diff --git a/CHANGELOG.md b/CHANGELOG.md
index 514a66f..22c6880 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,36 @@ for what changed inside the apps it composes.
 
 ## [Unreleased]
 
+## [1.3.1] - 2026-07-21
+
+### Bumped
+- proxy -> [v1.2.1](https://github.com/theta42/proxy/releases/tag/v1.2.1)
+- sso-manager-node -> [v1.1.18](https://github.com/theta42/sso-manager-node/releases/tag/v1.1.18)
+
+proxy:
+
+### Fixed
+- The bootstrap anti-lockout admin account was always created as `proxyadmin2` regardless of `conf.auth.adminUsers`, while `migrations/permission_bootstrap.js` grants the global-admin permission to `conf.auth.adminUsers[0]`. If an operator customized `adminUsers` away from the default, the bootstrapped account and the permissioned account were two different (non-matching) usernames, so the anti-lockout account ended up with no admin access. `models/user_redis.js` now derives the bootstrap username from `conf.auth.adminUsers[0]` (falling back to `proxyadmin2`), matching `permission_bootstrap.js`.
+- Corrected a `secrets.js.example` comment that claimed the bootstrap admin's password "defaults to the username itself" — it actually generates a random password printed to the container log on first boot.
+
+### Changed
+- Refreshed all README screenshots (hosts, per-host SSO auth, per-host basic auth) against the current UI, and added a new load-balancing screenshot for the multi-target feature.
+
+sso-manager-node:
+
+### Added
+- N-Way Multi-Master LDAP replication: `LDAP_SERVER_ID` + `LDAP_REPLICATION_HOSTS` configure `syncrepl` peers in the bundled OpenLDAP, and a new `/sites` page (nav: **Sites**) shows each configured peer's LDAP URL and live reachability.
+- A `location` property on users, editable from the profile and user-edit forms.
+
+### Fixed
+- `/sites` (added above) 500'd on every load: `views/sites.ejs` included nonexistent partials `header`/`footer` instead of this app's actual `top`/`bottom`. Fixed to match every other view.
+
+### Changed
+- Refreshed all README screenshots (dashboard, users, groups, OAuth apps) against the current UI, and added a new Sites & Replication screenshot.
+
+### theta-env own changes
+- Refreshed `docs/images/sso-dashboard.png` and `docs/images/proxy-hosts.png` to match the submodules' updated screenshots.
+
 ## [1.1.20] - 2026-07-20
 
 ### Bumped
diff --git a/docs/images/proxy-hosts.png b/docs/images/proxy-hosts.png
index 24b9257..19e8cb1 100644
Binary files a/docs/images/proxy-hosts.png and b/docs/images/proxy-hosts.png differ
diff --git a/docs/images/sso-dashboard.png b/docs/images/sso-dashboard.png
index 6886d8f..69f5b6d 100644
Binary files a/docs/images/sso-dashboard.png and b/docs/images/sso-dashboard.png differ
diff --git a/proxy b/proxy
index 93cf034..3f46a80 160000
--- a/proxy
+++ b/proxy
@@ -1 +1 @@
-Subproject commit 93cf034e614dec906917bbeadd4a82143a084bb7
+Subproject commit 3f46a807e54ff34167076bf268913415cd51d221
diff --git a/sso-manager-node b/sso-manager-node
index 6ce36b4..81ad538 160000
--- a/sso-manager-node
+++ b/sso-manager-node
@@ -1 +1 @@
-Subproject commit 6ce36b4a14dd22938f215dd53fba1504e4a43d92
+Subproject commit 81ad538e50ca85d74cb094148dda4ec9ec356360