diff --git a/elasticsearch/CHANGELOG.md b/elasticsearch/CHANGELOG.md
index 96bfdeb16c..a11e709ecb 100644
--- a/elasticsearch/CHANGELOG.md
+++ b/elasticsearch/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 8.19.18 (2026-07-14)
+
+- Upgrade to Elasticsearch 8.19.18 (#2849). Note: despite the previous add-on version reading `8.14.3`, the shipped image was still Elasticsearch 7.17.9 — the Dockerfile upstream version was never bumped. This release actually delivers 8.x, making the add-on compatible with the `homeassistant-elasticsearch` integration (requires 8.14+).
+- Automatic data migration: existing 7.17 data is upgraded in place by Elasticsearch on first start (one-way; can take a while on large datasets). A migration guard aborts with a clear message on unsupported paths (downgrades, or data more than one major version old). Take a Home Assistant backup before updating.
+- The previous bundled config directory is archived to `/data/config.bak-<old-version>` during major upgrades; re-apply custom settings to the new config if needed.
+- Security (`xpack.security.enabled`) defaults to `false` to preserve the previous plain-HTTP behavior. Override by adding `ES_SETTING_XPACK_SECURITY_ENABLED` (or any `ES_SETTING_XPACK_SECURITY_*` variable) in the add-on's `env_vars` option.
+- Fixed the `env_vars` add-on option, which previously had no effect: variables are now exported before Elasticsearch starts.
+- Removed the `ingest-attachment` plugin install: it is a bundled module since Elasticsearch 8.0.
+- Startup persistence logic rewritten as a proper init script (`/usr/local/bin/addon-init.sh`) instead of line-number-based entrypoint patching.
+- Added `updater.json` so upstream 8.19.x releases are tracked automatically (pinned to the 8.19 line: 9.x cannot read indices created in 7.x).
+
 ## 8.14.3-3 (2026-06-19)
 - Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)
 - Fix AppArmor profile name (was `inadyn_addon`, colliding with several other add-ons); renamed to `elasticsearch_addon`
diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile
index 5d00ec0305..abb39edbb4 100644
--- a/elasticsearch/Dockerfile
+++ b/elasticsearch/Dockerfile
@@ -14,7 +14,7 @@
 # 1 Build Image #
 #################
 
-ARG BUILD_UPSTREAM="7.17.9"
+ARG BUILD_UPSTREAM="8.19.18"
 FROM elasticsearch:$BUILD_UPSTREAM
 
 ##################
@@ -26,20 +26,15 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
     S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
     S6_SERVICES_GRACETIME=0
 
+# Expose the upstream version to the add-on init script (migration guard)
+ARG BUILD_UPSTREAM
+ENV UPSTREAM_VERSION="$BUILD_UPSTREAM"
 
-# Data persistence
-# hadolint ignore=SC2016
-RUN sed -i '5a echo "Data location moved. Please wait while elasticsearch starts..."' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a chown -R $(id -u):$(id -g) $HOME' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a done' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a ln -s $NEWHOME/$file /usr/share/elasticsearch || true' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a rm -r /usr/share/elasticsearch/$file || true' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a cp -rn /usr/share/elasticsearch/$file $NEWHOME || true' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a for file in "data" "config"; do' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a mkdir -p $NEWHOME' /usr/local/bin/docker-entrypoint.sh \
-    && sed -i '5a NEWHOME="/data"' /usr/local/bin/docker-entrypoint.sh \
-    # Install plugins
-    && /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch ingest-attachment
+# Data persistence & migration: source the add-on init script at the top of
+# the official entrypoint (pattern-anchored; ingest-attachment is bundled
+# since ES 8.0 so no plugin install is needed anymore)
+RUN sed -i '/^set -e$/a . /usr/local/bin/addon-init.sh' /usr/local/bin/docker-entrypoint.sh \
+    && grep -q "addon-init.sh" /usr/local/bin/docker-entrypoint.sh
 
 ##################
 # 3 Install apps #
@@ -62,7 +57,7 @@ COPY ha_automodules.sh /ha_automodules.sh
 RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
 
 # Manual apps
-ENV PACKAGES=""
+ENV PACKAGES="jq"
 
 # Automatic apps & bashio
 COPY ha_autoapps.sh /ha_autoapps.sh
diff --git a/elasticsearch/README.md b/elasticsearch/README.md
index 3379d23bed..ee9e174c12 100644
--- a/elasticsearch/README.md
+++ b/elasticsearch/README.md
@@ -91,6 +91,22 @@ Connect other applications to Elasticsearch using:
 
 Use the add-on `env_vars` option to pass extra environment variables (uppercase or lowercase names). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
 
