diff --git a/LLM.md b/LLM.md
index f7b5ff6bb8..f75244b235 100644
--- a/LLM.md
+++ b/LLM.md
@@ -225,6 +225,13 @@ CI: `hanzoai/.github/.github/workflows/docker-build.yml@main` builds
 `ghcr.io/hanzoai/kms:<branch>` for `linux/amd64` + `linux/arm64` on
 native runners (DO+GKE), no QEMU.
 
+Releases: a semver tag (`vX.Y.Z` matching `VERSION`) triggers
+`.github/workflows/release.yml`, which publishes the multi-arch
+`ghcr.io/hanzoai/kms:vX.Y.Z` + `:X.Y.Z` + `:latest` manifest and
+dispatches `hanzoai/universe` to bump the pin. The universe manifest
+pins the released tag (`ghcr.io/hanzoai/kms:2.5.5`) — never a DOCR
+one-off. `VERSION` (`2.5.5`) wraps canonical `luxfi/kms v1.11.7`.
+
 ## Where things live
 
 ```
diff --git a/VERSION b/VERSION
index f225a78adf..0cadbc1e33 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.5.2
+2.5.5
diff --git a/go.mod b/go.mod
index eef883dbb2..9b7f2bbf05 100644
--- a/go.mod
+++ b/go.mod
@@ -13,8 +13,8 @@ go 1.26.4
 
 // luxfi/keys + luxfi/kms drive the consensus-native ZAP secret surface.
 // Tagged upstream:
-//   luxfi/keys v1.1.0   — BBF-bound hybrid signature (secp256k1+ML-DSA-65)
-//   luxfi/kms  v1.11.0  — anti-replay nonce ledger closes 5min window
+//   luxfi/keys v1.2.0   — BBF-bound hybrid signature (secp256k1+ML-DSA-65)
+//   luxfi/kms  v1.11.7  — anti-replay nonce ledger closes 5min window
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/hanzoai/cloud v0.1.1
diff --git a/go.sum b/go.sum
index a44fd2421e..56da9fcd60 100644
--- a/go.sum
+++ b/go.sum
@@ -172,7 +172,7 @@ github.com/luxfi/tls v1.0.3 h1:rK3nxSAxrUOOSHOZnKChwV4f6UJ+cfOl8KWJXAQx/SI=
 github.com/luxfi/tls v1.0.3/go.mod h1:dQqSiGE7YxXUxOwICoReUuIitBms9DYOaCeteBwmIWw=
 github.com/luxfi/vm v1.2.0 h1:jTwQRHdC9VmyRZTPSn+IqjMju7f6xlxLc6P9CEg+Y2M=
 github.com/luxfi/vm v1.2.0/go.mod h1:qasVIBRerVQuvy9vFGrX3H8X8pPMPG5un/KbZSyq5YY=
-github.com/luxfi/zap v0.8.1 h1:MiVRsRA808bXn6Orc81cjlGjqbn8gf7fr9aP5MPbLEM=
+github.com/luxfi/zap v0.8.1 h1:IzYWf4T35QjsUJhoNbuhew8MDDRYmlZUVx4gKBNLjMA=
 github.com/luxfi/zap v0.8.1/go.mod h1:gUoQ/V9nTLLIb4/n0bY/L2zQDYK6pDBG121rK4t8bpg=
 github.com/luxfi/zapdb v1.10.0 h1:1lLHEmkyC0BucnA/zjQYsMkUVxuEo2vQkEaQGjYfuuc=
 github.com/luxfi/zapdb v1.10.0/go.mod h1:Qukh3hDRD0MnxA6z+a28JTnXhN85AiLLgp6TYr4QAMc=