diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index a1e7f0c3542..c7122e36314 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,8 +1,21 @@
 # Compatibility Contract
 
-## Server v1.6.532 candidate
-
-This candidate packages immutable Web Console `1.6.187` with unchanged Engine
+## Server v1.6.533 candidate
+
+This candidate packages immutable Web Console `1.6.188`, source
+`8e12216fd6f8d843ed043b4c0afcec995d33caeb`, archive SHA-256
+`3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92`.
+Native non-bubbling pointer events are owned by the tooltip element lifecycle,
+with run-loop entry and listener cleanup. Existing action-menu overrides and
+static context forwarding are preserved. Four new actual-DOM focused cases
+passed. Engine `v0.183.348`, APIs, registration, authentication, permissions,
+networking and all other component inputs are unchanged. Server publication,
+deployment and 52 actual-browser views plus ordinary HTTP copy remain pending.
+See [the release note](docs/releases/server-1.6.533.md).
+
+## Server v1.6.532 published; browser acceptance incomplete
+
+This release packages immutable Web Console `1.6.187` with unchanged Engine
 `v0.183.348`. Shared clipboard messages initialize before rendering and report
 success/failure in all 13 supported locales. Copy hints fit the viewport; Custom
 host commands remain LTR in RTL interfaces. Commands, registration APIs, native
@@ -12,9 +25,15 @@ Thirteen focused rendered cases and one corrected-caption case passed; 32 keys
 across 13 locales passed the targeted resource contract. The Web archive has
 SHA-256 `b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3`
 from signed normally merged source `b45f8ee73c72b5f58b010dd55c64d5aef7406c61`.
-Its official immutable release and anonymous readback are complete. Server
-publication and the real-browser locale/theme/viewport matrix are still separate
-gates, not inferred from source tests. See [the release note](docs/releases/server-1.6.532.md).
+Its official immutable release and anonymous readback are complete. Server532
+source is `77f1120f2b8796344ef1c2f8c4a6de8d54eb21fd`; exact artifact:
+`ghcr.io/pasturestack/server:v1.6.532@sha256:28dc6b10cfa37843f3c737a4d3bc15bb4c180791fcb710f034d19150458456ce`.
+The distinct OCI config is `sha256:cfeec9c242c0aa3952cbb01162a80bd374f742c27d9fee1a783c3f9841c2a8b4`.
+Official publication, startup/restart HTTP200/pong and preservation checks passed.
+Real-browser acceptance found missing native hover event dispatch after the
+Ember upgrade, so532 is not a completed52-view acceptance.188/533 addresses it;
+the matrix is not inferred from source tests.
+See [the release note](docs/releases/server-1.6.532.md).
 
 ## Server v1.6.531 published
 
diff --git a/README.md b/README.md
index 7960442cb91..4e9fb5a1ac6 100644
--- a/README.md
+++ b/README.md
@@ -13,8 +13,10 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.531`](https://github.com/PastureStack/server/releases/tag/v1.6.531)
-packages Web Console `1.6.186` and Orchestration Engine `v0.183.348`.
+Server [`v1.6.532`](https://github.com/PastureStack/server/releases/tag/v1.6.532)
+packages Web Console `1.6.187` and Orchestration Engine `v0.183.348`.
+The console includes scoped clipboard message and feedback changes across all
+13 supported locales; actual-browser acceptance remains incomplete.
 The shared Default uses the configured public Native project template, with
 system-stack definitions available before host registration and service
 activation triggered by the first active host. Machine driver cards display
@@ -37,10 +39,14 @@ Registration tokens use dedicated Basic authentication. Native project creation
 preserves the creator's initial membership and default networks. HA database
 exports return a SQL ZIP only after successful, nonempty output; failures clean
 up temporary files without returning command stderr or secrets.
-See the [release note](docs/releases/server-1.6.531.md) for component identities
+See the [release note](docs/releases/server-1.6.532.md) for component identities
 and acceptance limits.
 
