diff --git a/.SRCINFO b/.SRCINFO
index c172389..6b34733 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,6 +1,6 @@
 pkgbase = gotosocial-balki
 	pkgdesc = ActivityPub social network server written in Golang
-	pkgver = 0.20.3
+	pkgver = 0.21.1
 	pkgrel = 1
 	url = https://gotosocial.org
 	arch = x86_64
@@ -63,20 +63,20 @@ pkgbase = gotosocial-balki
 	backup = etc/gotosocial/template/status_poll.tmpl
 	backup = etc/gotosocial/template/tag.tmpl
 	backup = etc/gotosocial/template/thread.tmpl
-	source = gotosocial::git+https://codeberg.org/superseriousbusiness/gotosocial#tag=v0.20.3
+	source = gotosocial::git+https://codeberg.org/superseriousbusiness/gotosocial#tag=v0.21.1
 	source = sysusers.conf
 	source = tmpfiles.conf
 	source = use-fhs-directories.patch
 	source = modded.patch
-	sha512sums = 163d414314b5c670fdce36f6c1cadec7b38dbb7cb12a47f61323e28d772d8aea2719be9821a632d68ca18f7cc6e440621cb9156105bf5e7eac2c6fabeb9fd531
+	sha512sums = 75df2cf6d197f77ede26854353a59e63cd956f6ff2c029b1964ae74f90844cc7faf8ab563ce610623429dea4875cc613d9a60d7a0c434ca26c598badab229ac5
 	sha512sums = 2ff5499a31e12733cb20a9261942ed135fbac327d5a836b8955f3e86c009a603cf965440d9dbe6db64b80d0f652ba56faddb0ef398393b72474d8cf6c438ab80
 	sha512sums = b89fad3073e140f17167515b38942e5b5e2bc2aee03c484e1bb7cf6444f86cb1e2a13a60b101e04d22633d348be073ca26cd309da4746e5062c12b4f3ce4b38a
 	sha512sums = 87edf6e6acee86a621c838a7db32f1c9aab70bc5640f8eae099c5133a2be77ec2f711261d716a6821e4c0414436592170b1ae7a5f652bc8aeab49c8dbd0fedde
-	sha512sums = 7c3fe90c5aa6712e053e46d2f3a02606c48e57f49531ea7cb855e967f30c562fe7b353fa6666d04481e77196c0581bca98c678e69aafc23abf5522986e548dcf
-	b2sums = ed6564b2676e383479c0509409fdb9786fa5f1027ba122afd2f9de6ffb2a10c8ec9df855c7ce62bb2a8c714c0b6b2829237799268a15546e2d8a74eebb6e3b66
+	sha512sums = 54ce7741e0e5e53a5719bb7f396175ad19f63f5714257d6d4b6befd934906ea9515cc1b203688e152dfd0a57315d405c6e6ee92e48069b606768aa5658a2e76a
+	b2sums = 28e357ce4d63f222b2078cf92d51ca5438db5e9a1427c2f145adafcfc5fa2aa1001547c7c87bd49158de470c7eaf7da2e7f5af7c7808d9656909442de43d7da8
 	b2sums = ccf672731b88fc6700b0b81737790365e1eea0066bad1bbf6b13dac1e5b42af69063838efca47a6d9c16ee3f6308e2e23b92cf79d4226cd88f8551fb7361649b
 	b2sums = 4f65af952441c0f54bb32049a149675e207f8993678423d369c4095c57476464614ac720eccc64d7a93a81268ad7ca41cae75ca7211bd7b78f9035f6e5341f04
 	b2sums = 3671911545d15cc21045b37fbe6983c05499e66b8a6a1e1b3eccbb5c2686914c88b090dec0bfe8e2919d8787e5b4c59bfb1e2c292cad30a8b552ab57e91d5fdf
-	b2sums = 42d59322123dbf6a2bf836f155f7d0b2a6221803acd0efc85e82aa3543654e57e15a1225787d2aadba7f96a3c2de24fb078e547e143a867f03c5bef38ecf5d09
+	b2sums = 9b0f65ad56fbdd92b5e827b169d4152609a075bd3d7c90d227e1c8736692fbf58eb672d7138e3bfb04e9308248c25dfe56d9df6a99c86263a96ed38395fd0319
 
