diff --git a/docs/room-pass.md b/docs/room-pass.md
index ffec32b..94a1898 100644
--- a/docs/room-pass.md
+++ b/docs/room-pass.md
@@ -6,8 +6,8 @@ name, and arrive signed in. Voter asked for this in the
 [implementer feedback](implementer-feedback.md) (entry 2), as the release evidence its
 audience-release plan requires before switching to krm-foyer.
 
-**Status: run end to end (2026-10-06)** against Room Pass 2.0.0's released image
-(`ghcr.io/sunib/room-pass:2.0.0`, revision `2185782`, pinned by digest) and its CRDs,
+**Status: run end to end (2026-10-06)** against Room Pass 2.1.0's released image
+(`ghcr.io/sunib/room-pass:2.1.0`, revision `df2070d`, pinned by digest) and its CRDs,
 behind its own Dex, in the e2e fixture, by a real Chromium
 ([room_pass_test.go](../test/e2e/room_pass_test.go), fixture in
 [room-pass.sh](../test/e2e/cluster/room-pass.sh)). [What runs](#what-the-e2e-suite-runs)
diff --git a/test/e2e/cluster/room-pass.sh b/test/e2e/cluster/room-pass.sh
index 02b01b4..1953689 100755
--- a/test/e2e/cluster/room-pass.sh
+++ b/test/e2e/cluster/room-pass.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Room Pass's QR login in the e2e fixture (docs/room-pass.md): Room Pass 2.0.0 and the
+# Room Pass's QR login in the e2e fixture (docs/room-pass.md): Room Pass 2.1.0 and the
 # Dex behind it (room-pass/room-pass.yaml), its CRDs and a Room, a test application with
 # the QR entry point (room-pass/room-app.yaml), the two hosts' routes in Traefik
 # (room-pass/routes.yaml), and a third krm-foyer on the application's host
@@ -11,9 +11,9 @@
 # Writes E2E_DIR/room-env: where the suite finds it.
 set -euo pipefail
 
