diff --git a/CHANGELOG.md b/CHANGELOG.md
index e4f9659..f3886c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,31 @@ for what changed inside the apps it composes.
 
 ## [Unreleased]
 
+## [1.22.0] - 2026-07-31
+
+### Submodules bumped
+- jump-host `v1.11.0` -> [`v1.12.0`](https://github.com/theta42/jump-host/releases/tag/v1.12.0)
+- proxy `v1.9.0` -> [`v1.10.0`](https://github.com/theta42/proxy/releases/tag/v1.10.0)
+- sso-manager-node `v1.11.0` -> [`v1.12.0`](https://github.com/theta42/sso-manager-node/releases/tag/v1.12.0)
+
+#### jump-host — [v1.12.0](https://github.com/theta42/jump-host/releases/tag/v1.12.0)
+
+##### Added
+- **TUI host picker with colors**: ANSI-colored terminal UI with box-drawing header, cyan/magenta/green title treatment, per-row coloring (cyan hostnames, blue IPs), environment badges (red PROD / dim DEV), green inverse selection highlight with "◄ SELECTED ►" indicator, yellow filter text, and a footer separator with quick-select hint.
+
+#### sso-manager-node — [v1.12.0](https://github.com/theta42/sso-manager-node/releases/tag/v1.12.0)
+
+##### Changed
+- **Catalog page (`/`) redesigned**: Removed the portal banner; "My Access" section now has tabs separating Services and Hosts; icons support both Font Awesome classes and image URLs (http/https).
+- **Profile page redesigned as a single card with tabs**: Password reset is now a modal button; "My groups", "My Services", "Security & Usage Stats", and "Members of X's group" are now tabs on the main profile card instead of separate cards; metrics display fixed to properly load and show service usage data.
+
+#### proxy — [v1.10.0](https://github.com/theta42/proxy/releases/tag/v1.10.0)
+
+##### Changed
+- **Permissions page**: Converted from card grid to table/list layout with columns: Subject, Scope, Domain, Role, Actions.
+- **Users page**: Converted from card grid to table/list layout; form validation now shows both a summary message AND per-field error messages with visual highlighting.
+- **Groups page**: Added automatic refresh after adding/deleting groups to ensure new entries appear immediately.
+
 ## [1.21.0] - 2026-07-31
 
 ### Submodules bumped
diff --git a/README.md b/README.md
index a109f51..c239900 100644
--- a/README.md
+++ b/README.md
@@ -26,14 +26,18 @@ The SSO Manager and the proxy it fronts, both stood up by one `./setup.sh` run:
 | --- | --- |
 | [![SSO Manager dashboard](docs/images/sso-dashboard.png)](docs/images/sso-dashboard.png) | [![Proxy host list](docs/images/proxy-hosts.png)](docs/images/proxy-hosts.png) |
 
-**Why use this instead of running the two separately?** The two only become
-useful once the proxy is registered as an OIDC client of the SSO and pointed at
-the SSO's LDAP directory — and the SSO's domain has to match across half a dozen
-config fields or logins silently fail with `Invalid Credentials`. Doing that by
-hand is fiddly and easy to get wrong. `setup.sh` asks for your domain once (in
-`setup.env`), generates both config files with it filled in everywhere, registers
-the proxy as an OIDC client, and snapshots state before every rebuild — so you
-get a working SSO + proxy stack in one command and a safe way to upgrade it.
+## Configuration
+
+`setup.sh` automates the first-run glue between subprojects:
+- Asks for your domain once (in `setup.env`) and fills it in across all config files.
+- Registers the proxy as an OIDC client of the SSO.
+- Persists submodule commit hashes in `.env` for reproducibility (e.g., `SSO_GIT_COMMIT`, `PROXY_GIT_COMMIT`). This ensures future `docker compose` runs use the same submodule versions.
+
+**Why use this instead of running the two separately?** The two only become useful once the proxy is registered as an OIDC client of the SSO and pointed at the SSO's LDAP directory — and the SSO's domain has to match across half a dozen config fields or logins silently fail with `Invalid Credentials`. Doing that by hand is fiddly and easy to get wrong. `setup.sh` handles this automatically and snapshots state before every rebuild — so you get a working SSO + proxy stack in one command and a safe way to upgrade it.
+
+## Unified Release Status
+- ✅ **Phase 1 (oidc-client)**: Complete.
+- ⏳ **Phases 2-5**: Pending (see [roadmap](#)).
 
 ```
             ┌──────────────────────────────────────────────┐
diff --git a/jump-host b/jump-host
index 82318da..912b0e6 160000
--- a/jump-host
+++ b/jump-host
@@ -1 +1 @@
-Subproject commit 82318da484f4216910140d1aa3bce86abfbda498
+Subproject commit 912b0e69b581905d9839f234c6ec2303039b55e4
diff --git a/proxy b/proxy
index 8c0eaf0..0e98cab 160000
--- a/proxy
+++ b/proxy
@@ -1 +1 @@
-Subproject commit 8c0eaf0d07229df82141b1e97d4d5143a7a4d3a6
+Subproject commit 0e98cab3d3372a5fe054e05f2a5c6f5128db78ef
diff --git a/sso-manager-node b/sso-manager-node
index e74c5cf..887b775 160000
--- a/sso-manager-node
+++ b/sso-manager-node
@@ -1 +1 @@
-Subproject commit e74c5cf11d2c083883870ee44193154a76ed8b74
+Subproject commit 887b775b4216a2cf7606c2536e1a157f31f9cbc5