diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2ebd4d..5e3cfea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,18 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.8.5 — 2026-08-23
+
+Patch release with two fixes in the container's skill wiring — one behavioural,
+one a latent crash found while reviewing the first — plus the `mempalace-toolkit`
+change that makes palace writes carry provenance. **No component pin moved.**
+Every ref was re-resolved at tag time and is byte-identical to what v1.8.4
+shipped: `pi` `0.84.2` (still npm latest), `pi-atelier` `v0.8.2` → `159f34cf`
+(newest tag; the `≥0.7.1` floor for `pi ≥ 0.84` holds), `pi-studio` `v0.9.48` →
+`c3b83680`, `pi-fork` `f1ff8087`, `pi-observational-memory` `ce9fc982`,
+`pi-toolkit` `0e1369e6`, `pi-extensions` `20228878`, `MEMPALACE_VERSION` `3.7.1`
+(still PyPI latest, and the version the central palace serves — no client/server
+skew). The single moving part is `mempalace-toolkit` `fd8b15f5` → `0fe64c4`.
 
 ### Fixed
 
@@ -113,7 +124,10 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   (`AGENT="${MEMPALACE_PI_DEVICE:+pi@${MEMPALACE_PI_DEVICE}}"`), so un-enrolled
   hosts are unaffected. Nothing landed upstream after the
   `pi-observational-memory` merge `ce9fc982`, so the eight-week-bug fix in
-  v1.8.4 is not destabilised.
+  v1.8.4 is not destabilised. All of the above was re-resolved immediately
+  before the tag and was unchanged — worth repeating for any future release,
+  because six of nine components are moving refs that CI resolves at build
+  time, so the build, not the Dockerfile, decides what ships.
 
   Two notes for whoever runs the build. This release changes
   `entrypoint-user.sh`, `rootfs/**` and the resolved toolkit SHA — all three feed