-# Room Pass 2.0.0 (2185782f6f349731909eafdb290007bc3feb168c), the release
+# Room Pass 2.1.0 (df2070d0ed55ba110e9716efd76479b2db4a922b), the release
 # room-pass/crds.yaml is from.
-ROOM_PASS_IMAGE="ghcr.io/sunib/room-pass:2.0.0@sha256:eb5fee5161e52eb6de3983c811ddc883838cbee1dfea33fb013374696e189416"
+ROOM_PASS_IMAGE="ghcr.io/sunib/room-pass:2.1.0@sha256:346b4422278dc7b2f6f2f20d52bee59874916e3021fb477321c0aacca19e58de"
 # The same Dex and nginx as start-cluster.sh.
 DEX_IMAGE="ghcr.io/dexidp/dex:v2.45.1@sha256:8499afd690c437f52301efd2b05b2455da5bd2dfc20332cd697dc9937f808462"
 NGINX_IMAGE="nginx:1.31.6-alpine@sha256:df221db836e1754089190208cee7eeda94f233197056426eda74a43ab1abeac2"
diff --git a/test/e2e/cluster/room-pass/crds.yaml b/test/e2e/cluster/room-pass/crds.yaml
index 2c4eaf6..2f068ab 100644
--- a/test/e2e/cluster/room-pass/crds.yaml
+++ b/test/e2e/cluster/room-pass/crds.yaml
@@ -1,6 +1,6 @@
-# Room Pass's CRDs, as released in v2.0.0 (2185782f6f349731909eafdb290007bc3feb168c,
-# config/crd/), the release whose image room-pass.yaml pins. Copied unchanged; replace
-# both together.
+# Room Pass's CRDs, as released in v2.1.0 (df2070d0ed55ba110e9716efd76479b2db4a922b,
+# config/crd/bases/), the release whose image room-pass.yaml pins. Copied unchanged;
+# replace both together.
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -67,6 +67,59 @@ spec:
                 x-kubernetes-validations:
                 - message: allowedReturnURLs is immutable
                   rule: self == oldSelf
+              appearance:
+                description: |-
+                  Appearance dresses the join page for this event. Empty, the page looks
+                  as it always has.
+
+                  Pictures are paths on the join host, because the join page admits images
+                  from its own origin only. Serve them there without a login: participants
+                  have not signed in yet.
+
+                  Like any spec change, editing it starts a fresh join-code epoch, which
+                  invalidates the code on screen. Set it before the event.
+                properties:
+                  accentColor:
+                    description: |-
+                      AccentColor fills the buttons and outlines focused fields, as #rrggbb.
+                      The button text is white or near-black, whichever contrasts more.
+                    pattern: ^#[0-9a-fA-F]{6}$
+                    type: string
+                  backgroundColor:
+                    description: |-
+                      BackgroundColor is the page behind the form, as #rrggbb. Setting it, or
+                      BackgroundImage, puts the form on a white card so it stays readable.
+                    pattern: ^#[0-9a-fA-F]{6}$
+                    type: string
+                  backgroundImage:
+                    description: |-
+                      BackgroundImage covers the page behind the form, as a path on the join
+                      host. BackgroundColor shows until it arrives. The whole room loads it at
+                      once over the venue's network, so keep it small.
+                    maxLength: 512
+                    pattern: ^/[A-Za-z0-9._~%!$&+,;=:@?-][A-Za-z0-9._~%!$&+,;=:@/?-]*$
+                    type: string
+                  picture:
+                    description: |-
+                      Picture is shown above the title, as a path on the join host such as
+                      /talks/my-talk/logo.png.
+                    maxLength: 512
+                    pattern: ^/[A-Za-z0-9._~%!$&+,;=:@?-][A-Za-z0-9._~%!$&+,;=:@/?-]*$
+                    type: string
+                  pictureAlt:
+                    description: |-
+                      PictureAlt is what a screen reader says for the picture. Empty marks it
+                      decorative.
+                    maxLength: 120
+                    pattern: ^[^<>\x00-\x1f\x7f]*$
+                    type: string
+                  tagline:
+                    description: 'Tagline is one line under the title: the event,
+                      the room, the time.'
+                    maxLength: 120
+                    pattern: ^[^<>\x00-\x1f\x7f]*$
+                    type: string
+                type: object
               attributionNote:
                 description: |-
                   AttributionNote is the operator's one sentence about what the issued
@@ -285,7 +338,6 @@ spec:
     subresources:
       status: {}
 ---
----
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
diff --git a/test/e2e/cluster/room-pass/room-pass.yaml b/test/e2e/cluster/room-pass/room-pass.yaml
index 952cbbb..6ddca65 100644
--- a/test/e2e/cluster/room-pass/room-pass.yaml
+++ b/test/e2e/cluster/room-pass/room-pass.yaml
@@ -1,4 +1,4 @@
-# Room Pass 2.0.0 and the Dex behind it, as Room Pass's own reference deployment
+# Room Pass 2.1.0 and the Dex behind it, as Room Pass's own reference deployment
 # (deploy/base, deploy/dex) has them, with the fixture's names. room-pass.sh fills in
 # the images, the hosts and the configuration hash, and creates the ConfigMap `dex` and
 # the Secret `room-pass-cookie`.
@@ -134,7 +134,9 @@ spec:
       targetPort: http
 ---
 # Dex as Room Pass's issuer, from deploy/dex: one replica on SQLite, so its signing keys
-# outlive a restart of the pod.
+# outlive a restart of the pod. Room Pass 2.1.0's deploy/dex keeps that state in
+# Kubernetes instead (dex.coreos.com resources, CRDs in deploy/dex-crds); the fixture
+# keeps the volume, which needs no CRDs vendored to match the Dex image.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
diff --git a/test/e2e/room_pass_test.go b/test/e2e/room_pass_test.go
index 0eb10c8..e106252 100644
--- a/test/e2e/room_pass_test.go
+++ b/test/e2e/room_pass_test.go
@@ -28,7 +28,7 @@ import (
 )
 
 // Room Pass's QR login through krm-foyer (docs/room-pass.md), in a real browser, against
-// Room Pass 2.0.0 and the Dex behind it (test/e2e/cluster/room-pass.sh): a participant
+// Room Pass 2.1.0 and the Dex behind it (test/e2e/cluster/room-pass.sh): a participant
 // scans the code on the presenter's screen, types a display name, and is signed in to
 // the application through krm-foyer, with Kubernetes naming them as Room Pass's rules
 // say. Three programs share the application's host, room.localhost: krm-foyer-room,