-Narrow affected-path acceptance completed; see the release note for its scope.
+Official publication, immutable readback and QA 8080 deployment passed, including
+startup and restart checks with preserved volumes and runtime overrides.
+Actual-browser verification found a native hover event-lifecycle defect
+in Web Console `1.6.187`. A new `1.6.188` candidate takes over those repairs;
+the 52 locale/width/theme browser cases remain incomplete.
 
 The console supports OIDC, TOTP and passkeys, role-aware resource operations,
 container resource/hardware settings, and movable terminal/log windows.
@@ -82,7 +88,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.531
+  ghcr.io/pasturestack/server:v1.6.532
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
@@ -90,7 +96,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin:
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.531
+    image: ghcr.io/pasturestack/server:v1.6.532
     restart: unless-stopped
     ports:
       - "8080:8080"
diff --git a/docs/performance/README.md b/docs/performance/README.md
index 25283686dbe..e72ec264983 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -8,17 +8,20 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published `v1.6.529` image. See the
-[release note](../releases/server-1.6.529.md) for exact identities and acceptance limits.
+The example uses the published `v1.6.532` image, packaging Web Console `1.6.187`
+and Engine `v0.183.348`. See the [release note](../releases/server-1.6.532.md)
+for exact identities and acceptance limits.
 
 This release does not change these settings. Official image publication and
-readback passed. The isolated upgrade preserved runtime overrides and volumes;
-startup and one restart both returned HTTP 200/pong.
+immutable readback passed. The QA 8080 switch preserved runtime overrides and
+volumes; startup and restart checks passed. A native hover event-lifecycle
+defect remains in Web `1.6.187`, and the 52 actual-browser cases are
+incomplete; the new Web `1.6.188` candidate takes over the browser repairs.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.531
+    image: ghcr.io/pasturestack/server:v1.6.532
     restart: unless-stopped
     ports:
       - "8080:8080"
diff --git a/docs/releases/server-1.6.532.md b/docs/releases/server-1.6.532.md
index 7d391424568..ec1fc9066e7 100644
--- a/docs/releases/server-1.6.532.md
+++ b/docs/releases/server-1.6.532.md
@@ -23,20 +23,42 @@ Web producer：`b45f8ee73c72b5f58b010dd55c64d5aef7406c61`。
 `b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3`。
 正常必要檢查、簽章合併、正式不可變發行與匿名成品讀回已完成。
 
+Server producer：`77f1120f2b8796344ef1c2f8c4a6de8d54eb21fd`。
+官方 workflow [38598319956](https://github.com/PastureStack/server/actions/runs/38598319956)
+成功，沒有略過必要檢查；正式發行與不可變讀回完成，24 個成品已核對。
+linux/amd64 映像只有一個 runtime layer。
+
+Registry manifest digest：
+`sha256:28dc6b10cfa37843f3c737a4d3bc15bb4c180791fcb710f034d19150458456ce`。
+Canonical 成品識別（僅供證據，不是 Docker／Compose 安裝命令）：
+`ghcr.io/pasturestack/server:v1.6.532@sha256:28dc6b10cfa37843f3c737a4d3bc15bb4c180791fcb710f034d19150458456ce`。
+不同於 manifest 的 OCI config digest：
+`sha256:cfeec9c242c0aa3952cbb01162a80bd374f742c27d9fee1a783c3f9841c2a8b4`。
+文件後續提交不取代此正式 producer 或成品識別。
+
 13 項相關整合案例通過。修正舊測試的非法翻譯 fixture 後，只重跑受影響的
 1 項案例並通過；沒有重跑其他已通過案例。語系資源檢查涵蓋 32 鍵 × 13 語系，
 沒有缺鍵、空值或 ICU 參數契約錯誤。既有 MFA 的宣告英文 fallback 另列，
 不聲稱所有頁面都已有 13 語系原生翻譯。
 
