diff --git a/CHANGELOG.md b/CHANGELOG.md
index d0e4aac5ee..f50b54d42c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,131 @@
+## Fleet 4.90.0 (Aug 05, 2026)
+
+### IT Admins
+- Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.
+- Added support for editing existing configuration profiles (Apple `.mobileconfig`, Apple DDM declarations, Windows, and Android) in place via `PATCH /api/v1/fleet/configuration_profiles/:profile_uuid`.
+- Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as `$FLEET_HOST_VITAL_<id>` variables in scripts and configuration profiles.
+- Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).
+- Added `POST /api/v1/fleet/host_name_template` to set or clear the naming template (`fleet_id` omitted or `0` targets "No team"); an empty template clears it without renaming any host.
+- Added a `name_template` key under `controls` in GitOps for fleets and "No team", and included it in `fleetctl generate-gitops` output.
+- Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via `POST /api/v1/fleet/hosts/{id}/name_template/resend`.
+- Added host name enforcement statuses to the Controls OS settings aggregate cards and the `os_settings` host filter.
+- Added the `edited_host_name_template` activity.
+- Added support for Python (`.py`) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.
+- Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts.
+- Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
+- Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The `microsoft_compliance_partner.proxy_api_key` server configuration has been removed; the feature is now gated on the Fleet Premium license tier.
+- Added native Splunk HEC log destination for osquery status, result, and audit logs.
+- Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.
+- Added `FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION` (`mdm.enable_custom_disk_encryption`) as a cross-platform alias for `FLEET_MDM_ENABLE_CUSTOM_FILEVAULT`. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.
+- Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.
+- Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.
+- Added support for targeting declarations to the user channel on macOS.
+- Added the ability to handle DDM assets, and unblocked more declaration types.
+- Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or User). This requires osquery 5.23.1 or higher on the host.
+- Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.
+- Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM `CertificateList` command when an ACME-bearing configuration profile is installed or re-installed.
+- Added "Targeted platforms" column and platform filter dropdown to the Policies page.
+- Added optional `platform` query parameter to `GET /api/v1/fleet/policies` and `GET /api/v1/fleet/fleets/{id}/policies` to filter policies by targeted platform.
+- Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.
+- Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with `platform=zorin`, appear in the Linux disk-encryption summary, support `.deb` software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.
+- Added support for CachyOS (an Arch-based Linux distribution) as a recognized Linux platform.
+- Added an "Operating systems" card to the dashboard when Linux or Android is selected.
+- Added installed version and available version columns to the self-service software table on the My device page.
+- Added the "Applications" / "Full inventory" software filter to the Fleet Desktop **My device > Software** tab for macOS hosts, matching the host details page.
+- Added the asynchronous live query endpoint (`POST /api/v1/fleet/reports/run`) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.
+- Added audit activities when secret variables are created or updated through the `PUT /api/latest/fleet/spec/secret_variables` endpoint.
+
+### Security Engineers
+- Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."
+- Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.
+- Updated CIS Benchmark policies for Windows 10 Enterprise to align with the CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 (added, removed, and updated policies per the v4.0.0 change history).
+- Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add `$FLEET_VAR_CERTIFICATE_RENEWAL_ID` to the certificate's Subject OU to enable.
+- Renamed `$FLEET_VAR_SCEP_RENEWAL_ID` to `$FLEET_VAR_CERTIFICATE_RENEWAL_ID`. The legacy name still works.
+- Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
+- Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).
+- Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.
+- Rejected empty and whitespace-only enroll secrets when creating or updating teams.
+- Restricted SCIM endpoint access to global admin users only.
+- Removed the unused `/api/mdm/microsoft/auth` Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.
+- Added a `server_bypass_network_blocking` server config option to allow disabling all outbound network blocking protections for integration HTTP requests in production, for environments where egress is already constrained by external infrastructure.
+
+### Bug fixes and improvements
+- Improved software ingestion performance by removing a full table scan of `software_titles` table.
+- Optimized memory usage of CVE chart cron job.
+- Reduced MySQL reader load when listing hosts with `device_mapping=true` and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.
+- Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.
+- Improved performance of Orbit config endpoint by batching extension label-membership checks into a single database query.
+- Improved performance of host config endpoint by caching scheduled query configuration.
+- Improved efficiency of the scheduled query stats aggregation cron job.
+- Added better indexing for the Get Next Apple MDM command query.
+- Added a long-lived immutable `Cache-Control` header to content-hashed static assets under `/assets/` so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.
+- Removed the `fleetdm/bomutils` Docker dependency for generating macOS `.pkg` fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so `fleetctl package --type pkg` no longer requires Docker, `mkbom`, or `xar`.
+- Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.
+- Improved GitOps consistency by validating batch-applied Windows configuration profiles against the server's current MDM configuration state, while continuing to support previewing (dry run) a config that enables Windows MDM and applies profiles in a single run.
+- Added a check for duplicate patch policies when applying GitOps.
+- Added an error when `fleet_maintained_app_slug` is set on a non-patch policy in a GitOps yaml file.
+- Surfaced a more detailed error message in GitOps if user doesn't have server_private_key configured.
+- Improved error message when a mobileconfig profile contains unescaped special characters (e.g. `&`, `<`, `'`, `>`) that cause illegal base64 data errors during plist parsing.
+- Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).
+- Improved the Windows MDM enrollment server log for unsupported username and password (OnPremise) enrollment: a device that is not joined to Microsoft Entra ID now receives a clear server log message to join Microsoft Entra ID or enroll with fleetd.
+- Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM.
+- Renamed "Create" buttons and links to "Add" across the Fleet UI for consistency.
+- Updated link styles in the UI.
+- Updated the 404 page with a new illustration and copy consistent with the rest of the app.
+- Updated the 500 and 403 error pages to match the design system and reuse the app navigation so the 500 page no longer shows broken image elements.
+- Improved the user menu to show individual settings sections for admins.
+- Updated Windows MDM end user experience radio button labels from Automatic/Manual to Fleet agent-driven/End user-driven to reduce confusion with MDM status terminology.
+- Updated relative "time ago" timestamps to show days instead of months when the timestamp is less than 90 days ago.
+- Updated the message shown when refetching a host's vitals takes longer than expected to reflect uncertainty rather than failure, on the host details page, the My device page, and the dashboard's "Welcome to Fleet" card.
+- Clarified the delayed host vitals refetch banner to reflect that a refetch was sent and the UI will update when the host responds.
+- Removed the default platform filter on the "hosts online" chart, so iOS, iPadOS, and Android hosts are now included by default alongside desktop platforms.
+- Removed the elevated white background container from the loading spinner for a flatter, more consistent look.
+- Removed the blue active-state background flash when clicking a row in a single-select data table (e.g., **My device > Policies**).
+- Updated missed ABM references to AB.
+- Hid the Self-service "Install all" button on the unfiltered "All" category so end users can't queue an install of the entire catalog in one click. The button still appears when a specific category is selected.
+- Hid self-service categories that have no available software from the category filter on the **My device** page, so users only see categories they can actually install from.
+- Added a "no custom SCEP CA configured" empty state to the certificates card.
+- Made form validation consistent across more forms (#40410 follow-up): validation errors now appear when leaving a field (on blur) and no longer appear before any input. This covers the policy automations "Other workflows" Destination URL, the add/edit user Email field, and the host status webhook Destination URL (both global settings and fleet settings).
