diff --git a/CHANGES b/CHANGES
index 652e4e866..58d08db10 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2069,4 +2069,5 @@
 * Update MongoDB to 4.2.8
 * Remove IP nginx configuration that redirects to dashboard after activation
 * dashboard: looks for search string in app title as well
+* Add vaapi caps for transcoding
 
diff --git a/package-lock.json b/package-lock.json
index e8d0d3cd2..db7e3fc9c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -741,9 +741,9 @@
       }
     },
     "cloudron-manifestformat": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/cloudron-manifestformat/-/cloudron-manifestformat-5.5.0.tgz",
-      "integrity": "sha512-Xf1vOwCFT5h1MZQ9fC8EyfL2jfpVlShg5r7est/ZA+vSzcbvk2nQxPmpk4q4e6iDfr19B7iUw2b2X7mw5c1Dlg==",
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/cloudron-manifestformat/-/cloudron-manifestformat-5.6.0.tgz",
+      "integrity": "sha512-BqM2vw/OWUHmPmrQo3xwAME0ncX3JPmPtxrhOYy0ZRpNcRDLrwXz02WVM9hAvIoawJNJjVb+x22RQoa1y5DdMw==",
       "requires": {
         "cron": "^1.8.2",
         "java-packagename-regex": "^1.0.0",
diff --git a/package.json b/package.json
index 822616cb4..ac47c06bc 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
     "async": "^2.6.3",
     "aws-sdk": "^2.685.0",
     "body-parser": "^1.19.0",
-    "cloudron-manifestformat": "^5.5.0",
+    "cloudron-manifestformat": "^5.6.0",
     "connect": "^3.7.0",
     "connect-lastmile": "^2.0.0",
     "connect-timeout": "^1.9.0",
diff --git a/src/docker.js b/src/docker.js
index 49410ad04..4b778a61c 100644
--- a/src/docker.js
+++ b/src/docker.js
@@ -325,6 +325,12 @@ function createSubcontainer(app, name, cmd, options, callback) {
         if (capabilities.includes('mlock')) containerOptions.HostConfig.CapAdd.push('IPC_LOCK'); // mlock prevents swapping
         if (!capabilities.includes('ping')) containerOptions.HostConfig.CapDrop.push('NET_RAW'); // NET_RAW is included by default by Docker
 
+        if (capabilities.includes('vaapi')) {
+            containerOptions.HostConfig.Devices = [
+                { PathOnHost: '/dev/dri', PathInContainer: '/dev/dri', CgroupPermissions: 'rwm' }
+            ];
+        }
+
         containerOptions = _.extend(containerOptions, options);
 
         gConnection.createContainer(containerOptions, function (error, container) {