diff --git a/conf/nginx.conf b/conf/nginx.conf
index 950c275..3557942 100755
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -24,3 +24,8 @@ location __PATH__/ {
   # Include SSOWAT user panel.
   include conf.d/yunohost_panel.conf.inc;
 }
+
+location ^~ /media/ {
+  alias __DATA_DIR__/media/;
+  more_set_headers "Access-Control-Allow-Origin: *";
+}
diff --git a/conf/sql/v1.5.2.sql b/conf/sql/v1.5.2.sql
new file mode 100644
index 0000000..024cab9
--- /dev/null
+++ b/conf/sql/v1.5.2.sql
@@ -0,0 +1,14 @@
+-- change Twitter to X
+INSERT IGNORE INTO `cp_platforms` (`slug`, `type`, `label`, `home_url`, `submit_url`) VALUES
+('x', 'social', 'X', 'https://x.com/', 'https://x.com/i/flow/signup');
+
+UPDATE `cp_podcasts_platforms`
+SET `platform_slug` = 'x'
+WHERE `platform_slug` = 'twitter';
+
+DELETE FROM `cp_platforms` WHERE `slug` = 'twitter';
+
+-- add buymeacoffee and kofi as funding platforms
+INSERT IGNORE INTO `cp_platforms` (`slug`, `type`, `label`, `home_url`, `submit_url`) VALUES
+('buymeacoffee', 'funding', 'Buy Me a Coffee', 'https://www.buymeacoffee.com/', 'https://www.buymeacoffee.com/signup'),
+('kofi', 'funding', 'Ko-fi', 'https://ko-fi.com/', 'https://ko-fi.com/account/register');
diff --git a/conf/sql/v1.6.1.sql b/conf/sql/v1.6.1.sql
new file mode 100644
index 0000000..49d797e
--- /dev/null
+++ b/conf/sql/v1.6.1.sql
@@ -0,0 +1,2 @@
+INSERT IGNORE INTO `cp_platforms` (`slug`, `type`, `label`, `home_url`, `submit_url`) VALUES
+('tiktok', 'social', 'Tiktok', 'https://www.tiktok.com/', 'https://www.tiktok.com/signup');
diff --git a/scripts/install b/scripts/install
index 5441e89..94c4a4c 100755
--- a/scripts/install
+++ b/scripts/install
@@ -69,13 +69,21 @@ ynh_add_config --template=".env.example" --destination="$install_dir/.env"
 chmod 600 $install_dir/.env
 chown $app:www-data "$install_dir/.env"
 
+mkdir -p $data_dir/media
+cp -rf $install_dir/public/media/* $data_dir/media
+chmod -R 750 $data_dir
+chgrp -R www-data $data_dir
+
+ynh_secure_remove --file="$install_dir/public/media" 
+
 #=================================================
 # RUN MIGRATIONS
 #=================================================
 ynh_script_progression --message="Configuring $app database..." --weight=1
 
 pushd $install_dir
-  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark migrate --all
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark castopod:database-update
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark db:seed AppSeeder
 popd
 
 #=================================================
diff --git a/scripts/upgrade b/scripts/upgrade
index bb6cb7d..2fd85bc 100755
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -38,6 +38,24 @@ if [ -z "${fpm_usage:-}" ]; then
     ynh_app_setting_set --app=$app --key=fpm_usage --value=$fpm_usage
 fi
 
+#=================================================
+# MOVE DATA TO __DATA_DIR__
+#=================================================
+
+if ynh_compare_current_package_version --comparison le --version "1.1.2~ynh2"; then
+    ynh_script_progression --message="Moving data..." --weight=3
+    mkdir -p $data_dir/media
+    cp -rf $install_dir/public/media/* $data_dir/media
+    chmod -R 750 $data_dir
+    chgrp -R www-data $data_dir
+
+    ynh_secure_remove --file="$install_dir/public/media"
+
+    ynh_script_progression --message="Fixing migrations..." --weight=1
+    # this will fail is `cp-install` was not run on prev version - just ignore, DB schema is (re)generated later.
+    ynh_mysql_execute_as_root --database=$db_name --sql="UPDATE cp_migrations SET class='Media\\\\Database\\\\Migrations\\\\AddMedia', namespace='Media' where class='App\\\\Database\\\\Migrations\\\\AddMedia'" || true
+fi
+
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
 #=================================================
@@ -47,7 +65,7 @@ then
 	ynh_script_progression --message="Upgrading source files..." --weight=1
 
 	# Download, check integrity, uncompress and patch the source from app.src
-	ynh_setup_source --dest_dir="$install_dir" --keep=".env public/media"
+	ynh_setup_source --dest_dir="$install_dir" --full_replace=1
 fi
 
 chmod -R o-rwx "$install_dir"
@@ -85,9 +103,17 @@ chown $app:www-data "$install_dir/.env"
 ynh_script_progression --message="Configuring $app database..." --weight=1
 
 pushd $install_dir
-  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark migrate --all
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark cache:clear
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark castopod:database-update
 popd
 
+if ynh_compare_current_package_version --comparison le --version "1.6.5~ynh1"; then
+    # cf https://code.castopod.org/adaures/castopod/-/releases/v1.5.2
+    ynh_mysql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < "../conf/sql/v1.5.2.sql"
+    # cf https://code.castopod.org/adaures/castopod/-/releases/v1.6.1
+    ynh_mysql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < "../conf/sql/v1.6.1.sql"
+fi
+
 #=================================================
 # END OF SCRIPT
 #=================================================
diff --git a/sources/patches/main-001-allow-unsafe-login.patch b/sources/patches/main-001-allow-unsafe-login.patch
new file mode 100644
index 0000000..7574678
--- /dev/null
+++ b/sources/patches/main-001-allow-unsafe-login.patch
@@ -0,0 +1,12 @@
+diff -ruN castopod.old/vendor/codeigniter4/shield/src/Config/Auth.php castopod/vendor/codeigniter4/shield/src/Config/Auth.php
+--- castopod.old/vendor.old/codeigniter4/shield/src/Config/Auth.php	2023-10-31 13:05:34
++++ castopod/vendor/codeigniter4/shield/src/Config/Auth.php	2023-10-31 12:57:04
+@@ -375,7 +375,7 @@
+      *
+      * @deprecated This is only for backward compatibility.
+      */
+-    public bool $supportOldDangerousPassword = false;
++    public bool $supportOldDangerousPassword = true;
+ 
+     /**
+      * ////////////////////////////////////////////////////////////////////