 pkgname = gotosocial-balki
diff --git a/PKGBUILD b/PKGBUILD
index 6bc3e1f..7a42002 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,7 +4,7 @@
 
 pkgname=gotosocial-balki
 _pkgname=gotosocial
-pkgver=0.20.3
+pkgver=0.21.1
 pkgrel=1
 pkgdesc='ActivityPub social network server written in Golang'
 arch=(x86_64)
@@ -73,16 +73,16 @@ source=(
   use-fhs-directories.patch
   modded.patch
 )
-sha512sums=('163d414314b5c670fdce36f6c1cadec7b38dbb7cb12a47f61323e28d772d8aea2719be9821a632d68ca18f7cc6e440621cb9156105bf5e7eac2c6fabeb9fd531'
+sha512sums=('75df2cf6d197f77ede26854353a59e63cd956f6ff2c029b1964ae74f90844cc7faf8ab563ce610623429dea4875cc613d9a60d7a0c434ca26c598badab229ac5'
             '2ff5499a31e12733cb20a9261942ed135fbac327d5a836b8955f3e86c009a603cf965440d9dbe6db64b80d0f652ba56faddb0ef398393b72474d8cf6c438ab80'
             'b89fad3073e140f17167515b38942e5b5e2bc2aee03c484e1bb7cf6444f86cb1e2a13a60b101e04d22633d348be073ca26cd309da4746e5062c12b4f3ce4b38a'
             '87edf6e6acee86a621c838a7db32f1c9aab70bc5640f8eae099c5133a2be77ec2f711261d716a6821e4c0414436592170b1ae7a5f652bc8aeab49c8dbd0fedde'
-            '7c3fe90c5aa6712e053e46d2f3a02606c48e57f49531ea7cb855e967f30c562fe7b353fa6666d04481e77196c0581bca98c678e69aafc23abf5522986e548dcf')
-b2sums=('ed6564b2676e383479c0509409fdb9786fa5f1027ba122afd2f9de6ffb2a10c8ec9df855c7ce62bb2a8c714c0b6b2829237799268a15546e2d8a74eebb6e3b66'
+            '54ce7741e0e5e53a5719bb7f396175ad19f63f5714257d6d4b6befd934906ea9515cc1b203688e152dfd0a57315d405c6e6ee92e48069b606768aa5658a2e76a')
+b2sums=('28e357ce4d63f222b2078cf92d51ca5438db5e9a1427c2f145adafcfc5fa2aa1001547c7c87bd49158de470c7eaf7da2e7f5af7c7808d9656909442de43d7da8'
         'ccf672731b88fc6700b0b81737790365e1eea0066bad1bbf6b13dac1e5b42af69063838efca47a6d9c16ee3f6308e2e23b92cf79d4226cd88f8551fb7361649b'
         '4f65af952441c0f54bb32049a149675e207f8993678423d369c4095c57476464614ac720eccc64d7a93a81268ad7ca41cae75ca7211bd7b78f9035f6e5341f04'
         '3671911545d15cc21045b37fbe6983c05499e66b8a6a1e1b3eccbb5c2686914c88b090dec0bfe8e2919d8787e5b4c59bfb1e2c292cad30a8b552ab57e91d5fdf'
-        '42d59322123dbf6a2bf836f155f7d0b2a6221803acd0efc85e82aa3543654e57e15a1225787d2aadba7f96a3c2de24fb078e547e143a867f03c5bef38ecf5d09')
+        '9b0f65ad56fbdd92b5e827b169d4152609a075bd3d7c90d227e1c8736692fbf58eb672d7138e3bfb04e9308248c25dfe56d9df6a99c86263a96ed38395fd0319')
 