-Server 正式發行、digest 讀回、部署及瀏覽器 13 語系 × 桌面／窄版 × 亮／暗色
-驗收仍為獨立必要 gate，完成後更新實際結果。既有較廣矩陣及 KVM 待驗不升格。
+正式映像已切換部署至 QA 8080；部署讀回的 manifest、
+config 與 producer 均符合上述正式成品。首次就緒與重啟檢查通過，既有資料卷
+及 runtime 覆寫設定保留；沒有接觸 production。
+
+實際瀏覽器驗收發現 Web `1.6.187` 仍有原生 hover 事件生命週期缺陷。
+既有 static-tooltip context 代理正確，保持不變。
+因此 13 語系 × 桌面／窄版 × 亮／暗色共 52 組瀏覽器關卡尚未完成，
+不能由上述整合測試、正式發行或部署結果推定通過。新 Web `1.6.188` 候選版已由
+正常合併來源 `8e12216fd6f8d843ed043b4c0afcec995d33caeb` 接手修正；其不可變發行、
+新 Server 配對及部署瀏覽器驗收另行記錄。既有較廣矩陣及 KVM 待驗不升格。
 
 ## 升級與回復
 
-正式成品確認後，僅更新 Compose 的 Server 數字版本 tag，保留現有環境變數、
+安裝／升級使用 Compose 的 Server 數字版本 tag `v1.6.532`，保留現有環境變數、
 named volumes、restart policy、AppArmor、HTTPS origin、OIDC 與效能設定。
 不使用 runtime patch。本版沒有資料庫遷移；回復可沿用同資料卷切回
-上一個正式 `v1.6.531` 映像。實際回復點及首次啟動／重啟結果在部署後記錄。
+上一個正式 `v1.6.531` 映像。驗收環境保留上一版容器與SQL備份；
+首次就緒與重啟結果已通過。
 
 ## 安全範圍
 
diff --git a/docs/releases/server-1.6.533.md b/docs/releases/server-1.6.533.md
new file mode 100644
index 00000000000..97b201254f5
--- /dev/null
+++ b/docs/releases/server-1.6.533.md
@@ -0,0 +1,33 @@
+# Server v1.6.533 candidate
+
+本版封裝正式不可變 Web Console `1.6.188`，Engine 維持 `v0.183.348`。
+實際瀏覽器驗收187時發現：Ember5預設不再委派非冒泡的
+`mouseenter`／`mouseleave`，共用提示仍依賴舊事件，因此懸停沒有出現提示。
+
+## 修正與驗證
+
+共用 trigger 與浮動提示各自於掛載時註冊原生 listener、進入 run loop，
+銷毀時移除相同 handler。維持既有虛擬方法與 action-menu 的開啟歸屬，
+不改全域事件映射；既有靜態 context 代理、13語系翻譯與複製保護不變。
+
+四項新增實際DOM回歸通過：初始／成功／失敗內容、滑鼠離開與進入、
+listener清理及銷毀後事件、action-menu覆寫、原生主機註冊複製。
+原13項與修正caption後1項證據保留，不重跑無關測試。
+
+Web producer `8e12216fd6f8d843ed043b4c0afcec995d33caeb`；正式tar為
+3,025,072 bytes，SHA-256
+`3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92`。
+Web必要檢查、正常簽章合併、不可變發布與匿名讀回已完成。
+
+Server正式發行、成品讀回、8080部署、13語系×桌面／窄版×亮／暗色52組
+以及普通HTTP複製仍各自待完成，不將來源測試當成瀏覽器通過。
+歷史矩陣與KVM待驗維持原狀。
+
+## 邊界與升級
+
+不改註冊API、帳號權限、OIDC、MFA、HAProxy、DB、網路後端或效能設定。
+官方成品確認後只更新Server數字tag，保留既有三卷、環境變數、restart、
+AppArmor及Runtime。無DB遷移，保留532容器／SQL備份作回復點。
+
+保留既有OpenVEX判斷與vendor-pending精確集合；20筆MEDIUM／10CVE仍無官方
+修補版，2026-10-20複查。正式workflow必要安全與來源檢查不可繞過。
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 6c9fd26631b..307e806d47a 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \
     'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.532' \
+    'ARG SERVER_RELEASE_TAG=v1.6.533' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -567,16 +567,16 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.187' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.188' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.187.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=b45f8ee73c72b5f58b010dd55c64d5aef7406c61' \
+    'ARG WEB_CONSOLE_COMMIT=8e12216fd6f8d843ed043b4c0afcec995d33caeb' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-b45f8ee73c72b5f58b010dd55c64d5aef7406c61}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-8e12216fd6f8d843ed043b4c0afcec995d33caeb}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.187}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.187.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.13' \
@@ -1059,10 +1059,10 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.532}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.533}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.532}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
@@ -2146,7 +2146,7 @@ done
 