+- Fixed recurring Redis `MOVED` errors and silently-dropped report result-count increments on Redis Cluster deployments by grouping `query_results_count` keys by hash slot before pipelining.
+- Fixed newly created or updated reports not appearing in the host details "Live report" modal or the reports list until a hard refresh.
+- Fixed an issue where an identity provider (IdP) user associated with multiple hosts only had IdP host vitals populated on one of them. All matching hosts are now linked when the SCIM/IdP user is created.
+- Fixed a bug where the Add software > App Store picker failed with an error for maintainer and technician roles because listing VPP tokens required admin access.
+- Fixed an issue where the tooltip size of "Require BitLocker PIN" was bigger than normal.
+- Fixed a bug where the DEP syncer could silently drop device enrollment events when interrupted mid-run (e.g. context cancelled). The sync cursor now only advances after device records are successfully written, ensuring affected devices are replayed on the next sync rather than lost.
+- Fixed high memory usage (and occasional osquery watchdog worker restarts) on macOS hosts running the `software_macos` detail query, caused by an unbounded recursive filesystem walk used to de-duplicate Homebrew casks against the `apps` table. The check now uses bounded, non-recursive globs matching the standard cask layout. This also fixes casks that ship no `.app` bundle (e.g. `gcloud-cli`) being incorrectly dropped from software inventory.
+- Fixed the "Missing hosts" summary card not showing on the Fleet Free dashboard when a platform other than "All" was selected.
+- Fixed an issue where ACME urls would throw a 500 error on malformed URLs.
+- Fixed macOS software titles being displayed with an embedded login-helper's name (e.g. "AmphetamineLoginHelper") instead of the parent app's name when the helper bundle shares a bundle identifier with the main app. Embedded `.app` bundles nested under `Contents/` are now excluded at ingestion, and existing mis-named titles are renamed by a one-shot migration that recomputes the name from the title's sibling software rows.
+- Fixed long certificate names overflowing the delete certificate modal in Controls > OS settings > Certificates.
+- Fixed the policies and users tables intermittently reloading and clearing the current selection or resetting to the first page when the browser window regained focus.
+- Fixed a timeout when editing existing Windows configuration profiles for a large team via `POST /api/latest/fleet/mdm/profiles/batch` (GitOps). Now the request stays fast regardless of host count.
+- Fixed label membership being incorrectly cleared when a label's query errors out on a host (e.g. the extension socket is unavailable) instead of returning zero rows; existing membership is now left unchanged when a label query fails.
+- Fixed observers not seeing the "Show managed account" action on a macOS host's details page, even though the API already allows them to view the managed local account password.
+- Fixed an issue where the truncated vulnerabilities list in the Update details modal did not show a tooltip listing the remaining CVEs.
+- Fixed an incorrect error message where an `msix` file was parsed as an `ipa` file.
+- Fixed sorting of fleets for fleet-level users.
+- Fixed stale policy results inflating a host's failing policies count (shown in Fleet Desktop and the host's "Issues" column) after the policy no longer applied to the host (e.g. the host changed teams, or the policy's platform or label scope changed). Stale results are now cleaned up when the host reports its policy results.
+- Fixed missing hover state on buttons and dropdowns inside cards in dark mode.
+- Fixed the Policies page automations filter disappearing from the UI when switching to the "Unassigned" fleet and selecting a different automation type.
+- Fixed the SSO sign-on button text overflowing by using a fixed "Sign in with SSO" label and showing the configured IdP name in a tooltip.
+- Fixed an issue where premium MDM calls were being made on a Fleet Free license.
+- Fixed cron jobs getting stuck in "expired" when a run is interrupted mid-flight (e.g. during server shutdown); the run now records a terminal "canceled" status, preserving any job errors, instead of being left "pending" until reaped to "expired".
+- Fixed several styling issues on the end user enrollment page (BYOD info banner icon, active tab color, banner border, uneven QR code spacing) and added a "Learn more" link to the BYOD info banner. Also fixed enroll secret text incorrectly rendering in blue instead of black in the Add hosts modal.
+- Fixed error in re-enrollment to Fleet with EUA on Linux with a different e-mail than the one used in the first enrollment.
+- Fixed the vulnerability automations webhook "Destination URL" field to validate on blur (when the user clicks out of the field), consistent with other URL fields in Fleet, instead of only showing an error on save.
+- Fixed Google Translate extension causing a 500-page when running live reports.
+- Fixed a bug where some symbols changed height based on nearby characters in input fields.
+- Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.
+- Fixed an issue where tooltips for full name did not always show.
+- Fixed server-side paginated tables (e.g. policies) landing on an empty state after deleting the last row on a page. The table now navigates back to a page with data instead.
+- Fixed a server panic ("assignment to entry in nil map") when a host checked in for its osquery config while its agent options had a null `config`.
+- Fixed team write endpoints (modify team, modify team agent options, and create team) so that they no longer return plaintext enroll secrets to users who cannot read them (such as GitOps), and applied the same secret masking to the list teams response.
+- Fixed a bug where a custom Windows configuration profile/command could bypass Fleet's checks by using a scope-less LocURI.
+- Fixed vulnerability detection for Citrix Workspace on Windows by normalizing the software version (e.g. `25.7.1.6` to `2507.1.6`) for Citrix Workspace entries whose name does not include the `YYMM` release, so the generated CPE matches NVD.
+- Fixed Citrix Workspace LTSR detection on Windows to include cumulative updates (e.g. 2203 LTSR CU4), so their vulnerabilities report the correct LTSR `resolved_in_version` (e.g. `2402` for CVE-2024-6286) instead of the Current Release version.
+- Fixed missing `resolved_in_version` for CVE-2025-63389 on Ollama (resolved in v0.12.4), which was absent because the NVD record only provides a `versionEndIncluding` constraint.
+- Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.
+
 ## Fleet 4.89.2 (Jul 24, 2026)
 
 ### Bug fixes
diff --git a/changes/16771-gitops-team-secret-leak b/changes/16771-gitops-team-secret-leak
deleted file mode 100644
index bc46730fc0..0000000000
--- a/changes/16771-gitops-team-secret-leak
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed team write endpoints (modify team, modify team agent options, and create team) so that they no longer return plaintext enroll secrets to users who cannot read them (such as GitOps), and applied the same secret masking to the list teams response.
diff --git a/changes/16779-secret-variable-spec-activities b/changes/16779-secret-variable-spec-activities
deleted file mode 100644
index b63440d328..0000000000
--- a/changes/16779-secret-variable-spec-activities
+++ /dev/null
@@ -1 +0,0 @@
-- Added audit activities when secret variables are created or updated through the `PUT /api/latest/fleet/spec/secret_variables` endpoint.
diff --git a/changes/16800-reject-empty-enroll-secrets b/changes/16800-reject-empty-enroll-secrets
index 6910322f9b..1e5a84c1fb 100644
--- a/changes/16800-reject-empty-enroll-secrets
+++ b/changes/16800-reject-empty-enroll-secrets
@@ -1 +1 @@
-- Rejected empty and whitespace-only enroll secrets when creating or updating teams, blocked host enrollment with such secrets across all enrollment paths (osquery, Orbit, Apple MDM, Android), and removed any pre-existing empty enroll secrets.