 prepare() {
   cd "$_pkgname"
diff --git a/REUSE.toml b/REUSE.toml
index 3ba8a05..b90a4a4 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -3,8 +3,6 @@ version = 1
 [[annotations]]
 path = [
     "PKGBUILD",
-    "README.md",
-    "keys/**",
     ".SRCINFO",
     ".nvchecker.toml",
     "sysusers.conf",
diff --git a/modded.patch b/modded.patch
index 1e22ade..992151f 100644
--- a/modded.patch
+++ b/modded.patch
@@ -1,5 +1,5 @@
 diff --git a/example/config.yaml b/example/config.yaml
-index a7c679f38..144e7580d 100644
+index 5c284b058..0fc7a16d8 100644
 --- a/example/config.yaml
 +++ b/example/config.yaml
 @@ -118,7 +118,7 @@ account-domain: ""
@@ -44,41 +44,50 @@ index a7c679f38..144e7580d 100644
  db-address: "sqlite.db"
  
 diff --git a/go.mod b/go.mod
-index dfa91d6fe..a096979ec 100644
+index ff934c684..81fb8e95a 100644
 --- a/go.mod
 +++ b/go.mod
-@@ -71,6 +71,7 @@ require (
- 	github.com/uptrace/bun/extra/bunotel v1.2.15
+@@ -76,6 +76,7 @@ require (
+ 	github.com/uptrace/bun/extra/bunotel v1.2.17
  	github.com/wagslane/go-password-validator v0.3.0
- 	github.com/yuin/goldmark v1.7.13
+ 	github.com/yuin/goldmark v1.7.16
 +	go.balki.me/anyhttp v0.5.2
- 	go.opentelemetry.io/contrib/exporters/autoexport v0.63.0
- 	go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0
- 	go.opentelemetry.io/otel v1.38.0
+ 	go.opentelemetry.io/contrib/exporters/autoexport v0.65.0
+ 	go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0
+ 	go.opentelemetry.io/otel v1.40.0
 diff --git a/go.sum b/go.sum
-index ce986407b..4610bf550 100644
+index edd9edd3b..624abebc5 100644
 --- a/go.sum
 +++ b/go.sum
-@@ -44,8 +44,6 @@ codeberg.org/gruf/go-maps v1.0.4 h1:K+Ww4vvR3TZqm5jqrKVirmguZwa3v1VUvmig2SE8uxY=
- codeberg.org/gruf/go-maps v1.0.4/go.mod h1:ASX7osM7kFwt5O8GfGflcFjrwYGD8eIuRLl/oMjhEi8=
- codeberg.org/gruf/go-mempool v0.0.0-20251003110531-b54adae66253 h1:qPAY72xCWlySVROSNZecfLGAyeV/SiXmPmfhUU+o3Xw=
- codeberg.org/gruf/go-mempool v0.0.0-20251003110531-b54adae66253/go.mod h1:761koiXmqfgzvu5mez2Rk7YlwWilpqJ/zv5hIA6NoNI=
--codeberg.org/gruf/go-mmap v0.0.0-20251105200114-34f58283863a h1:b0SZOKBohFBiGDiMBAM7vwHZxwQ6wpL4uaajqtoke+c=
--codeberg.org/gruf/go-mmap v0.0.0-20251105200114-34f58283863a/go.mod h1:kaHx5xHuLNf13iALbHiFpXmLeO33Ll/aW3mGkW8sI40=
- codeberg.org/gruf/go-mmap v0.0.0-20251111184116-345a42dab154 h1:2SSyx/7XgOOC9nKdlrgpxenz7oZlvUeLR+YEfjM6iS8=
- codeberg.org/gruf/go-mmap v0.0.0-20251111184116-345a42dab154/go.mod h1:kaHx5xHuLNf13iALbHiFpXmLeO33Ll/aW3mGkW8sI40=
- codeberg.org/gruf/go-mutexes v1.5.8 h1:HRGnvT4COb3jX9xdeoSUUbjPgmk5kXPuDfld9ksUJKA=
-@@ -501,6 +499,8 @@ github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
- github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
- gitlab.com/NyaaaWhatsUpDoc/sqlite v1.40.0-concurrency-workaround h1:RCxabWH2xbAyFjBsvmX/IC/HVJf48co9QZphvMb93wo=
- gitlab.com/NyaaaWhatsUpDoc/sqlite v1.40.0-concurrency-workaround/go.mod h1:9fjQZ0mB1LLP0GYrp39oOJXx/I2sxEnZtzCmEQIKvGE=
+@@ -516,6 +516,8 @@ github.com/yuin/goldmark v1.7.16 h1:n+CJdUxaFMiDUNnWC3dMWCIQJSkxH4uz3ZwQBkAlVNE=
+ github.com/yuin/goldmark v1.7.16/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+ gitlab.com/NyaaaWhatsUpDoc/sqlite v1.45.0-concurrency-workaround h1:ZUMRkBuH0UYp31yhNt28+Wv5FEBqkEZl0VZyf+skCno=
+ gitlab.com/NyaaaWhatsUpDoc/sqlite v1.45.0-concurrency-workaround/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 +go.balki.me/anyhttp v0.5.2 h1:et4tCDXLeXpWfMNvRKG7ojfrnlr3du7cEaG966MLSpA=
 +go.balki.me/anyhttp v0.5.2/go.mod h1:JhfekOIjgVODoVqUCficjpIgmB3wwlB7jhN0eN2EZ/s=
  go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
  go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
- go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+diff --git a/internal/api/util/mime.go b/internal/api/util/mime.go
+index 6159d4b79..280be3445 100644
+--- a/internal/api/util/mime.go
++++ b/internal/api/util/mime.go
+@@ -42,6 +42,13 @@
+ 	UTF8              = `utf-8`
+ )
+ 
++func JSONVariantContentType(ct string) bool {
++	p := splitContentType(ct)
++	p, ok := isUTF8ContentType(p)
++	return ok && len(p) == 1 &&
++		(p[0] == AppJSON || (strings.HasPrefix(p[0], `application/`) && strings.HasSuffix(p[0], `+json`)))
++}
++
+ // JSONContentType returns whether is application/json(;charset=utf-8)? content-type.
+ func JSONContentType(ct string) bool {
+ 	p := splitContentType(ct)
 diff --git a/internal/config/config.go b/internal/config/config.go
-index 9ee321b56..cee63661b 100644
+index 069465ef7..aa9409605 100644
 --- a/internal/config/config.go
 +++ b/internal/config/config.go
 @@ -54,13 +54,13 @@ func fieldtag(field, tag string) string {
@@ -113,10 +122,10 @@ index 9ee321b56..cee63661b 100644
  
