diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 400b3519..90d960aa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,19 +68,8 @@ jobs:
       - name: Deployment Checks
         run: python manage.py check --deploy --fail-level ERROR
 
-      # The ignored IDs are Django 4.2.30 advisories, fixed in Django 5.2.17.
-      # Remove them with the Django 5.2 upgrade.
       - name: Audit Installed Packages
-        run: |
-          pip-audit \
-            --ignore-vuln PYSEC-2026-198 \
-            --ignore-vuln PYSEC-2026-199 \
-            --ignore-vuln PYSEC-2026-201 \
-            --ignore-vuln PYSEC-2026-2090 \
-            --ignore-vuln PYSEC-2026-2091 \
-            --ignore-vuln PYSEC-2026-2092 \
-            --ignore-vuln PYSEC-2026-3717 \
-            --ignore-vuln PYSEC-2026-4035
+        run: pip-audit
 
   docker:
     name: Docker Image
diff --git a/README.md b/README.md
index 1164df40..2ad82c6d 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/retspen/webvirtcloud)
 
 # WebVirtCloud
-###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.13)
+###### Python >=3.10 & Django 5.2 LTS (tested on Python 3.10 – 3.13)
 
 ## Purpose and Scope
 
@@ -394,6 +394,10 @@ environment=CSRF_TRUSTED_ORIGINS="https://webvirtcloud.example.com"
 
 ## How To Update
 
+Back up `db.sqlite3` before updating (in Docker it lives in the `data` volume).
+
+Upgrading from Django 4.2: delete `USE_L10N` from `webvirtcloud/settings.py` (Django 5 ignores it). Logging out now needs a POST; links or scripts that call `/accounts/logout/` with GET get 405.
+
 Before running migrations, add `accounts.middleware.ForcePasswordChangeMiddleware`
 to `MIDDLEWARE` in your existing `webvirtcloud/settings.py`, after
 `django.contrib.auth.middleware.AuthenticationMiddleware` (and the OTP/login-required
diff --git a/accounts/tests.py b/accounts/tests.py
index 22cb6a26..3267c7b4 100644
--- a/accounts/tests.py
+++ b/accounts/tests.py
@@ -76,7 +76,7 @@ class AccountsTestCase(TestCase):
         )
         self.assertRedirects(response, settings.LOGIN_REDIRECT_URL)
 
-        response = client.get(reverse("accounts:logout"))
+        response = client.post(reverse("accounts:logout"))
         self.assertRedirects(response, reverse("accounts:login"))
 
     def test_change_password(self):
diff --git a/conf/requirements.txt b/conf/requirements.txt
index 7435ab46..30d0260f 100644
--- a/conf/requirements.txt
+++ b/conf/requirements.txt
@@ -1,4 +1,4 @@
-Django==4.2.30
+Django==5.2.17
 django_bootstrap5==26.2
 django-bootstrap-icons==0.9.0
 django-login-required-middleware==0.9.0
diff --git a/templates/navbar.html b/templates/navbar.html
index 72f38925..e71867ba 100644
--- a/templates/navbar.html
+++ b/templates/navbar.html
@@ -44,7 +44,10 @@
             </a>
             <a class="dropdown-item {% view_active request 'accounts:profile' %}" href="{% url 'accounts:profile' %}">{% bs_icon 'person-vcard' %} {% trans "Profile" %}</a>
             <div class="dropdown-divider"></div>
-            <a class="dropdown-item" href="{% url 'accounts:logout' %}">{% bs_icon 'power' %}  {% trans "Log Out" %}</a>
+            <form method="post" action="{% url 'accounts:logout' %}">
+              {% csrf_token %}
+              <button type="submit" class="dropdown-item">{% bs_icon 'power' %}  {% trans "Log Out" %}</button>
+            </form>
           </div>
         </li>
       </ul>
diff --git a/webvirtcloud/settings.py.template b/webvirtcloud/settings.py.template
index d77cf51c..9a35b25a 100644
--- a/webvirtcloud/settings.py.template
+++ b/webvirtcloud/settings.py.template
@@ -141,7 +141,6 @@ TIME_ZONE = "UTC"
 
 USE_I18N = True
 
-USE_L10N = True
 
 USE_TZ = True