 jq -e '
   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.532"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533"
   and (.statements | length) == 51
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2172,7 +2172,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.532 >/dev/null
+    "$vendor_pending_fixture" v1.6.533 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2261,4 +2261,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.532 base=v1.6.460 engine=0.183.348 web_console=1.6.187 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index 47bbdd0e6e1..285fef5caf3 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -17,21 +17,21 @@
 PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。'
 STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`'
 COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING'
-WEB_SHA = 'b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3'
-WEB_SOURCE = 'b45f8ee73c72b5f58b010dd55c64d5aef7406c61'
+WEB_SHA = '3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92'
+WEB_SOURCE = '8e12216fd6f8d843ed043b4c0afcec995d33caeb'
 CATALOG_COMMIT = 'b6b658888fce50d3ec217eb4eba0f26ab0113baf'
 ENGINE_SHA = '72581f6eead8633b6bbafbe15512cd44561b9ff25df68d00dd7120ad507aa449'
 ENGINE_SOURCE = 'f19cd64183c0fa93464e9a9f9c2477c9e902b56d'
 OLD_COORDINATES = {
-    'v1.6.532': 'v1.6.521',
-    '1.6.187': '1.6.181',
+    'v1.6.533': 'v1.6.521',
+    '1.6.188': '1.6.181',
     WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
     WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
     CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
 }
-# Engine348 and Web187 use the reviewed component input identities.
+# Engine348 and Web188 use the reviewed component input identities.
 # Published521 component values remain mutation controls.
-# Component coordinates do not establish Server532 artifact/runtime PASS.
+# Component coordinates do not establish Server533 artifact/runtime PASS.
 CATALOG_FIELDS = (
     ('VERSION', 'version', '0.20.13'),
     ('COMMIT', 'commit', '4c39c73a8131ba06e9ff0aaec3b95cc27e049324'),
@@ -47,19 +47,19 @@
 }
 EXPECTED = {
     COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
-    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.532'),
+    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.533'),
     'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
     'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.187'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.187.tar.gz'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.188'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.187}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.187.tar.gz}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.532}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.532}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.533}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533}'),
     'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
     'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
     'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -470,15 +470,15 @@ def verify(files, gate=GATE):
                 pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
                 if len(re.findall(pipeline, source)) != 1:
                     raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
-    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.532"' not in gate:
+    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533"' not in gate:
         raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
-    if '"$vendor_pending_fixture" v1.6.532 >/dev/null' not in gate:
+    if '"$vendor_pending_fixture" v1.6.533 >/dev/null' not in gate:
         raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
-    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.532':
+    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.533':
         raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
-    if json.loads(files[VENDOR]).get('release') != 'v1.6.532':
+    if json.loads(files[VENDOR]).get('release') != 'v1.6.533':
         raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
-    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.532 base=v1.6.460 engine=0.183.348 web_console=1.6.187 catalog_service=0.20.13 ' not in gate:
+    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 ' not in gate:
         raise AssertionError('CURRENT_SUMMARY_MISMATCH')
     verify_incremental_contract(files, gate)
 