  type HTTPClientConfiguration struct {
 diff --git a/internal/config/defaults.go b/internal/config/defaults.go
-index a1b4ec211..48e7fd0e8 100644
+index ff41dfa5a..d37ec5c82 100644
 --- a/internal/config/defaults.go
 +++ b/internal/config/defaults.go
-@@ -263,4 +263,7 @@
+@@ -268,4 +268,7 @@
  	RequestIDHeader: "X-Request-Id",
  
  	LogClientIP: true,
@@ -125,18 +134,18 @@ index a1b4ec211..48e7fd0e8 100644
 +	KalaclistaTurnOffAuthorizedFetch: true,
  }
 diff --git a/internal/config/helpers.gen.go b/internal/config/helpers.gen.go
-index 078c67289..73d2f8152 100644
+index 8fcc1016c..13ab000b1 100644
 --- a/internal/config/helpers.gen.go
 +++ b/internal/config/helpers.gen.go
-@@ -226,6 +226,7 @@
- 	AdminMediaListRemoteOnlyFlag                   = "remote-only"
- 	TestrigSkipDBSetupFlag                         = "skip-db-setup"
- 	TestrigSkipDBTeardownFlag                      = "skip-db-teardown"
-+	KalaclistaTurnOffAuthorizedFetchFlag           = "kalaclista-turnoff-authorized-fetch"
+@@ -230,6 +230,7 @@
+ 	AdminMediaListRemoteOnlyFlag                  = "remote-only"
+ 	TestrigSkipDBSetupFlag                        = "skip-db-setup"
+ 	TestrigSkipDBTeardownFlag                     = "skip-db-teardown"
++	KalaclistaTurnOffAuthorizedFetchFlag          = "kalaclista-turnoff-authorized-fetch"
  )
  
