diff --git a/linkwarden/CHANGELOG.md b/linkwarden/CHANGELOG.md
index eeab68d221..85c788afe9 100644
--- a/linkwarden/CHANGELOG.md
+++ b/linkwarden/CHANGELOG.md
@@ -1,4 +1,10 @@
  
+## 2.16.2 (2026-09-05)
+- Update to latest version from linkwarden/linkwarden (changelog : https://github.com/linkwarden/linkwarden/releases)
+- Stop installing vim, sudo, gnupg2 and lsb-release at build time. Debian 11 reached LTS end on 2026-08-31 and deb.debian.org no longer serves some of the debs that its frozen bullseye-security index still lists, which is what broke the 2.16.2 build.
+- Run the Postgres bootstrap through su instead of sudo, as the ente and postgres_15 add-ons already do
+- Fetch the bullseye-security suite from security.debian.org instead of the deb.debian.org CDN, which 404s on debs that suite still lists
+ 
 ## 2.16.1 (2026-08-22)
 - Update to latest version from linkwarden/linkwarden (changelog : https://github.com/linkwarden/linkwarden/releases)
  
diff --git a/linkwarden/Dockerfile b/linkwarden/Dockerfile
index 5d7d534128..f96844e10a 100644
--- a/linkwarden/Dockerfile
+++ b/linkwarden/Dockerfile
@@ -30,15 +30,38 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
 
 ENV PGDATA=/config/postgres
 # Adapt campaign
+#
+# Nothing is installed from the base image's own Debian suites before the PGDG
+# repository is added. Debian 11 reached LTS end on 2026-08-31 and its frozen
+# bullseye-security index still lists debs that deb.debian.org no longer serves
+# (sudo 1.9.5p2-3+deb11u4 among them), so every avoidable package here is a
+# build that fails for reasons unrelated to this add-on:
+#   - vim was never used by the add-on.
+#   - sudo is replaced by su in 99-run.sh, matching the ente and postgres_15
+#     add-ons.
+#   - gnupg2 is unnecessary: apt has read ASCII-armoured keys since 1.4.
+#   - lsb-release is unnecessary: /etc/os-release carries the codename.
+# curl is already present in the upstream linkwarden image.
+#
+# postgresql-16's own dependencies still come from bullseye-security, and
+# deb.debian.org serves that suite inconsistently now: libc-l10n, exim4-base and
+# libpython3.9-minimal all 404'd there during a build while every one of them was
+# 200 on security.debian.org, the origin deb.debian.org is a CDN alias for. Point
+# the security suite straight at the origin. If a future base image stops using
+# /etc/apt/sources.list this sed fails the build loudly, which is the point:
+# whoever rebases it has to revisit this.
 # hadolint ignore=DL3015
 RUN \
     # Change data directory
     mv /data /data_linkwarden && \
     \
+    # Fetch the security suite from its origin rather than the CDN
+    sed -i 's|deb.debian.org/debian-security|security.debian.org/debian-security|g' /etc/apt/sources.list && \
+    \
     # Install postgres
-    apt-get update && apt-get install vim gnupg2 lsb-release sudo curl -y && \
-    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc| gpg --dearmor -o /etc/apt/trusted.gpg.d/postgresql.gpg && \
-    sh -c 'echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list' && \
+    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /etc/apt/trusted.gpg.d/postgresql.asc && \
+    . /etc/os-release && \
+    echo "deb https://apt.postgresql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
     apt-get update && apt-get install -y postgresql-16 && \
     sed -i "/data_directory/c data_directory = '/config/postgres'" /etc/postgresql/*/main/postgresql.conf
 
diff --git a/linkwarden/config.yaml b/linkwarden/config.yaml
index 62a3479998..2aae5b049f 100644
--- a/linkwarden/config.yaml
+++ b/linkwarden/config.yaml
@@ -45,5 +45,5 @@ schema:
   STORAGE_FOLDER: str?
 slug: linkwarden
 url: https://github.com/alexbelgium/hassio-addons/tree/master/linkwarden
-version: "2.16.1"
+version: "2.16.2"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]"
diff --git a/linkwarden/rootfs/etc/cont-init.d/99-run.sh b/linkwarden/rootfs/etc/cont-init.d/99-run.sh
index ac20ed97ec..e572198dac 100755
--- a/linkwarden/rootfs/etc/cont-init.d/99-run.sh
+++ b/linkwarden/rootfs/etc/cont-init.d/99-run.sh
@@ -62,23 +62,28 @@ if [[ "$DATABASE_URL" == *"localhost"* ]]; then
     # Create folder
     if [ ! -e /config/postgres/postgresql.conf ]; then
         echo "... init folder"
-        sudo -u postgres /usr/lib/postgresql/16/bin/initdb -D /config/postgres
+        su - postgres -c "/usr/lib/postgresql/16/bin/initdb -D /config/postgres"
     fi
     chown -R postgres:postgres /config/postgres
     chmod 0700 /config/postgres
 
     echo "... starting server"
-    sudo -u postgres service postgresql start
+    # su - resets PATH to the login default, which has no /usr/sbin
+    su - postgres -c "/usr/sbin/service postgresql start"
     sleep 5
 
     echo "... create user and table"
+    # Both statements go to psql on stdin over the local socket, so neither the
+    # password nor a connection URI ends up in the process arguments
     # Set password
-    sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD 'homeassistant';"
+    su - postgres -c 'psql' <<'SQL'
+ALTER USER postgres WITH PASSWORD 'homeassistant';
+SQL
 
     # Create database if does not exist
-    echo "CREATE DATABASE linkwarden; GRANT ALL PRIVILEGES ON DATABASE linkwarden to postgres;
-    \q" > setup_postgres.sql
-    sudo -u postgres bash -c 'cat setup_postgres.sql | psql "postgres://postgres:homeassistant@localhost:5432"' || true
+    su - postgres -c 'psql' <<'SQL' || true
+CREATE DATABASE linkwarden; GRANT ALL PRIVILEGES ON DATABASE linkwarden to postgres;
+SQL
 fi
 
 ########################
diff --git a/linkwarden/updater.json b/linkwarden/updater.json
index e4aa3d3161..6a87eb0304 100644
--- a/linkwarden/updater.json
+++ b/linkwarden/updater.json
@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-22",
+  "last_update": "2026-09-05",
   "repository": "alexbelgium/hassio-addons",
   "slug": "linkwarden",
   "source": "github",
   "upstream_repo": "linkwarden/linkwarden",
-  "upstream_version": "2.16.1"
+  "upstream_version": "2.16.2"
 }