+- Blocked host enrollment with empty or whitespace-only enroll secrets across all enrollment paths (osquery, Orbit, Apple MDM, Android), and removed any pre-existing empty enroll secrets.
diff --git a/changes/23242-apple-byod-enrollment-permissions b/changes/23242-apple-byod-enrollment-permissions
deleted file mode 100644
index f300a3b03f..0000000000
--- a/changes/23242-apple-byod-enrollment-permissions
+++ /dev/null
@@ -1 +0,0 @@
-- Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.
diff --git a/changes/25217-turn-off-mdm-offline-macos b/changes/25217-turn-off-mdm-offline-macos
deleted file mode 100644
index e70a304c27..0000000000
--- a/changes/25217-turn-off-mdm-offline-macos
+++ /dev/null
@@ -1 +0,0 @@
-- Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.
diff --git a/changes/25574-splunk-log-destination b/changes/25574-splunk-log-destination
deleted file mode 100644
index e941a94dd8..0000000000
--- a/changes/25574-splunk-log-destination
+++ /dev/null
@@ -1 +0,0 @@
-- Added native Splunk HEC log destination for osquery status, result, and audit logs.
diff --git a/changes/28108-multiple-custom-packages b/changes/28108-multiple-custom-packages
deleted file mode 100644
index f936944fc1..0000000000
--- a/changes/28108-multiple-custom-packages
+++ /dev/null
@@ -1 +0,0 @@
-- Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.
diff --git a/changes/31294-windows-host-certificates b/changes/31294-windows-host-certificates
deleted file mode 100644
index f4acefcc73..0000000000
--- a/changes/31294-windows-host-certificates
+++ /dev/null
@@ -1,2 +0,0 @@
-- Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or
-  User). This requires osquery 5.23.1 or higher on the host.
diff --git a/changes/34591-add-cachyos-support b/changes/34591-add-cachyos-support
deleted file mode 100644
index 8562606961..0000000000
--- a/changes/34591-add-cachyos-support
+++ /dev/null
@@ -1,2 +0,0 @@
-CachyOS is an Arch-based Linux distribution that is not currently fully supported by Fleet with missing vital information.
-This adds support for it as a known Linux platform
diff --git a/changes/34984-spinner-elevated-background b/changes/34984-spinner-elevated-background
deleted file mode 100644
index fc31d4818e..0000000000
--- a/changes/34984-spinner-elevated-background
+++ /dev/null
@@ -1 +0,0 @@
-- Removed the elevated white background container from the loading spinner for a flatter, more consistent look.
diff --git a/changes/35075-android-os-versions-vulnerabilities b/changes/35075-android-os-versions-vulnerabilities
deleted file mode 100644
index 2e609cd7e2..0000000000
--- a/changes/35075-android-os-versions-vulnerabilities
+++ /dev/null
@@ -1,2 +0,0 @@
-- Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."
-- Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.
\ No newline at end of file
diff --git a/changes/35328-update-text-link-styles b/changes/35328-update-text-link-styles
deleted file mode 100644
index 3db27bea2f..0000000000
--- a/changes/35328-update-text-link-styles
+++ /dev/null
@@ -1 +0,0 @@
-Updated link styles in the UI
diff --git a/changes/37972-improve-settings-subnav b/changes/37972-improve-settings-subnav
deleted file mode 100644
index d932b79455..0000000000
--- a/changes/37972-improve-settings-subnav
+++ /dev/null
@@ -1,2 +0,0 @@
-- Improved the user menu to show individual settings sections for admins.
-- Fixed sorting of fleets for fleet-level users.
diff --git a/changes/38214-clarify-vitals-refetch-timeout-banner b/changes/38214-clarify-vitals-refetch-timeout-banner
deleted file mode 100644
index 8521e9215e..0000000000
--- a/changes/38214-clarify-vitals-refetch-timeout-banner
+++ /dev/null
@@ -1 +0,0 @@
-- Clarified the delayed host vitals refetch banner to reflect that a refetch was sent and the UI will update when the host responds.
diff --git a/changes/38214-improve-ux-delayed-host-vitals-refetch b/changes/38214-improve-ux-delayed-host-vitals-refetch
deleted file mode 100644
index e4824d7def..0000000000
--- a/changes/38214-improve-ux-delayed-host-vitals-refetch
+++ /dev/null
@@ -1 +0,0 @@
-- Updated the message shown when refetching a host's vitals takes longer than expected to reflect uncertainty rather than failure, on the host details page, the My device page, and the dashboard's "Welcome to Fleet" card.
diff --git a/changes/38806-macos-iosipados-rename-hosts b/changes/38806-macos-iosipados-rename-hosts
deleted file mode 100644
index 0d2e423b00..0000000000
--- a/changes/38806-macos-iosipados-rename-hosts
+++ /dev/null
@@ -1,6 +0,0 @@
-* Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).
-* Added `POST /api/v1/fleet/host_name_template` to set or clear the naming template (`fleet_id` omitted or `0` targets "No team"); an empty template clears it without renaming any host.
-* Added a `name_template` key under `controls` in GitOps for fleets and "No team", and included it in `fleetctl generate-gitops` output.
-* Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via `POST /api/v1/fleet/hosts/{id}/name_template/resend`.
-* Added host name enforcement statuses to the Controls OS settings aggregate cards and the `os_settings` host filter.
-* Added the `edited_host_name_template` activity.
diff --git a/changes/38874-macos-enroll-url b/changes/38874-macos-enroll-url
deleted file mode 100644
index 79d66b0d2c..0000000000
--- a/changes/38874-macos-enroll-url
+++ /dev/null
@@ -1 +0,0 @@
-- Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.
diff --git a/changes/38986-support-ddm-assets b/changes/38986-support-ddm-assets
deleted file mode 100644
index 4e5a5f333c..0000000000
--- a/changes/38986-support-ddm-assets
+++ /dev/null
@@ -1 +0,0 @@
-- Added the ability to handle DDM assets, and unblocked more declaration types.
\ No newline at end of file
diff --git a/changes/39346-certificates-list b/changes/39346-certificates-list
deleted file mode 100644
index b8f8da9fdd..0000000000
--- a/changes/39346-certificates-list
+++ /dev/null
@@ -1,2 +0,0 @@
-- Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.
-- Added a "no custom SCEP CA configured" empty state to the certificates card.
diff --git a/changes/40410-consistent-form-validation-onblur.md b/changes/40410-consistent-form-validation-onblur.md
deleted file mode 100644
index d2c076bd6a..0000000000
--- a/changes/40410-consistent-form-validation-onblur.md
+++ /dev/null
@@ -1 +0,0 @@
-- Made form validation consistent across more forms (#40410 follow-up): validation errors now appear when leaving a field (on blur) and no longer appear before any input. This covers the policy automations "Other workflows" Destination URL, the add/edit user Email field, and the host status webhook Destination URL (both global settings and fleet settings).
diff --git a/changes/40410-webhook-url-validation-onblur.md b/changes/40410-webhook-url-validation-onblur.md
deleted file mode 100644
index 0d6462789a..0000000000
--- a/changes/40410-webhook-url-validation-onblur.md
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed the vulnerability automations webhook "Destination URL" field to validate on blur (when the user clicks out of the field), consistent with other URL fields in Fleet, instead of only showing an error on save.
diff --git a/changes/40639-non-proxied-cert-renewal b/changes/40639-non-proxied-cert-renewal
deleted file mode 100644
index a820a992ab..0000000000
--- a/changes/40639-non-proxied-cert-renewal
+++ /dev/null
@@ -1,3 +0,0 @@
-* Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add `$FLEET_VAR_CERTIFICATE_RENEWAL_ID` to the certificate's Subject OU to enable.
