diff --git a/CHANGELOG.md b/CHANGELOG.md
index c21b382..8794d7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,11 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
+## [v1.35.9] - 2026-08-03
+
+### Fixed
+- **sso & proxy version strings now match their release tags** — The v1.20.2 / v1.32.0 release tags were created but their `nodejs/package.json` version fields were left behind (1.20.1 / 1.14.3), so the deployed apps' update-check banner falsely reported a newer version. Bumped submodules to the corrected commits so `buildVersion` matches the deployed tag.
+
 ## [v1.35.2] - 2026-08-03
 
 ### Fixed
diff --git a/proxy b/proxy
index eb08b6b..8107755 160000
--- a/proxy
+++ b/proxy
@@ -1 +1 @@
-Subproject commit eb08b6b5b94f152f8d14a4b130a99b9d5ed8c652
+Subproject commit 81077553076f9ac6397c27afbde719e39cfecb2f
diff --git a/sso-manager-node b/sso-manager-node
index d802c39..2612b0e 160000
--- a/sso-manager-node
+++ b/sso-manager-node
@@ -1 +1 @@
-Subproject commit d802c399a3589bf1972431d69f90dd93eaf21631
+Subproject commit 2612b0e3ab5356e88a1c35a915b990c6e7f33328