diff --git a/deploy/charts/buzz/Chart.yaml b/deploy/charts/buzz/Chart.yaml
index 49a6fafd192..c8d5b84c270 100644
--- a/deploy/charts/buzz/Chart.yaml
+++ b/deploy/charts/buzz/Chart.yaml
@@ -8,7 +8,9 @@ description: |
   (subcharts on) and HA production (external services, existingSecret).
 type: application
 version: 0.1.8
-appVersion: "0.1.0"
+# Post-auto-migrate image (see #988). Empty values.image.tag falls back here —
+# keep this on a tag that understands BUZZ_AUTO_MIGRATE (compose uses `:main`).
+appVersion: "main"
 home: https://github.com/block/buzz
 sources:
   - https://github.com/block/buzz
@@ -25,6 +27,8 @@ annotations:
   artifacthub.io/changes: |
     - kind: added
       description: Optional immutable relay image digest pinning with backwards-compatible tag fallback.
+    - kind: fixed
+      description: Default appVersion tracks ghcr.io/block/buzz:main so BUZZ_AUTO_MIGRATE works out of the box (#2473).
   artifacthub.io/license: Apache-2.0
 
 # Optional eval-only subcharts. Production deploys disable both and point
diff --git a/deploy/charts/buzz/tests/render_test.yaml b/deploy/charts/buzz/tests/render_test.yaml
index f288f8df2d5..3b650eb7719 100644
--- a/deploy/charts/buzz/tests/render_test.yaml
+++ b/deploy/charts/buzz/tests/render_test.yaml
@@ -48,6 +48,40 @@ tests:
             name: BUZZ_HUDDLE_AUDIO_AVAILABLE
             value: "true"
         template: templates/deployment.yaml
+      # Empty image.tag falls back to Chart.appVersion — must be post-auto-migrate (#2473).
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/block/buzz:main
+        template: templates/deployment.yaml
+      # Security default: media GET/HEAD reads must be auth-gated out of the
+      # box. A private attachment must never be publicly readable by URL/hash
+      # in an unmodified render. If this assertion fails, someone flipped the
+      # default — treat that as a security regression, not a config tweak.
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: BUZZ_REQUIRE_MEDIA_GET_AUTH
+            value: "true"
+        template: templates/deployment.yaml
+
+  - it: lets an explicit value opt out of media read auth for dev/public deployments
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+      relay.requireMediaGetAuth: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: BUZZ_REQUIRE_MEDIA_GET_AUTH
+            value: "false"
+        template: templates/deployment.yaml
+
   - it: renders virtual-hosted S3 addressing for providers that require it
     set:
       relayUrl: wss://buzz.example.com
diff --git a/deploy/charts/buzz/values.yaml b/deploy/charts/buzz/values.yaml
index 6c57a5c8ac9..3e1ce7fcfca 100644
--- a/deploy/charts/buzz/values.yaml
+++ b/deploy/charts/buzz/values.yaml
@@ -24,6 +24,8 @@ quickstart: false
 # ── Image ────────────────────────────────────────────────────────────────────
 image:
   repository: ghcr.io/block/buzz
+  # Empty → Chart.appVersion (must be a post-auto-migrate image; see #2473).
+  # Pin to sha-<7> or a release tag for production.
   tag: ""                        # empty → .Chart.AppVersion
   digest: ""                     # optional sha256:...; when set, overrides tag
   pullPolicy: IfNotPresent