-* Renamed `$FLEET_VAR_SCEP_RENEWAL_ID` to `$FLEET_VAR_CERTIFICATE_RENEWAL_ID`. The legacy name still works.
-* Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
diff --git a/changes/41056-remove-windows-sts-auth-endpoint.md b/changes/41056-remove-windows-sts-auth-endpoint.md
deleted file mode 100644
index 3655a3ce13..0000000000
--- a/changes/41056-remove-windows-sts-auth-endpoint.md
+++ /dev/null
@@ -1 +0,0 @@
-- Removed the unused `/api/mdm/microsoft/auth` Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.
diff --git a/changes/41470-python-script-only-packages b/changes/41470-python-script-only-packages
deleted file mode 100644
index 12d43d136c..0000000000
--- a/changes/41470-python-script-only-packages
+++ /dev/null
@@ -1 +0,0 @@
-- Added support for Python (`.py`) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.
diff --git a/changes/41790-citrix-ltsr-cumulative-updates b/changes/41790-citrix-ltsr-cumulative-updates
deleted file mode 100644
index 8653bd9df1..0000000000
--- a/changes/41790-citrix-ltsr-cumulative-updates
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed Citrix Workspace LTSR detection on Windows to include cumulative updates (e.g. 2203 LTSR CU4), so their vulnerabilities report the correct LTSR `resolved_in_version` (e.g. `2402` for CVE-2024-6286) instead of the Current Release version.
diff --git a/changes/42473-sso-button-overflow b/changes/42473-sso-button-overflow
deleted file mode 100644
index ef7c1caaa7..0000000000
--- a/changes/42473-sso-button-overflow
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed the SSO sign-on button text overflowing by using a fixed "Sign in with SSO" label and showing the configured IdP name in a tooltip.
diff --git a/changes/42827-macos-mdm-certificate-ingestion b/changes/42827-macos-mdm-certificate-ingestion
deleted file mode 100644
index 685b4263b4..0000000000
--- a/changes/42827-macos-mdm-certificate-ingestion
+++ /dev/null
@@ -1 +0,0 @@
-* Surface hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM `CertificateList` command when an ACME-bearing configuration profile is installed or re-installed.
diff --git a/changes/43097-more-detailed-error-without-server-private-key b/changes/43097-more-detailed-error-without-server-private-key
deleted file mode 100644
index 9a8f6f4b05..0000000000
--- a/changes/43097-more-detailed-error-without-server-private-key
+++ /dev/null
@@ -1 +0,0 @@
-- Surface a more detailed error message in GitOps if user doesn't have server_private_key configured.
diff --git a/changes/43328-python3-prefix-cpe b/changes/43328-python3-prefix-cpe
deleted file mode 100644
index 7ac7501aa8..0000000000
--- a/changes/43328-python3-prefix-cpe
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.
diff --git a/changes/43379-windows-mdm-end-user-experience-labels b/changes/43379-windows-mdm-end-user-experience-labels
deleted file mode 100644
index 67db94cc29..0000000000
--- a/changes/43379-windows-mdm-end-user-experience-labels
+++ /dev/null
@@ -1 +0,0 @@
-- Updated Windows MDM end user experience radio button labels from Automatic/Manual to Fleet agent-driven/End user-driven to reduce confusion with MDM status terminology.
diff --git a/changes/43518-enable-disk-encryption-bitlocker b/changes/43518-enable-disk-encryption-bitlocker
deleted file mode 100644
index 79d62145a1..0000000000
--- a/changes/43518-enable-disk-encryption-bitlocker
+++ /dev/null
@@ -1 +0,0 @@
-- Added `FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION` (`mdm.enable_custom_disk_encryption`) as a cross-platform alias for `FLEET_MDM_ENABLE_CUSTOM_FILEVAULT`. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.
diff --git a/changes/44199-embedded-bundle-title-name b/changes/44199-embedded-bundle-title-name
deleted file mode 100644
index f7f74336ff..0000000000
--- a/changes/44199-embedded-bundle-title-name
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed macOS software titles being displayed with an embedded login-helper's name (e.g. "AmphetamineLoginHelper") instead of the parent app's name when the helper bundle shares a bundle identifier with the main app. Embedded `.app` bundles nested under `Contents/` are now excluded at ingestion, and existing mis-named titles are renamed by a one-shot migration that recomputes the name from the title's sibling software rows.
diff --git a/changes/44352-500-error-page b/changes/44352-500-error-page
deleted file mode 100644
index 1b40b2e18a..0000000000
--- a/changes/44352-500-error-page
+++ /dev/null
@@ -1 +0,0 @@
-* Updated the 500 and 403 error pages to match the design system and reuse the app navigation so the 500 page no longer shows broken image elements.
diff --git a/changes/44428-tpm-backed-disk-encryption.md b/changes/44428-tpm-backed-disk-encryption.md
deleted file mode 100644
index 73c4053fa5..0000000000
--- a/changes/44428-tpm-backed-disk-encryption.md
+++ /dev/null
@@ -1 +0,0 @@
-- Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.
diff --git a/changes/44624-policies-automations-filter-unassigned b/changes/44624-policies-automations-filter-unassigned
deleted file mode 100644
index cee2ea740f..0000000000
--- a/changes/44624-policies-automations-filter-unassigned
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed the Policies page automations filter disappearing from the UI when switching to the "Unassigned" fleet and selecting a different automation type.
diff --git a/changes/44800-ollama-resolved-in-version b/changes/44800-ollama-resolved-in-version
deleted file mode 100644
index a447dfd2dc..0000000000
--- a/changes/44800-ollama-resolved-in-version
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed missing `resolved_in_version` for CVE-2025-63389 on Ollama (resolved in v0.12.4), which was absent because the NVD record only provides a `versionEndIncluding` constraint.
diff --git a/changes/44954-custom-host-vitals.md b/changes/44954-custom-host-vitals.md
deleted file mode 100644
index 73fcc4552f..0000000000
--- a/changes/44954-custom-host-vitals.md
+++ /dev/null
@@ -1 +0,0 @@
-- Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as `$FLEET_HOST_VITAL_<id>` variables in scripts and configuration profiles.
diff --git a/changes/45524-macos-password-sync b/changes/45524-macos-password-sync
deleted file mode 100644
index 9183e42242..0000000000
--- a/changes/45524-macos-password-sync
+++ /dev/null
@@ -1 +0,0 @@
-* Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts
diff --git a/changes/45550-surface-windows-scep-proxy-failures.md b/changes/45550-surface-windows-scep-proxy-failures.md
deleted file mode 100644
index b5070c8a14..0000000000
--- a/changes/45550-surface-windows-scep-proxy-failures.md
+++ /dev/null
@@ -1 +0,0 @@
-- Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).
