diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40d8c00c9..c4f45e725 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [1.28.13] — 2026-07-10 — Sharing a document shares only the document
+
+Fixes a scope bug: a link created from a document carried the full health record
+(vital signs, labs, medications) because an empty report scope was read as "all
+sections". A document share is now document-only — it serves the attached
+document and no health data — while sharing from Settings keeps the full record
+form. NOTE: revoke and re-create any document link made before this release; an
+earlier link cannot be narrowed retroactively.
+
 ## [1.28.12] — 2026-07-09 — Lab scans use your AI provider; tidier dashboard
 
 Scanning a lab report now uses the AI provider you already configured — including
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 9c922c3e0..07a59a596 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.28.12
+  version: 1.28.13
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index f943bfeef..2d3cde4f6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.28.12",
+  "version": "1.28.13",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 37dda533d..1ada9a62c 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.28.12";
+  /* @sw-version-fallback */ "v1.28.13";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`