diff --git a/acs-keycloak-spi/pom.xml b/acs-keycloak-spi/pom.xml
index 146c13449..1d5516649 100644
--- a/acs-keycloak-spi/pom.xml
+++ b/acs-keycloak-spi/pom.xml
@@ -24,7 +24,7 @@
              the base assumes (lib/X), so acs.top must point at the repo root. -->
         <acs.top>..</acs.top>
 
-        <keycloak.version>26.1.1</keycloak.version>
+        <keycloak.version>26.6.3</keycloak.version>
         <!-- 5.18.0 supports inline-mocking on JDK 24/25; 5.11 throws
              "Could not modify all classes [interface
              org.keycloak.models.KeycloakSession]" on JDK 25. -->
diff --git a/acs-keycloak/Dockerfile b/acs-keycloak/Dockerfile
index 6fc153c52..80c12efe4 100644
--- a/acs-keycloak/Dockerfile
+++ b/acs-keycloak/Dockerfile
@@ -8,7 +8,12 @@
 #   * lib  -> ../lib (provides java-base-pom and the in-tree mvn repo)
 #   * spi  -> ../acs-keycloak-spi (the SPI source tree)
 
-ARG keycloak_version=26.1.1
+# 26.6.3: first line we ship with pgjdbc >= 42.7.5, fixing the
+# GSSInputStream partial-read bug (pgjdbc #3373) that corrupts GSS
+# encrypted Postgres streams under unlucky TCP segmentation, seen as
+# "Could not use AES128 Cipher - Checksum failed" crash loops on
+# amrc-fp. Also covers pgjdbc CVE-2025-49146.
+ARG keycloak_version=26.6.3
 ARG maven_image=docker.io/library/maven:3.9-eclipse-temurin-21
 ARG revision=unknown
 
diff --git a/deploy/templates/openid/openid.yaml b/deploy/templates/openid/openid.yaml
index 5f7e80e01..3bfffa5c1 100644
--- a/deploy/templates/openid/openid.yaml
+++ b/deploy/templates/openid/openid.yaml
@@ -112,10 +112,14 @@ spec:
             - name: KC_HEALTH_ENABLED
               value: "true"
 
-            # Initial admin user (for bootstrapping the realm via service-setup)
-            - name: KEYCLOAK_ADMIN
+            # Initial admin user (for bootstrapping the realm via
+            # service-setup). KC_BOOTSTRAP_ADMIN_* replaced the
+            # deprecated KEYCLOAK_ADMIN vars in Keycloak 26; only
+            # consulted when the master realm has no admin yet, so this
+            # is inert on established installations.
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
               value: _bootstrap
-            - name: KEYCLOAK_ADMIN_PASSWORD
+            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: keycloak-clients
diff --git a/docs/reference/release-notes.md b/docs/reference/release-notes.md
index 9cdd46822..1e8f7dc9b 100644
--- a/docs/reference/release-notes.md
+++ b/docs/reference/release-notes.md
@@ -8,6 +8,27 @@ chronological order.
 These changes have not been released yet, but are likely to appear in
 the next release.
 
+### Keycloak upgraded from 26.1 to 26.6
+
+The bundled Keycloak moves to 26.6.3, primarily for its PostgreSQL
+JDBC driver (42.7.11): the 42.7.4 driver shipped with Keycloak 26.1
+has a bug (pgjdbc #3373) where the GSS-encrypted database stream is
+corrupted by partial TCP reads, crashing Keycloak with "Could not use
+AES128 Cipher - Checksum failed" under network conditions that split
+GSS tokens across reads. Seen in production; the trigger is
+environmental (TCP segmentation behaviour), so any site can hit it.
+
+Keycloak migrates its database schema one-way on first start of the
+new version; downgrading afterwards requires a database restore. The
+F+ SPI is rebuilt against 26.6 (no source changes needed) and the
+chart now uses the KC_BOOTSTRAP_ADMIN environment variables in place
+of the KEYCLOAK_ADMIN ones deprecated in Keycloak 26 (only consulted
+when the master realm has no admin, so inert on established sites).
+Keycloak 26.2-26.6 also tightens some token-endpoint behaviour
+(introspection audience checks, userinfo with lightweight tokens);
+none of it affects the flows ACS provisions, but sites with custom
+OIDC clients should skim the upstream migration notes.
+
 ## v6.1.3
 
 ### ACL editor shows identity-less principals