diff --git a/changes/45650-windows-mdm-command-results-insert-perf.md b/changes/45650-windows-mdm-command-results-insert-perf.md
deleted file mode 100644
index 448c00d9a1..0000000000
--- a/changes/45650-windows-mdm-command-results-insert-perf.md
+++ /dev/null
@@ -1 +0,0 @@
-- Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.
diff --git a/changes/45682-cache-control-static-assets b/changes/45682-cache-control-static-assets
deleted file mode 100644
index 600e928297..0000000000
--- a/changes/45682-cache-control-static-assets
+++ /dev/null
@@ -1 +0,0 @@
-* Added a long-lived immutable `Cache-Control` header to content-hashed static assets under `/assets/` so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.
diff --git a/changes/45710-zorin-os-support b/changes/45710-zorin-os-support
deleted file mode 100644
index eacc7a5516..0000000000
--- a/changes/45710-zorin-os-support
+++ /dev/null
@@ -1 +0,0 @@
-- Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with `platform=zorin`, appear in the Linux disk-encryption summary, support `.deb` software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.
diff --git a/changes/45729-self-service-show-version b/changes/45729-self-service-show-version
deleted file mode 100644
index e23795823d..0000000000
--- a/changes/45729-self-service-show-version
+++ /dev/null
@@ -1 +0,0 @@
-- Added installed version and available version columns to the self-service software table on the My device page.
diff --git a/changes/46057-vpp-tokens-maintainer-authz b/changes/46057-vpp-tokens-maintainer-authz
deleted file mode 100644
index e01cbe4847..0000000000
--- a/changes/46057-vpp-tokens-maintainer-authz
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where the Add software > App Store picker failed with an error for maintainer and technician roles because listing VPP tokens required admin access.
diff --git a/changes/46077-newly-created-reports-do-not-show-up b/changes/46077-newly-created-reports-do-not-show-up
deleted file mode 100644
index 8b8700b9ac..0000000000
--- a/changes/46077-newly-created-reports-do-not-show-up
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed newly created or updated reports not appearing in the host details "Live report" modal or the reports list until a hard refresh.
diff --git a/changes/46193-duplicate-patch-policy-gitops-check b/changes/46193-duplicate-patch-policy-gitops-check
deleted file mode 100644
index 589f6d7cef..0000000000
--- a/changes/46193-duplicate-patch-policy-gitops-check
+++ /dev/null
@@ -1 +0,0 @@
-- Added a check for duplicate patch policies when applying GitOps.
diff --git a/changes/46235-dep-syncer-cursor-not-advanced-on-callback-error b/changes/46235-dep-syncer-cursor-not-advanced-on-callback-error
deleted file mode 100644
index f8980ce25c..0000000000
--- a/changes/46235-dep-syncer-cursor-not-advanced-on-callback-error
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where the DEP syncer could silently drop device enrollment events when interrupted mid-run (e.g. context cancelled). The sync cursor now only advances after device records are successfully written, ensuring affected devices are replayed on the next sync rather than lost.
diff --git a/changes/46282-handle-client-error-decoding-errors b/changes/46282-handle-client-error-decoding-errors
deleted file mode 100644
index f6c44f6e68..0000000000
--- a/changes/46282-handle-client-error-decoding-errors
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an issue where ACME urls would throw a 500 error on malformed URLs.
\ No newline at end of file
diff --git a/changes/46380-ndes-error-location b/changes/46380-ndes-error-location
deleted file mode 100644
index be595febe9..0000000000
--- a/changes/46380-ndes-error-location
+++ /dev/null
@@ -1 +0,0 @@
-- Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).
diff --git a/changes/46387-windows-mdm-enrollment-auth-error b/changes/46387-windows-mdm-enrollment-auth-error
deleted file mode 100644
index 364f758a26..0000000000
--- a/changes/46387-windows-mdm-enrollment-auth-error
+++ /dev/null
@@ -1 +0,0 @@
-- Improved the Windows MDM enrollment server log for unsupported username and password (OnPremise) enrollment: a device that is not joined to Microsoft Entra ID now receives a clear server log message to join Microsoft Entra ID or enroll with fleetd.
diff --git a/changes/46399-query-errors-can-cause-label-membership-unassigned.md b/changes/46399-query-errors-can-cause-label-membership-unassigned.md
deleted file mode 100644
index d1f13956d7..0000000000
--- a/changes/46399-query-errors-can-cause-label-membership-unassigned.md
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed label membership being incorrectly cleared when a label's query errors out on a host (e.g. the extension socket is unavailable) instead of returning zero rows; existing membership is now left unchanged when a label query fails.
diff --git a/changes/46811-citrix-workspace-cpe b/changes/46811-citrix-workspace-cpe
deleted file mode 100644
index db3bcae664..0000000000
--- a/changes/46811-citrix-workspace-cpe
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed vulnerability detection for Citrix Workspace on Windows by normalizing the software version (e.g. `25.7.1.6` to `2507.1.6`) for Citrix Workspace entries whose name does not include the `YYMM` release, so the generated CPE matches NVD.
diff --git a/changes/46959-fpsso-configure-ui b/changes/46959-fpsso-configure-ui
deleted file mode 100644
index 6da56eb320..0000000000
--- a/changes/46959-fpsso-configure-ui
+++ /dev/null
@@ -1 +0,0 @@
-* Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
diff --git a/changes/46965-time-ago-timestamps-use-days b/changes/46965-time-ago-timestamps-use-days
deleted file mode 100644
index e39303f3f4..0000000000
--- a/changes/46965-time-ago-timestamps-use-days
+++ /dev/null
@@ -1 +0,0 @@
-* Updated relative "time ago" timestamps to show days instead of months when the timestamp is less than 90 days ago.
diff --git a/changes/47303-redis-moved-errors-query-results-counts b/changes/47303-redis-moved-errors-query-results-counts
deleted file mode 100644
index d7cc305c4e..0000000000
--- a/changes/47303-redis-moved-errors-query-results-counts
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed recurring Redis `MOVED` errors and silently-dropped report result-count increments on Redis Cluster deployments by grouping `query_results_count` keys by hash slot before pipelining.
diff --git a/changes/47388-getclientconfig-nil-map-panic b/changes/47388-getclientconfig-nil-map-panic
deleted file mode 100644
index 6562294f46..0000000000
--- a/changes/47388-getclientconfig-nil-map-panic
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a server panic ("assignment to entry in nil map") when a host checked in for its osquery config while its agent options had a null `config`.
diff --git a/changes/47488-render-mysql-version b/changes/47488-render-mysql-version
deleted file mode 100644
index 9cdb2e8101..0000000000
--- a/changes/47488-render-mysql-version
+++ /dev/null
@@ -1 +0,0 @@
-- Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.
diff --git a/changes/47530-my-device-policy-click-highlight b/changes/47530-my-device-policy-click-highlight
deleted file mode 100644
index df2d71ad30..0000000000
--- a/changes/47530-my-device-policy-click-highlight
+++ /dev/null
@@ -1 +0,0 @@
-- Removed the blue active-state background flash when clicking a row in a single-select data table (e.g., **My device > Policies**).
diff --git a/changes/47626-use-generated-uuid-for-mdm_idp_account b/changes/47626-use-generated-uuid-for-mdm_idp_account
deleted file mode 100644
index 1bf494b11b..0000000000
--- a/changes/47626-use-generated-uuid-for-mdm_idp_account
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed error in re-enrollment to Fleet with EUA on Linux with a different e-mail than the one used in the first enrollment.
