diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e0f73c02..d7d276837 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog
 
+## [1.44.1] — 2026-10-22
+
+### Security
+
+- **Next.js 16.4.2.** The framework fixed two critical advisories that
+  allow unauthenticated remote code execution, one in `use cache` functions
+  that return typed arrays (GHSA-673q-mjm6-r5xr) and one in the image
+  optimizer when it handles SVG (GHSA-2464-fhr4-w9xw), and a high-severity
+  denial of service through Server Actions (GHSA-p3m5-59mp-jv5r). HealthLog
+  uses neither `use cache` nor the image component, and it defines no Server
+  Actions and refuses requests that call one. Every instance runs the same
+  framework, though, so it updates anyway.
+- **The image optimizer is off.** Nothing in HealthLog renders through it,
+  so `/_next/image` now answers 404 instead of processing whatever image a
+  request names. Icons and logos load as before.
+- **nodemailer 10.1.7** fixes several advisories in how email addresses are
+  parsed (GHSA-8c8m-p3m8-cjg8 among them).
+
+### Fixed
+
+- **`[` and `]` move the open day on every press.** Pressed quickly in a
+  row, one press could be lost, because a step started from the day still
+  on screen rather than the one the previous press had already opened.
+
+### Upgrade notes
+
+- None. Pull the new image and restart.
+
 ## [1.44.0] — 2026-10-22
 
 ### Added
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 6cc0471ec..da8fbac66 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.44.0
+  version: 1.44.1
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index 6e5cbd564..5f044d763 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.44.0",
+  "version": "1.44.1",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 58b5aebf1..9d6ebe388 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.44.0";
+  /* @sw-version-fallback */ "v1.44.1";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`