@@ -492,11 +492,11 @@ def previous_gate(gate=GATE):
         if stale(marker) != marker:
             replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
     replacements.update({
-        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.532"':
+        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533"':
             'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
-        '"$vendor_pending_fixture" v1.6.532 >/dev/null':
+        '"$vendor_pending_fixture" v1.6.533 >/dev/null':
             '"$vendor_pending_fixture" v1.6.521 >/dev/null',
-        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.532 base=v1.6.460 engine=0.183.348 web_console=1.6.187 catalog_service=0.20.13 ':
+        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 ':
             'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
     })
     for marker, stale_marker in replacements.items():
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 33d6ba0db34..d6c62a2df2e 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -55,9 +55,9 @@ ARG NODE_AGENT_BINARY_SHA256=ce8342e10da07c50cc414b471cadc67db4dd390e6e2dcb632b3
 ARG NODE_AGENT_APPLY_SHA256=dd8cb342518a43e7468cc121db5c4e44b16731f2620b77ea0fd03c02c03766a9
 
 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.187
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.187.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.188
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92
 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
 ARG CATALOG_SERVICE_VERSION=0.20.13
 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324
@@ -568,7 +568,7 @@ FROM ${BASE_IMAGE}
 
 ARG SOURCE_DATE_EPOCH
 ARG PASTURESTACK_SERVER_REVISION
-ARG SERVER_RELEASE_TAG=v1.6.532
+ARG SERVER_RELEASE_TAG=v1.6.533
 ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.348
 ARG ORCHESTRATION_ENGINE_VERSION=0.183.348
 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
@@ -588,9 +588,9 @@ ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2
 ARG LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1
 ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.187
-ARG WEB_CONSOLE_ARTIFACT_SHA256=b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3
-ARG WEB_CONSOLE_COMMIT=b45f8ee73c72b5f58b010dd55c64d5aef7406c61
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.188
+ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92
+ARG WEB_CONSOLE_COMMIT=8e12216fd6f8d843ed043b4c0afcec995d33caeb
 ARG CATALOG_SERVICE_VERSION=0.20.13
 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324
 ARG CATALOG_SERVICE_ARCHIVE_SHA256=29626181cb8489b016e5975ffaddc00b2a32d290b1c0066e833d27fa7a5edf83
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index 58ca1c4690a..be66dbae1f4 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,7 +14,7 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
 fi
 
 revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.532}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533}
 source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
 base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
 orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
@@ -48,10 +48,10 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.18.tar.gz}
 api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-92b718c46163018ea40c008ac552911f0eb610647377725405f4046dcd411f2c}
 api_explorer_commit=${API_EXPLORER_COMMIT:-3b1c39e8a116f58649d94233a384a0362c02b43e}
 web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download}
-web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.187}
-web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.187.tar.gz}
-web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3}
-web_console_commit=${WEB_CONSOLE_COMMIT:-b45f8ee73c72b5f58b010dd55c64d5aef7406c61}
+web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}
+web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz}
+web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92}
+web_console_commit=${WEB_CONSOLE_COMMIT:-8e12216fd6f8d843ed043b4c0afcec995d33caeb}
 catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download}
 catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.13}
 catalog_service_commit=${CATALOG_SERVICE_COMMIT:-4c39c73a8131ba06e9ff0aaec3b95cc27e049324}
@@ -101,7 +101,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-5ce
 usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-e62a21270142181315293d7e11482288ffe8fc4d91cc8fe07dacc90b461f3709}
 supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
 newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.532}
+image=${IMAGE:-pasturestack-validation/server:v1.6.533}
 build_options=()
 
 [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index c2b3a7554f2..9f369538e29 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -14,10 +14,10 @@ for name in "${required[@]}"; do
     case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
     export "$name"
 done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.532}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.533}
 export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.348}
 export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.187}
+export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}
 export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz"
 export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.15}
 export HOST_API_VERSION=${HOST_API_VERSION:-0.38.5}
diff --git a/server/security/openvex.json b/server/security/openvex.json
index f220d2adbe3..0fc2baf51d4 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,9 +1,9 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.532",
+  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.533",
   "author": "PastureStack Security",
   "timestamp": "2026-10-02T22:05:00Z",
-  "version": 52,
+  "version": 53,
   "statements": [
     {
       "vulnerability": {
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index a19129cb1b9..cd3e54b349f 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "release": "v1.6.532",
+  "release": "v1.6.533",
   "generatedAt": "2026-10-14T00:00:00Z",
   "policy": {
     "allowedSeverities": [