diff --git a/changes/47661-hosts-online-chart-include-mobile-by-default b/changes/47661-hosts-online-chart-include-mobile-by-default
deleted file mode 100644
index 859e756aa3..0000000000
--- a/changes/47661-hosts-online-chart-include-mobile-by-default
+++ /dev/null
@@ -1 +0,0 @@
-- Removed the default platform filter on the "hosts online" chart, so iOS, iPadOS, and Android hosts are now included by default alongside desktop platforms.
diff --git a/changes/47683-windows-mdm-fleetd-install-ordering b/changes/47683-windows-mdm-fleetd-install-ordering
deleted file mode 100644
index 61f20e8e9b..0000000000
--- a/changes/47683-windows-mdm-fleetd-install-ordering
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.
diff --git a/changes/47699-entra-conditional-access-self-hosted b/changes/47699-entra-conditional-access-self-hosted
deleted file mode 100644
index e44106ed1a..0000000000
--- a/changes/47699-entra-conditional-access-self-hosted
+++ /dev/null
@@ -1 +0,0 @@
-- Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The `microsoft_compliance_partner.proxy_api_key` server configuration has been removed; the feature is now gated on the Fleet Premium license tier.
diff --git a/changes/47722-host-device-mapping-reader-load b/changes/47722-host-device-mapping-reader-load
deleted file mode 100644
index 14ffcae479..0000000000
--- a/changes/47722-host-device-mapping-reader-load
+++ /dev/null
@@ -1 +0,0 @@
-* Reduced MySQL reader load when listing hosts with `device_mapping=true` and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.
diff --git a/changes/47922-fix-jumping-symbol b/changes/47922-fix-jumping-symbol
deleted file mode 100644
index 3a451c58ba..0000000000
--- a/changes/47922-fix-jumping-symbol
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where some symbols changed height based on nearby characters in input fields.
diff --git a/changes/47943-premium-calls-on-fleet-free b/changes/47943-premium-calls-on-fleet-free
deleted file mode 100644
index 1b5d40667d..0000000000
--- a/changes/47943-premium-calls-on-fleet-free
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an issue where premium MDM calls was being made on a Fleet Free license.
\ No newline at end of file
diff --git a/changes/48054-fma-duplicate-software-titles b/changes/48054-fma-duplicate-software-titles
deleted file mode 100644
index 8a63ea8b89..0000000000
--- a/changes/48054-fma-duplicate-software-titles
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where adding Windows software via GitOps could create a duplicate software title when a host had already reported the same program.
diff --git a/changes/48077-observer-managed-account-action.md b/changes/48077-observer-managed-account-action.md
deleted file mode 100644
index ef4ac861b9..0000000000
--- a/changes/48077-observer-managed-account-action.md
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed observers not seeing the "Show managed account" action on a macOS host's details page, even though the API already allows them to view the managed local account password.
diff --git a/changes/48102-fix-msix-detecting-as-ipa b/changes/48102-fix-msix-detecting-as-ipa
deleted file mode 100644
index 3c482ee7d3..0000000000
--- a/changes/48102-fix-msix-detecting-as-ipa
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an incorrect error message where an `msix` file was parsed as an `ipa` file.
diff --git a/changes/48125-tooltip-not-showing-idp b/changes/48125-tooltip-not-showing-idp
deleted file mode 100644
index cc7aa71b6c..0000000000
--- a/changes/48125-tooltip-not-showing-idp
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an issue where tooltips for full name did not always show.
\ No newline at end of file
diff --git a/changes/48129-404-page b/changes/48129-404-page
deleted file mode 100644
index 9c1f586a6f..0000000000
--- a/changes/48129-404-page
+++ /dev/null
@@ -1 +0,0 @@
-* Updated the 404 page with a new illustration and copy consistent with the rest of the app.
diff --git a/changes/48177-rename-create-buttons-to-add b/changes/48177-rename-create-buttons-to-add
deleted file mode 100644
index 714ab865f4..0000000000
--- a/changes/48177-rename-create-buttons-to-add
+++ /dev/null
@@ -1 +0,0 @@
-- Renamed "Create" buttons and links to "Add" across the Fleet UI for consistency.
diff --git a/changes/48229-inconsistent-font-size-tooltip b/changes/48229-inconsistent-font-size-tooltip
deleted file mode 100644
index f814131209..0000000000
--- a/changes/48229-inconsistent-font-size-tooltip
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an issue with the tooltip size of "Require BitLocker PIN" was bigger than normal.
\ No newline at end of file
diff --git a/changes/48314-updated-missed-abm-references b/changes/48314-updated-missed-abm-references
deleted file mode 100644
index 150aa3bc5a..0000000000
--- a/changes/48314-updated-missed-abm-references
+++ /dev/null
@@ -1 +0,0 @@
-- Updated missed ABM references to AB.
\ No newline at end of file
diff --git a/changes/48342-edit-config-profile-endpoint b/changes/48342-edit-config-profile-endpoint
deleted file mode 100644
index edf287571e..0000000000
--- a/changes/48342-edit-config-profile-endpoint
+++ /dev/null
@@ -1 +0,0 @@
-* Added support for editing existing configuration profiles (Apple `.mobileconfig`, Apple DDM declarations, Windows, and Android) in place via `PATCH /api/v1/fleet/configuration_profiles/:profile_uuid`.
diff --git a/changes/48349-windows-batch-modify-async b/changes/48349-windows-batch-modify-async
deleted file mode 100644
index f8a22fe460..0000000000
--- a/changes/48349-windows-batch-modify-async
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a timeout when editing existing Windows configuration profiles for a large team via `POST /api/latest/fleet/mdm/profiles/batch` (GitOps). Now the request stays fast regardless of host count.
diff --git a/changes/4842-search-public-ip b/changes/4842-search-public-ip
deleted file mode 100644
index e1eedd04d2..0000000000
--- a/changes/4842-search-public-ip
+++ /dev/null
@@ -1 +0,0 @@
-- Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.
diff --git a/changes/48448-remove-bomutils-docker b/changes/48448-remove-bomutils-docker
deleted file mode 100644
index 4483e93bd9..0000000000
--- a/changes/48448-remove-bomutils-docker
+++ /dev/null
@@ -1 +0,0 @@
-- Removed the `fleetdm/bomutils` Docker dependency for generating macOS `.pkg` fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so `fleetctl package --type pkg` no longer requires Docker, `mkbom`, or `xar`.
diff --git a/changes/48485-hide-install-all-on-all-category b/changes/48485-hide-install-all-on-all-category
deleted file mode 100644
index 50525d43b7..0000000000
--- a/changes/48485-hide-install-all-on-all-category
+++ /dev/null
@@ -1 +0,0 @@
-- Hid the Self-service "Install all" button on the unfiltered "All" category so end users can't queue an install of the entire catalog in one click. The button still appears when a specific category is selected.
