diff --git a/CHANGELOG.alpha.md b/CHANGELOG.alpha.md
index 6d437b0..22e6030 100644
--- a/CHANGELOG.alpha.md
+++ b/CHANGELOG.alpha.md
@@ -6,6 +6,22 @@ are upstreamed or promoted to stable. Alpha uses the dedicated
 `jsonbored/sure-aio-alpha` image repo so testing tags stay out of the stable
 `jsonbored/sure-aio` package.
 
+## 0.7.5-alpha.6-aio.1 - 2026-09-08
+
+### Build
+
+- Track upstream Sure Alpha 0.7.5-alpha.6.
+- Publish Docker Hub and GHCR tags with the configured component revision tag.
+
+### Component Customizations
+
+- Preserve the Sure AIO alpha import-limit overlay documented in `docs/alpha-lane.md`.
+- Preserve the strict SureImport preflight/failure overlay until the pinned upstream alpha includes equivalent behavior.
+- Preserve the route-parity importer overlay for Enhanced NDJSON split/transfer proof packages until upstream carries it.
+- Keep `SURE_IMPORT_MAX_NDJSON_SIZE_MB` and `SURE_IMPORT_MAX_ROWS` alpha-only.
+- Do not add dirty-target taxonomy merge as a Unraid template or environment control.
+- Keep alpha passkey/WebAuthn template controls separate from stable.
+
 ## 0.7.3-alpha.6-aio.1 - 2026-07-27
 
 ### Build
diff --git a/Dockerfile b/Dockerfile
index c70889e..48aae59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # checkov:skip=CKV_DOCKER_8: s6-overlay entrypoint must start as root so init scripts can prepare filesystem state before dropping privileges
 
-ARG UPSTREAM_VERSION=0.7.2
-ARG UPSTREAM_IMAGE_DIGEST=sha256:96155b20c0b71f8e2ab960ab5aba8fba9df64c6a40ec581eca20af2b20ab089c
+ARG UPSTREAM_VERSION=0.7.4
+ARG UPSTREAM_IMAGE_DIGEST=sha256:391b2c52acfe538065a41cdd1c9755f90d95ba17a2c06e9b6438b12098df3f3a
 ARG PGVECTOR_VERSION=0.8.2
 FROM jsonbored/aio-base:s6-3.2.1.0@sha256:07db479a01a95ba28480b4605f5d1cc8bedb574b77cf167ee46e29b9558fee90 AS aio-base
 
diff --git a/Dockerfile.alpha b/Dockerfile.alpha
index ffe717d..5166f8d 100644
--- a/Dockerfile.alpha
+++ b/Dockerfile.alpha
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # checkov:skip=CKV_DOCKER_8: s6-overlay entrypoint must start as root so init scripts can prepare filesystem state before dropping privileges
 
-ARG UPSTREAM_VERSION=0.7.3-alpha.6
-ARG UPSTREAM_IMAGE_DIGEST=sha256:1c4e77af614e981325762142d2d07de9de9926ca1713f3de128f9ecd3870580b
+ARG UPSTREAM_VERSION=0.7.5-alpha.6
+ARG UPSTREAM_IMAGE_DIGEST=sha256:253cbe4f533aa8aed3103c495f6545e5cb3ba5da3778387c87d0541e5cf60290
 ARG AIO_REVISION=1
 ARG PGVECTOR_VERSION=0.8.2
 FROM jsonbored/aio-base:s6-3.2.1.0@sha256:07db479a01a95ba28480b4605f5d1cc8bedb574b77cf167ee46e29b9558fee90 AS aio-base