diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb1c7ded1..3a125b3c5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,18 +1,28 @@
-## [Unreleased]
+## [5.6.1] - 2026-07-26
 ### Security
-- SSRF: `URLValidator` now blocks wildcard/any-local (0.0.0.0, ::) addresses in addition to link-local and private ranges, and checks every address the host resolves to (narrowing the DNS-rebinding window). Loopback stays reachable for same-origin document/WebID dereferencing; the backend triplestore is site-local (already blocked). `ALLOW_INTERNAL_URLS` remains the development escape hatch (LNK-003/LNK-009)
-- XXE: added `SecureXML` hardened parser factories — `XSLTMasterUpdater` parses with DTDs and external entities disabled, and the external responses parsed by `ldh:send-request` use secure processing (entity-expansion capped) with external entities disabled (LNK-005 residual)
+- SSRF: `URLValidator` blocks wildcard/any-local (`0.0.0.0`, `::`) addresses and checks every resolved address; loopback stays reachable, `ALLOW_INTERNAL_URLS` remains the escape hatch (LNK-003/LNK-009)
+- XXE: `SecureXML` hardened parser factories disable DTDs/external entities in `XSLTMasterUpdater` and `ldh:send-request` responses (LNK-005 residual)
 - Upgraded `java-jwt` 3.19.4 → 4.5.2 on the OAuth2/OIDC verification path
-- Documented the pinned-truststore invariant behind the disabled hostname verification on internal HTTP clients
+- Documented the pinned-truststore invariant behind disabled hostname verification on internal HTTP clients
 
 ### Added
-- Unit tests for `AuthorizationFilter`: the HTTP-method → ACL access-mode contract (`GET`/`HEAD`→Read, `POST`→Append, `PUT`/`DELETE`/`PATCH`→Write), mode lookup, and the owner Read/Write/Append grant
-- Loopback/wildcard `URLValidator` tests; JWKS-based `JWTVerifier` tests (valid, wrong issuer, wrong audience, expired, missing `kid`, bad signature)
-- `AGENTS.md`: an agent-facing guide to driving a running instance's HTTP API — data model, WebID auth, read/write discipline (writes via `POST`/`PUT`/`PATCH` on document URLs; read-only SPARQL), content model, dataspaces, tooling
-- Dependabot config (`.github/dependabot.yml`) for Maven, the Docker base image, and GitHub Actions updates; routine Maven minor/patch bumps grouped into one PR
+- Unit tests for `AuthorizationFilter`'s HTTP-method → ACL access-mode contract, mode lookup, and owner grant
+- Loopback/wildcard `URLValidator` tests; JWKS-based `JWTVerifier` tests
+- `AGENTS.md`: agent-facing guide to driving a running instance's HTTP API
+- Dependabot config (`.github/dependabot.yml`) for Maven, the Docker base image, and GitHub Actions
 
 ### Changed
-- Cache TTLs configurable: the WebID model cache and the JWKS cache now read their expiration (seconds) from `WEBID_CACHE_EXPIRATION` / `JWKS_CACHE_EXPIRATION` (default 86400 = 1 day), via `CATALINA_OPTS` system properties like the `CLIENT_*` timeouts. Lowering `WEBID_CACHE_EXPIRATION` bounds how long a revoked WebID stays authenticated
+- Cache TTLs configurable via `WEBID_CACHE_EXPIRATION` / `JWKS_CACHE_EXPIRATION` (default 86400s), bounding how long a revoked WebID stays authenticated
+- CSR label rendering consolidated on Web-Client per-vocab templates; retired `$ldt:lang` for `$ac:langs` from `navigator.languages`; added client-side `ac:uuid()` (#323)
+- Web-Client dependency bumped to 5.0.3
+
+### Fixed
+- View queries with a `FROM`/`FROM NAMED` clause returned `400`; `ldh:wrap-describe` now hoists the clause to the outer `DESCRIBE`
+- Duplicate bilingual widget headings when the browser language matched neither value (#323)
+- Language badge leaking into view headings (e.g. `enCurrent members`)
+- `acl:mode()` went stale on fetch-less tab-pane switches; flags now re-synced from the activated pane
+- Modal live-search debounce logged an unsupported-scheme fetch from `document="ixsl:page()"`
+- Left-sidebar flyout clipped on short viewports; now scrolls
 
 ## [5.6.0] - 2026-07-08
 ### Added
diff --git a/pom.xml b/pom.xml
index 50635e15f..50c92c80f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
 
     <groupId>com.atomgraph</groupId>
     <artifactId>linkeddatahub</artifactId>
-    <version>5.6.1</version>
+    <version>5.6.2-SNAPSHOT</version>
     <packaging>${packaging.type}</packaging>
 
     <name>AtomGraph LinkedDataHub</name>
@@ -46,7 +46,7 @@
         <url>https://github.com/AtomGraph/LinkedDataHub</url>
         <connection>scm:git:git://github.com/AtomGraph/LinkedDataHub.git</connection>
         <developerConnection>scm:git:git@github.com:AtomGraph/LinkedDataHub.git</developerConnection>
-        <tag>linkeddatahub-5.6.1</tag>
+        <tag>linkeddatahub-5.5.4</tag>
     </scm>
 
     <repositories>
@@ -339,7 +339,7 @@
                 <executions>
                     <execution>
                         <id>inline-xml-entities</id>
-                        <phase>package</phase>
+                        <phase>pre-integration-test</phase>
                         <goals>
                             <goal>iterator</goal>
                         </goals>
@@ -377,14 +377,14 @@
                         <goals>
                             <goal>install-node-and-npm</goal>
                         </goals>
-                        <phase>package</phase>
+                        <phase>pre-integration-test</phase>
                     </execution>
                     <execution>
                         <id>generate-sef</id>
                         <goals>
                             <goal>npx</goal>
                         </goals>
-                        <phase>package</phase>
+                        <phase>pre-integration-test</phase>
                         <configuration>
                             <arguments>xslt3-he -t -xsl:${project.build.directory}/${build.warName}${saxon-js.stylesheet} -export:${project.build.directory}/${build.warName}${saxon-js.stylesheet}.sef.json -nogo -ns:##html5 -relocate:on</arguments>
                         </configuration>