diff --git a/changes/48486-scep-renew b/changes/48486-scep-renew
deleted file mode 100644
index a3770497dc..0000000000
--- a/changes/48486-scep-renew
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed a bug where Apple MDM devices re-enrolling manually with a pending SCEP renewal would not be treated as a new renewal and might skip apps, profiles, etc
diff --git a/changes/48497-cron-interrupted-run-status b/changes/48497-cron-interrupted-run-status
deleted file mode 100644
index ec573cbc06..0000000000
--- a/changes/48497-cron-interrupted-run-status
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed cron jobs getting stuck in "expired" when a run is interrupted mid-flight (e.g. during server shutdown); the run now records a terminal "canceled" status, preserving any job errors, instead of being left "pending" until reaped to "expired".
diff --git a/changes/48531-dark-mode-hover-state b/changes/48531-dark-mode-hover-state
deleted file mode 100644
index 5adf5b5435..0000000000
--- a/changes/48531-dark-mode-hover-state
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed missing hover state on buttons and dropdowns inside cards in dark mode.
diff --git a/changes/48542-table-reload-on-window-focus b/changes/48542-table-reload-on-window-focus
deleted file mode 100644
index 45f78adba8..0000000000
--- a/changes/48542-table-reload-on-window-focus
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed the policies and users tables intermittently reloading and clearing the current selection or resetting to the first page when the browser window regained focus.
diff --git a/changes/48567-user-scoped-declarations b/changes/48567-user-scoped-declarations
deleted file mode 100644
index b21978a172..0000000000
--- a/changes/48567-user-scoped-declarations
+++ /dev/null
@@ -1 +0,0 @@
-* Added support for targeting declarations to the user channel on macOS
diff --git a/changes/48614-hide-empty-self-service-categories b/changes/48614-hide-empty-self-service-categories
deleted file mode 100644
index 7a4df043f7..0000000000
--- a/changes/48614-hide-empty-self-service-categories
+++ /dev/null
@@ -1 +0,0 @@
-- Hide self-service categories that have no available software from the category filter on the **My device** page, so users only see categories they can actually install from.
diff --git a/changes/48641-policies-empty-page-after-delete b/changes/48641-policies-empty-page-after-delete
deleted file mode 100644
index c21d062f5f..0000000000
--- a/changes/48641-policies-empty-page-after-delete
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed server-side paginated tables (e.g. policies) landing on an empty state after deleting the last row on a page. The table now navigates back to a page with data instead.
diff --git a/changes/48685-mdm-enrolled-host-usage-stats b/changes/48685-mdm-enrolled-host-usage-stats
deleted file mode 100644
index 2dce02a193..0000000000
--- a/changes/48685-mdm-enrolled-host-usage-stats
+++ /dev/null
@@ -1 +0,0 @@
-- Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM.
diff --git a/changes/48752-windows-reserved-locuri-scopeless-bypass b/changes/48752-windows-reserved-locuri-scopeless-bypass
deleted file mode 100644
index c3fb825680..0000000000
--- a/changes/48752-windows-reserved-locuri-scopeless-bypass
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where a custom Windows configuration profile/command could bypass Fleet's checks by using a scope-less LocURI.
diff --git a/changes/48883-nano-queue-index b/changes/48883-nano-queue-index
deleted file mode 100644
index 6d3ca3b33a..0000000000
--- a/changes/48883-nano-queue-index
+++ /dev/null
@@ -1 +0,0 @@
-* Added better indexing for the Get Next Apple MDM command query
diff --git a/changes/48948-delete-cert-modal-overflow b/changes/48948-delete-cert-modal-overflow
deleted file mode 100644
index e7f746799f..0000000000
--- a/changes/48948-delete-cert-modal-overflow
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed long certificate names overflowing the delete certificate modal in Controls > OS settings > Certificates.
diff --git a/changes/48951-certificate-ca-dropdown-scep-only b/changes/48951-certificate-ca-dropdown-scep-only
deleted file mode 100644
index a2495cd0d0..0000000000
--- a/changes/48951-certificate-ca-dropdown-scep-only
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.
diff --git a/changes/48987-vulnerabilities-tooltip b/changes/48987-vulnerabilities-tooltip
deleted file mode 100644
index 9a4b384868..0000000000
--- a/changes/48987-vulnerabilities-tooltip
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an issue where the truncated vulnerabilities list in the Update details modal did not show a tooltip listing the remaining CVEs.
diff --git a/changes/49134-windows-esp-user-release-retry b/changes/49134-windows-esp-user-release-retry
deleted file mode 100644
index 450442c330..0000000000
--- a/changes/49134-windows-esp-user-release-retry
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed Windows Autopilot enrollments intermittently hanging on the Enrollment Status Page at "Account setup".
diff --git a/changes/49260-swupdate b/changes/49260-swupdate
deleted file mode 100644
index e10293cbce..0000000000
--- a/changes/49260-swupdate
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed an issue where devices given a mandatory update during ADE enrollment might display a failure or fail to display the update
diff --git a/changes/49297-free-tier-linux-summary-cards b/changes/49297-free-tier-linux-summary-cards
deleted file mode 100644
index 032d46aae7..0000000000
--- a/changes/49297-free-tier-linux-summary-cards
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fixed the "Missing hosts" summary card not showing on the Fleet Free dashboard when a platform other than "All" was selected.
-- Added an "Operating systems" card to the dashboard when Linux or Android is selected.
diff --git a/changes/49329-windows-discovery-request-version b/changes/49329-windows-discovery-request-version
deleted file mode 100644
index 8f0e40e347..0000000000
--- a/changes/49329-windows-discovery-request-version
+++ /dev/null
@@ -1,4 +0,0 @@
-- Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error
-  80180006 because the device's discovery `RequestVersion` (e.g. "9.0") was rejected by an exact-match
-  allow-list. Fleet now accepts any MS-MDE2 discovery `RequestVersion` at or above the minimum supported
-  version ("4.0").
diff --git a/changes/49474-fix-patch-policy-query-not-updating b/changes/49474-fix-patch-policy-query-not-updating
deleted file mode 100644
index fa5839fe9f..0000000000
--- a/changes/49474-fix-patch-policy-query-not-updating
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where pinning a Fleet-maintained app to a different version didn't update the patch policy for it.
diff --git a/changes/49475-failed-installs-reported-successful b/changes/49475-failed-installs-reported-successful
deleted file mode 100644
index 6f9526989a..0000000000
--- a/changes/49475-failed-installs-reported-successful
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where a failed software install was reported as successfully installed when the install script exited with an error but a post-install script exited successfully.
diff --git a/changes/49495-stale-fma-installer-version b/changes/49495-stale-fma-installer-version
deleted file mode 100644
index 623991d9cc..0000000000
--- a/changes/49495-stale-fma-installer-version
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed a bug where a Fleet-maintained app install could run a stale, previously-cached version after the app was auto-updated; installs (including automatic retries) now target the version Fleet currently displays.
diff --git a/changes/49756-revert-scep-challenge-printable-validation b/changes/49756-revert-scep-challenge-printable-validation
deleted file mode 100644
index d933078497..0000000000
--- a/changes/49756-revert-scep-challenge-printable-validation
+++ /dev/null
@@ -1 +0,0 @@
-- Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.
diff --git a/changes/50266-mem-optimization-cve-chart b/changes/50266-mem-optimization-cve-chart
deleted file mode 100644
index ebb9c6cf0a..0000000000
--- a/changes/50266-mem-optimization-cve-chart
+++ /dev/null
@@ -1 +0,0 @@
-* Optimized memory usage of CVE chart cron job.
