKU_AUTH_PASSWORD=choose-a-long-random-password` for remote access.
+- `KAIZOKU_JOB_STDOUT=true` to mirror job logs to container or terminal output.
+- `KAIZOKU_STATE_ROOT=/path/to/state` to move SQLite state, config, thumbnails, sessions, and staging.
+- `KAIZOKU_DOWNLOAD_DIR=/downloads` for the default library output path.
+- `KAIZOKU_REMOTE_PATH_ROOTS=/downloads,/media/anime` to limit remote filesystem browsing.
+- `KAIZOKU_MODE=sub`, `KAIZOKU_QUALITY=best`, and `KAIZOKU_DEBUG=1` for runtime defaults and diagnostics.
 
 ## Docker
 
@@ -62,12 +64,22 @@ Useful environment variables:
 docker compose up -d --build
 ```
 
-The compose file mounts:
+The compose file builds the local checkout and runs Kaizoku on port `8421` by default. It mounts:
 
 - `./downloads` to `/downloads`
 - `./.kaizoku` to `/app/.kaizoku`
 
-The Docker image installs Python, Node.js, npm, and `ffmpeg`, then runs `npm install --omit=dev` for the provider bridge.
+The Docker image installs Python, Node.js, npm, `ffmpeg`, `openssl`, and `util-linux` for optional UID/GID switching, then runs `npm install --omit=dev` for the provider bridge. Downloads go through Kaizoku's provider bridge and `provider_downloader.py`.
+
+Useful Compose overrides:
+
+```sh
+KAIZOKU_PORT=8080 docker compose up -d --build
+KAIZOKU_ALLOW_REMOTE=1 KAIZOKU_AUTH_USERNAME=admin KAIZOKU_AUTH_PASSWORD='change-me' docker compose up -d
+USER_UID=$(id -u) USER_GID=$(id -g) docker compose up -d
+```
+
+Keep `./.kaizoku` mounted for production instances. That directory contains the SQLite database, configuration, queue history, watchlist data, thumbnail cache, remote sessions, and temporary staging files. Removing the mount starts Kaizoku with a fresh empty state.
 
 ## Download Flow
 
diff --git a/VERSION b/VERSION
index 27d68a6..3f01561 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.52.1
+0.52.2
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 6fb53c3..2b760f5 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -17,7 +17,9 @@ services:
       KAIZOKU_AUTH_USERNAME: ${KAIZOKU_AUTH_USERNAME:-}
       KAIZOKU_AUTH_PASSWORD: ${KAIZOKU_AUTH_PASSWORD:-}
       KAIZOKU_JOB_STDOUT: ${KAIZOKU_JOB_STDOUT:-true}
+      KAIZOKU_REMOTE_PATH_ROOTS: ${KAIZOKU_REMOTE_PATH_ROOTS:-/downloads}
       KAIZOKU_DOWNLOAD_DIR: /downloads
+      KAIZOKU_STATE_ROOT: /app/.kaizoku
     volumes:
       - ./downloads:/downloads
       - ./.kaizoku:/app/.kaizoku