diff --git a/Dockerfile b/Dockerfile
index 989c57c..3bb88be 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,8 +36,7 @@ RUN \
     /tmp/mstream.tar.gz -C \
     /app/mstream/ --strip-components=1 && \
   cd /app/mstream && \
-  chown -R abc:abc ./ && \
-  su -s /bin/sh abc -c 'HOME=/tmp npm install --omit=dev' && \
+  HOME=/tmp npm install --omit=dev && \
   echo "**** use distro onnxruntime for the discovery embedding runtime ****" && \
   if [ -d /app/mstream/node_modules/onnxruntime-node/bin/napi-v6/linux/x64 ]; then \
     rm -f \
@@ -50,6 +49,8 @@ RUN \
   fi && \
   npm link && \
   chmod +x /app/mstream/bin/rust-parser/* && \
+  echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \
+  HOME=/tmp node scripts/fetch-p2p-sidecar.mjs && \
   printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
   echo "**** cleanup ****" && \
   rm -rf \
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
index 30b280f..ab87ef9 100644
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -36,8 +36,7 @@ RUN \
     /tmp/mstream.tar.gz -C \
     /app/mstream/ --strip-components=1 && \
   cd /app/mstream && \
-  chown -R abc:abc ./ && \
-  su -s /bin/sh abc -c 'HOME=/tmp npm install --omit=dev' && \
+  HOME=/tmp npm install --omit=dev && \
   echo "**** use distro onnxruntime for the discovery embedding runtime ****" && \
   if [ -d /app/mstream/node_modules/onnxruntime-node/bin/napi-v6/linux/arm64 ]; then \
     rm -f \
@@ -50,6 +49,8 @@ RUN \
   fi && \
   npm link && \
   chmod +x /app/mstream/bin/rust-parser/* && \
+  echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \
+  HOME=/tmp node scripts/fetch-p2p-sidecar.mjs && \
   printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
   echo "**** cleanup ****" && \
   rm -rf \
diff --git a/README.md b/README.md
index 9746f8b..c75484c 100644
--- a/README.md
+++ b/README.md
@@ -282,6 +282,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **31.08.26:** - Bake the p2p discovery sidecar into the image at build time (manifest-pinned, sha256-verified) so discovery works without runtime egress to GitHub.
 * **08.07.26:** - Rebase to Alpine 3.24. Use the distro onnxruntime so the discovery/recommendation features work on musl.
 * **24.04.26:** - Make waveform data persistent.
 * **20.04.26:** - Fix perms on rust binaries.
diff --git a/readme-vars.yml b/readme-vars.yml
index 37885c1..84612b8 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -72,6 +72,7 @@ init_diagram: |
   "mstream:latest" <- Base Images
 # changelog
 changelogs:
+  - {date: "31.08.26:", desc: "Bake the p2p discovery sidecar into the image at build time (manifest-pinned, sha256-verified) so discovery works without runtime egress to GitHub."}
   - {date: "08.07.26:", desc: "Rebase to Alpine 3.24. Use the distro onnxruntime so the discovery/recommendation features work on musl."}
   - {date: "24.04.26:", desc: "Make waveform data persistent."}
   - {date: "20.04.26:", desc: "Fix perms on rust binaries."}