diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 717a4bef..4e4a9490 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,7 +30,7 @@ before_script:
   # Add upstream Conduit binary cache
   - if command -v nix > /dev/null; then echo "extra-substituters = https://nix.computer.surgery/conduit" >> /etc/nix/nix.conf; fi
   - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = conduit:ZGAf6P6LhNvnoJJ3Me3PRg7tlLSrPxcQ2RiE5LIppjo=" >> /etc/nix/nix.conf; fi
-  
+
   # Add alternate binary cache
   - if command -v nix > /dev/null && [ -n "$ATTIC_ENDPOINT" ]; then echo "extra-substituters = $ATTIC_ENDPOINT" >> /etc/nix/nix.conf; fi
   - if command -v nix > /dev/null && [ -n "$ATTIC_PUBLIC_KEY" ]; then echo "extra-trusted-public-keys = $ATTIC_PUBLIC_KEY" >> /etc/nix/nix.conf; fi
@@ -129,9 +129,9 @@ artifacts:
 
 .push-oci-image:
   stage: publish
-  image: docker:26.0.0
+  image: docker:26.0.1
   services:
-    - docker:26.0.0-dind
+    - docker:26.0.1-dind
   variables:
     IMAGE_SUFFIX_AMD64: amd64
     IMAGE_SUFFIX_ARM64V8: arm64v8
diff --git a/Cargo.lock b/Cargo.lock
index c68b46e6..d9fe9254 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -459,7 +459,7 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "conduit"
-version = "0.7.0+conduwuit-0.1.15"
+version = "0.7.0+conduwuit-0.1.16"
 dependencies = [
  "argon2",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index 3df32004..82080824 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ authors = [
 homepage = "https://puppygock.gay/conduwuit"
 repository = "https://github.com/girlbossceo/conduwuit"
 readme = "README.md"
-version = "0.7.0+conduwuit-0.1.15"
+version = "0.7.0+conduwuit-0.1.16"
 edition = "2021"
 
 # See also `rust-toolchain.toml`
@@ -217,7 +217,7 @@ default-features = false
 
 # to support multiple variations of setting a config option
 [dependencies.either]
-version = "1.10.0"
+version = "1.11.0"
 features = ["serde"]
 
 # to listen on both HTTP and HTTPS if listening on TLS dierctly from conduwuit for complement or sytest
diff --git a/src/api/client_server/room.rs b/src/api/client_server/room.rs
index cd75c3d4..d2a62576 100644
--- a/src/api/client_server/room.rs
+++ b/src/api/client_server/room.rs
@@ -360,13 +360,23 @@ pub async fn create_room_route(body: Ruma<create_room::v3::Request>) -> Result<c
 
 	let mut power_levels_content = serde_json::to_value(RoomPowerLevelsEventContent {
 		users,
-		state_default: int!(100),
 		..Default::default()
 	})
 	.expect("event is valid, we just created it");
 
+	// secure proper defaults of sensitive/dangerous permissions that moderators
+	// (power level 50) should not have easy access to
+	power_levels_content["events"]["m.room.power_levels"] = serde_json::to_value(100).expect("100 is valid Value");
+	power_levels_content["events"]["m.room.server_acl"] = serde_json::to_value(100).expect("100 is valid Value");
+	power_levels_content["events"]["m.room.tombstone"] = serde_json::to_value(100).expect("100 is valid Value");
+	power_levels_content["events"]["m.room.encryption"] = serde_json::to_value(100).expect("100 is valid Value");
+	power_levels_content["events"]["m.room.history_visibility"] =
+		serde_json::to_value(100).expect("100 is valid Value");
+
+	// synapse does this too. clients do not expose these permissions. it prevents
+	// default users from calling public rooms, for obvious reasons.
 	if body.visibility == room::Visibility::Public {
-		power_levels_content["m.call.invite"] = serde_json::to_value(50).expect("50 is valid Value");
+		power_levels_content["events"]["m.call.invite"] = serde_json::to_value(50).expect("50 is valid Value");
 		power_levels_content["events"]["org.matrix.msc3401.call"] =
 			serde_json::to_value(50).expect("50 is valid Value");
 		power_levels_content["events"]["org.matrix.msc3401.call.member"] =