  func (cfg *Configuration) RegisterFlags(flags *pflag.FlagSet) {
-@@ -417,6 +418,7 @@ func (cfg *Configuration) RegisterFlags(flags *pflag.FlagSet) {
+@@ -425,10 +426,11 @@ func (cfg *Configuration) RegisterFlags(flags *pflag.FlagSet) {
  	flags.Float64("cache-mutes-mem-ratio", cfg.Cache.MutesMemRatio, "")
  	flags.Float64("cache-status-filter-mem-ratio", cfg.Cache.StatusFilterMemRatio, "")
  	flags.Float64("cache-visibility-mem-ratio", cfg.Cache.VisibilityMemRatio, "")
@@ -144,7 +153,12 @@ index 078c67289..73d2f8152 100644
  }
  
  func (cfg *Configuration) MarshalMap() map[string]any {
-@@ -618,6 +620,7 @@ func (cfg *Configuration) MarshalMap() map[string]any {
+-	cfgmap := make(map[string]any, 201)
++	cfgmap := make(map[string]any, 202)
+ 	cfgmap["log-level"] = cfg.LogLevel
+ 	cfgmap["log-format"] = cfg.LogFormat
+ 	cfgmap["log-timestamp-format"] = cfg.LogTimestampFormat
+@@ -630,6 +632,7 @@ func (cfg *Configuration) MarshalMap() map[string]any {
  	cfgmap["remote-only"] = cfg.AdminMediaListRemoteOnly
  	cfgmap["skip-db-setup"] = cfg.TestrigSkipDBSetup
  	cfgmap["skip-db-teardown"] = cfg.TestrigSkipDBTeardown
@@ -152,7 +166,7 @@ index 078c67289..73d2f8152 100644
  	return cfgmap
  }
  
-@@ -2237,6 +2240,14 @@ func (cfg *Configuration) UnmarshalMap(cfgmap map[string]any) error {
+@@ -2281,6 +2284,14 @@ func (cfg *Configuration) UnmarshalMap(cfgmap map[string]any) error {
  		}
  	}
  
@@ -167,7 +181,7 @@ index 078c67289..73d2f8152 100644
  	return nil
  }
  
-@@ -2570,6 +2581,31 @@ func GetTrustedProxies() []string { return global.GetTrustedProxies() }
+@@ -2614,6 +2625,31 @@ func GetTrustedProxies() []string { return global.GetTrustedProxies() }
  // SetTrustedProxies safely sets the value for global configuration 'TrustedProxies' field
  func SetTrustedProxies(v []string) { global.SetTrustedProxies(v) }
  
@@ -199,7 +213,7 @@ index 078c67289..73d2f8152 100644
  // GetSoftwareVersion safely fetches the Configuration value for state's 'SoftwareVersion' field
  func (st *ConfigState) GetSoftwareVersion() (v string) {
  	st.mutex.RLock()
-@@ -6598,6 +6634,28 @@ func GetTestrigSkipDBTeardown() bool { return global.GetTestrigSkipDBTeardown()
+@@ -6730,6 +6766,28 @@ func GetTestrigSkipDBTeardown() bool { return global.GetTestrigSkipDBTeardown()
  // SetTestrigSkipDBTeardown safely sets the value for global configuration 'TestrigSkipDBTeardown' field
  func SetTestrigSkipDBTeardown(v bool) { global.SetTestrigSkipDBTeardown(v) }
  