+Elasticsearch settings can be set through variables named `ES_SETTING_<SETTING_WITH_UNDERSCORES>`; for example `ES_SETTING_XPACK_SECURITY_ENABLED` maps to `xpack.security.enabled`.
+
+### Security
+
+To preserve the plain-HTTP behavior of previous versions (and compatibility with the Home Assistant Elasticsearch integration), `xpack.security.enabled` defaults to `false`. To enable Elasticsearch security, add `ES_SETTING_XPACK_SECURITY_ENABLED` with value `true` in `env_vars`.
+
+## Upgrading from 7.x
+
+The upgrade to Elasticsearch 8.x is automatic and **one-way**:
+
+1. Take a Home Assistant backup of the add-on before updating.
+2. Update the add-on and start it. Elasticsearch upgrades the existing indices in place on first start — this can take a while on large datasets; do **not** stop the add-on during the first start.
+3. The previous bundled config directory is archived to `/data/config.bak-<old-version>`; re-apply any custom settings to the new config.
+
+Downgrading afterwards is not supported by Elasticsearch — restore the backup instead.
+
 ## Integration with HA
 
 Component : https://community.home-assistant.io/t/elasticsearch-component-publish-home-assistant-events-to-elasticsearch/66877
diff --git a/elasticsearch/config.yaml b/elasticsearch/config.yaml
index 6219b3cb36..13a19f4a81 100644
--- a/elasticsearch/config.yaml
+++ b/elasticsearch/config.yaml
@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: 8.14.3-3
+version: 8.19.18
diff --git a/elasticsearch/rootfs/etc/cont-init.d/99-run.sh b/elasticsearch/rootfs/etc/cont-init.d/99-run.sh
deleted file mode 100755
index a9bf588e2f..0000000000
--- a/elasticsearch/rootfs/etc/cont-init.d/99-run.sh
+++ /dev/null
@@ -1 +0,0 @@
-#!/bin/bash
diff --git a/elasticsearch/rootfs/usr/local/bin/addon-init.sh b/elasticsearch/rootfs/usr/local/bin/addon-init.sh
new file mode 100644
index 0000000000..63533c96d3
--- /dev/null
+++ b/elasticsearch/rootfs/usr/local/bin/addon-init.sh
@@ -0,0 +1,138 @@
+#!/bin/bash
+# shellcheck shell=bash
+# Sourced by /usr/local/bin/docker-entrypoint.sh (right after "set -e"),
+# before Elasticsearch starts. Runs as root when the Supervisor starts the
+# container; the official entrypoint then drops privileges itself.
+#
+# Responsibilities:
+#   1. Export user env_vars from /data/options.json
+#   2. Default xpack.security.enabled=false (7.x behavior) unless user overrides
+#   3. Relocate data & config to /data for persistence (idempotent)
+#   4. Guard major-version data migrations (7.x -> 8.x is automatic)
+
+echo "-----------------------------------------------------------"
+echo " Add-on: Elasticsearch server"
+echo " Upstream version: ${UPSTREAM_VERSION:-unknown}"
+echo "-----------------------------------------------------------"
+
+ES_HOME="/usr/share/elasticsearch"
+PERSISTENT_HOME="/data"
+VERSION_MARKER="$PERSISTENT_HOME/.addon-upstream-version"
+OPTIONS_JSON="/data/options.json"
+
+############################
+# 1 Export user env_vars   #
+############################
+
+if [ -f "$OPTIONS_JSON" ] && command -v jq >/dev/null 2>&1; then
+    while IFS= read -r pair; do
+        name=$(jq -r '.name // empty' <<<"$pair")
+        value=$(jq -r '.value // empty' <<<"$pair")
+        if [[ $name =~ ^[A-Za-z0-9_]+$ ]]; then
+            echo "Setting env variable from options: $name"
+            export "$name"="$value"
+        elif [ -n "$name" ]; then
+            echo "WARNING: ignoring invalid env_vars name: $name"
+        fi
+    done < <(jq -c '.env_vars[]?' "$OPTIONS_JSON" 2>/dev/null || true)
+fi
+
+##################################
+# 2 Security default (7.x parity)#
+##################################
+
+# ES 8+ enables security + TLS by default, which breaks plain-http clients
+# such as the homeassistant-elasticsearch component. Keep the previous 7.x
+# behavior unless the user explicitly configures xpack.security themselves
+# (either as a dotted setting or via the ES_SETTING_* translation).
+if ! env | grep -qiE '^(xpack\.security\.|ES_SETTING_XPACK_SECURITY_)'; then
+    export ES_SETTING_XPACK_SECURITY_ENABLED=false
+    echo "Security: xpack.security.enabled=false (default; override by setting ES_SETTING_XPACK_SECURITY_ENABLED in env_vars)"
+fi
+
+############################
+# 3 Migration guard        #
+############################
+
