diff --git a/CHANGELOG.md b/CHANGELOG.md
index bfbb72455..53cb335cb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,42 @@
 # Changelog
 
+## [1.39.9] — 2026-10-03
+
+Workouts can be logged by hand, the body fat tile opens its own page, and
+every AI call honours the response-timeout setting.
+
+### Added
+
+- **Manual workouts (#1085).** A short form (sport, start, duration, optional
+  distance and energy) from the dashboard "+ Add" menu, the capture picker and
+  the workouts page, saved through `POST /api/workouts/batch` with
+  `source: "MANUAL"` and a per-form `externalId`. New
+  `DELETE /api/workouts/{id}` for manual workouts only (409
+  `workout.delete.synced_source` for synced ones).
+- **Body fat page (#1084).** `/insights/body-fat`; insights layout id
+  `body-fat`. Tile destinations live in one table gated on the module surface
+  map.
+- **Wide lab scan review (#1059).** The review stage uses a 72 rem dialog on
+  large screens, with a container-query row layout.
+
+### Fixed
+
+- **AI response timeout (#1090).** Document reading, summaries, extraction,
+  lab OCR, filing suggestions, medication extraction, the About-me questions,
+  the document chat and the provider test run under the user's setting
+  instead of a fixed 60 s; browser aborts derive from
+  `ai.provider.responseTimeoutMs` on `/api/auth/me`. The lab OCR text mode no
+  longer hits the 15 s client default. The settings placeholder shows the
+  real defaults.
+- **Dashboard "+ Add" menu.** Mood and medication intake follow their
+  modules, like the capture picker.
+
+### Checks
+
+- Tile destination guard, AI call timeout guard, menu and picker parity.
+- node-forge advisory GHSA-86w9-cpqp-85rv ignored until a patched release
+  exists; only the unused APNs certificate path depends on it.
+
 ## [1.39.8] — 2026-10-02
 
 New ECGs from the iPhone get through, a resting heart rate can be logged by
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index b5aeaf86a..f66443ff6 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.39.8
+  version: 1.39.9
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index d6451e91b..8f2a1b5f0 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.39.8",
+  "version": "1.39.9",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 1cee2fcef..12e07572b 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.39.8";
+  /* @sw-version-fallback */ "v1.39.9";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`