@@ -208,7 +222,7 @@ index 078c67289..73d2f8152 100644
 +	st.mutex.RLock()
 +	v = st.config.KalaclistaTurnOffAuthorizedFetch
 +	st.mutex.RUnlock()
-+	return v
++	return
 +}
 +
 +// SetKalaclistaTurnOffAuthorizedFetch safely sets the Configuration value for state's 'KalaclistaTurnOffAuthorizedFetch' field
@@ -255,7 +269,7 @@ index ff6ed6fd4..01b3037f1 100644
  	}
  
 diff --git a/internal/router/router.go b/internal/router/router.go
-index fd7a18ebe..8ee62dc89 100644
+index d9d0a399d..57e0bb3d5 100644
 --- a/internal/router/router.go
 +++ b/internal/router/router.go
 @@ -24,6 +24,7 @@
@@ -265,7 +279,7 @@ index fd7a18ebe..8ee62dc89 100644
 +	"strings"
  	"time"
  
- 	"code.superseriousbusiness.org/gotosocial/internal/config"
+ 	"code.superseriousbusiness.org/gopkg/log"
 @@ -32,6 +33,7 @@
  	"codeberg.org/gruf/go-bytesize"
  	"codeberg.org/gruf/go-debug"
@@ -286,7 +300,7 @@ index fd7a18ebe..8ee62dc89 100644
  	// Set up client IP forwarding via
  	// trusted x-forwarded-* headers.
  	trustedProxies := config.GetTrustedProxies()
-@@ -138,6 +145,7 @@ func (r *Router) Start() error {
+@@ -132,6 +139,7 @@ func (r *Router) Start() error {
  		certFile  = config.GetTLSCertificateChain()
  		keyFile   = config.GetTLSCertificateKey()
  		leEnabled = config.GetLetsEncryptEnabled()
@@ -294,7 +308,7 @@ index fd7a18ebe..8ee62dc89 100644
  	)
  
  	switch {
-@@ -158,6 +166,18 @@ func (r *Router) Start() error {
+@@ -152,6 +160,18 @@ func (r *Router) Start() error {
  			return err
  		}
  
@@ -313,6 +327,19 @@ index fd7a18ebe..8ee62dc89 100644
  	// Default listen. TLS must
  	// be handled by reverse proxy.
  	default:
+diff --git a/internal/transport/finger.go b/internal/transport/finger.go
+index bed14c2b3..1bc4dccaa 100644
+--- a/internal/transport/finger.go
++++ b/internal/transport/finger.go
+@@ -112,7 +112,7 @@ func (t *transport) Finger(ctx context.Context, targetUsername string, targetDom
+ 		}
+ 
+ 		// Ensure that the incoming request content-type is expected.
+-		if ct := rsp.Header.Get("Content-Type"); !apiutil.JSONJRDContentType(ct) {
++		if ct := rsp.Header.Get("Content-Type"); !(apiutil.JSONJRDContentType(ct) || apiutil.JSONVariantContentType(ct)) {
+ 			err := gtserror.Newf("non webfinger type response: %s", ct)
+ 			return nil, gtserror.SetMalformed(err)
+ 		}
 diff --git a/vendor/go.balki.me/anyhttp/LICENSE b/vendor/go.balki.me/anyhttp/LICENSE
 new file mode 100644
 index 000000000..ad2653ac1
@@ -1216,10 +1243,10 @@ index 000000000..ee3d81ff1
 +	return i.c
 +}
 diff --git a/vendor/modules.txt b/vendor/modules.txt
-index b959ddc5a..43d951ba8 100644
+index 96cdab2aa..b92f9305e 100644
 --- a/vendor/modules.txt
 +++ b/vendor/modules.txt
-@@ -1007,6 +1007,10 @@ github.com/yuin/goldmark/renderer
+@@ -1045,6 +1045,10 @@ github.com/yuin/goldmark/renderer
  github.com/yuin/goldmark/renderer/html
  github.com/yuin/goldmark/text
  github.com/yuin/goldmark/util