+current_version="${UPSTREAM_VERSION:-0.0.0}"
+current_major="${current_version%%.*}"
+data_version=""
+
+if [ -f "$VERSION_MARKER" ]; then
+    data_version="$(head -n 1 "$VERSION_MARKER" | tr -cd '0-9.')"
+elif [ -d "$PERSISTENT_HOME/data" ] && [ -n "$(ls -A "$PERSISTENT_HOME/data" 2>/dev/null)" ]; then
+    # Existing data without a marker: only 7.17.9 was ever shipped before markers
+    data_version="7.17.9"
+fi
+
+if [ -n "$data_version" ] && [[ $current_major =~ ^[0-9]+$ ]]; then
+    data_major="${data_version%%.*}"
+    if [ "$data_major" -gt "$current_major" ]; then
+        echo "FATAL: existing data was written by Elasticsearch $data_version but this add-on runs $current_version."
+        echo "Downgrading Elasticsearch data is not supported. Restore a Home Assistant snapshot taken with the newer version, or delete the add-on data to start fresh."
+        exit 1
+    elif [ "$((current_major - data_major))" -gt 1 ]; then
+        echo "FATAL: existing data was written by Elasticsearch $data_version, which is more than one major version behind $current_version."
+        echo "Elasticsearch can only upgrade data from the previous major version. Upgrade stepwise (e.g. $data_major.x -> $((data_major + 1)).x -> ...) or delete the add-on data to start fresh."
+        exit 1
+    elif [ "$data_major" -lt "$current_major" ]; then
+        echo "NOTICE: one-time automatic data migration from Elasticsearch $data_version to $current_version."
+        echo "NOTICE: indices are upgraded automatically on startup. This can take a while on large datasets - do NOT stop the add-on during the first start."
+        # The bundled config from the old major is stale (jvm.options, log4j2,
+        # security settings). Archive it so a fresh one is seeded below.
+        if [ -d "$PERSISTENT_HOME/config" ] && [ ! -L "$PERSISTENT_HOME/config" ]; then
+            config_backup="$PERSISTENT_HOME/config.bak-$data_version"
+            if [ ! -e "$config_backup" ]; then
+                mv "$PERSISTENT_HOME/config" "$config_backup"
+                echo "NOTICE: previous config archived to $config_backup. Re-apply any custom settings to the new config."
+            fi
+        fi
+        # The container config dir may still symlink to the archived config
+        if [ -L "$ES_HOME/config" ]; then
+            rm -f "$ES_HOME/config"
+        fi
+    fi
+fi
+
+############################
+# 4 Data persistence       #
+############################
+
+mkdir -p "$PERSISTENT_HOME"
+for dir in "data" "config"; do
+    if [ ! -L "$ES_HOME/$dir" ]; then
+        if [ -d "$ES_HOME/$dir" ]; then
+            cp -rn "$ES_HOME/$dir" "$PERSISTENT_HOME" 2>/dev/null || true
+            rm -rf "${ES_HOME:?}/$dir"
+        fi
+        mkdir -p "$PERSISTENT_HOME/$dir"
+        ln -s "$PERSISTENT_HOME/$dir" "$ES_HOME/$dir"
+    fi
+done
+
+# Make the persisted files usable by the elasticsearch user (uid 1000),
+# which the official entrypoint drops to when started as root
+if [ "$(id -u)" -eq 0 ]; then
+    chown -R 1000:0 "$PERSISTENT_HOME/data" "$PERSISTENT_HOME/config" 2>/dev/null || true
+fi
+
+echo "Data location: $PERSISTENT_HOME (persistent). Please wait while elasticsearch starts..."
+
+############################
+# 5 Record data version    #
+############################
+
+# Only record the running version once ES is confirmed healthy, so a failed
+# upgrade attempt never masks the true on-disk data lineage
+if [ "$data_version" != "$current_version" ]; then
+    (
+        for _ in $(seq 1 180); do
+            if curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:9200" >/dev/null 2>&1; then
+                echo "$current_version" >"$VERSION_MARKER"
+                echo "Elasticsearch $current_version started successfully; data version recorded."
+                exit 0
+            fi
+            sleep 10
+        done
+    ) &
+fi
diff --git a/elasticsearch/updater.json b/elasticsearch/updater.json
new file mode 100644
index 0000000000..fdaf54d409
--- /dev/null
+++ b/elasticsearch/updater.json
@@ -0,0 +1,10 @@
+{
+  "github_fulltag": false,
+  "github_tagfilter": "v8.19",
+  "last_update": "14-07-2026",
+  "repository": "alexbelgium/hassio-addons",
+  "slug": "elasticsearch",
+  "source": "github",
+  "upstream_repo": "elastic/elasticsearch",
+  "upstream_version": "8.19.18"
+}