diff --git a/changes/50305-improve-software-query b/changes/50305-improve-software-query
deleted file mode 100644
index 87012c7506..0000000000
--- a/changes/50305-improve-software-query
+++ /dev/null
@@ -1 +0,0 @@
-- Improved software ingestion performance by removing a full table scan of `software_titles` table.
diff --git a/changes/add-missing-error-fma-dynamic-policy b/changes/add-missing-error-fma-dynamic-policy
deleted file mode 100644
index 076817b696..0000000000
--- a/changes/add-missing-error-fma-dynamic-policy
+++ /dev/null
@@ -1 +0,0 @@
-- Added an error when `fleet_maintained_app_slug` is set on a non-patch policy in a GitOps yaml file.
diff --git a/changes/allow-network-blocking-bypass-in-prod b/changes/allow-network-blocking-bypass-in-prod
deleted file mode 100644
index b901d07fc2..0000000000
--- a/changes/allow-network-blocking-bypass-in-prod
+++ /dev/null
@@ -1 +0,0 @@
-* Added a `server_bypass_network_blocking` server config option to allow disabling all outbound network blocking protections for integration HTTP requests in production, for environments where egress is already constrained by external infrastructure.
diff --git a/changes/api-endpoints-add-reports-run b/changes/api-endpoints-add-reports-run
deleted file mode 100644
index db00e5a910..0000000000
--- a/changes/api-endpoints-add-reports-run
+++ /dev/null
@@ -1 +0,0 @@
-- Added the asynchronous live query endpoint (`POST /api/v1/fleet/reports/run`) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.
diff --git a/changes/batch-extension-label-check b/changes/batch-extension-label-check
deleted file mode 100644
index 4bc7af2bc9..0000000000
--- a/changes/batch-extension-label-check
+++ /dev/null
@@ -1 +0,0 @@
-- Improved performance of Orbit config endpoint by batching extension label-membership checks into a single database query.
diff --git a/changes/cache-pack-config-json b/changes/cache-pack-config-json
deleted file mode 100644
index 12051b08af..0000000000
--- a/changes/cache-pack-config-json
+++ /dev/null
@@ -1 +0,0 @@
-- Improved performance of host config endpoint by caching scheduled query configuration.
diff --git a/changes/cis-win10-benchmark-v4 b/changes/cis-win10-benchmark-v4
deleted file mode 100644
index 65d094b05e..0000000000
--- a/changes/cis-win10-benchmark-v4
+++ /dev/null
@@ -1 +0,0 @@
-- Updated CIS Benchmark policies for Windows 10 Enterprise to align with the CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 (added, removed, and updated policies per the v4.0.0 change history).
diff --git a/changes/fix-48277-live-results-translate-crash b/changes/fix-48277-live-results-translate-crash
deleted file mode 100644
index e22c6a27a3..0000000000
--- a/changes/fix-48277-live-results-translate-crash
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed Google Translate extension causing a 500-page when running live reports.
diff --git a/changes/fix-enroll-page-styling b/changes/fix-enroll-page-styling
deleted file mode 100644
index 35e5409be4..0000000000
--- a/changes/fix-enroll-page-styling
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed several styling issues on the end user enrollment page (BYOD info banner icon, active tab color, banner border, uneven QR code spacing) and added a "Learn more" link to the BYOD info banner. Also fixed enroll secret text incorrectly rendering in blue instead of black in the Add hosts modal.
diff --git a/changes/fix-macos-software-memory-recursive-cask-glob b/changes/fix-macos-software-memory-recursive-cask-glob
deleted file mode 100644
index 08f4f402e4..0000000000
--- a/changes/fix-macos-software-memory-recursive-cask-glob
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed high memory usage (and occasional osquery watchdog worker restarts) on macOS hosts running the `software_macos` detail query, caused by an unbounded recursive filesystem walk used to de-duplicate Homebrew casks against the `apps` table. The check now uses bounded, non-recursive globs matching the standard cask layout. This also fixes casks that ship no `.app` bundle (e.g. `gcloud-cli`) being incorrectly dropped from software inventory.
diff --git a/changes/friendly-base64-error-mobileconfig b/changes/friendly-base64-error-mobileconfig
deleted file mode 100644
index 9f9127b2eb..0000000000
--- a/changes/friendly-base64-error-mobileconfig
+++ /dev/null
@@ -1 +0,0 @@
-* Improved error message when a mobileconfig profile contains unescaped special characters (e.g. `&`, `<`, `'`, `>`) that cause illegal base64 data errors during plist parsing.
diff --git a/changes/gitops-windows-profiles-mdm-state b/changes/gitops-windows-profiles-mdm-state
deleted file mode 100644
index 5c40f39b08..0000000000
--- a/changes/gitops-windows-profiles-mdm-state
+++ /dev/null
@@ -1 +0,0 @@
-- Improved GitOps consistency by validating batch-applied Windows configuration profiles against the server's current MDM configuration state, while continuing to support previewing (dry run) a config that enables Windows MDM and applies profiles in a single run.
diff --git a/changes/my-device-applications-filter b/changes/my-device-applications-filter
deleted file mode 100644
index 3cc0812368..0000000000
--- a/changes/my-device-applications-filter
+++ /dev/null
@@ -1 +0,0 @@
-- Added the "Applications" / "Full inventory" software filter to the Fleet Desktop **My device > Software** tab for macOS hosts, matching the host details page.
diff --git a/changes/optimize-query-aggregated-stats b/changes/optimize-query-aggregated-stats
deleted file mode 100644
index 45243ba3d0..0000000000
--- a/changes/optimize-query-aggregated-stats
+++ /dev/null
@@ -1 +0,0 @@
-- Improved efficiency of the scheduled query stats aggregation cron job.
diff --git a/changes/policies-targeted-platforms-filter b/changes/policies-targeted-platforms-filter
deleted file mode 100644
index cd598bd940..0000000000
--- a/changes/policies-targeted-platforms-filter
+++ /dev/null
@@ -1,2 +0,0 @@
-* Added "Targeted platforms" column and platform filter dropdown to the Policies page.
-* Added optional `platform` query parameter to `GET /api/v1/fleet/policies` and `GET /api/v1/fleet/fleets/{id}/policies` to filter policies by targeted platform.
diff --git a/changes/scim-admin-only-access b/changes/scim-admin-only-access
deleted file mode 100644
index c94f820e56..0000000000
--- a/changes/scim-admin-only-access
+++ /dev/null
@@ -1 +0,0 @@
-Restricted SCIM endpoint access to global admin users only.
diff --git a/changes/scim-idp-associate-all-matching-hosts b/changes/scim-idp-associate-all-matching-hosts
deleted file mode 100644
index 72e8d69b04..0000000000
--- a/changes/scim-idp-associate-all-matching-hosts
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed an issue where an identity provider (IdP) user associated with multiple hosts only had IdP host vitals populated on one of them. All matching hosts are now linked when the SCIM/IdP user is created.
diff --git a/changes/stale-policy-membership-cleanup.md b/changes/stale-policy-membership-cleanup.md
deleted file mode 100644
index 00f3461e65..0000000000
--- a/changes/stale-policy-membership-cleanup.md
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed stale policy results inflating a host's failing policies count (shown in Fleet Desktop and the host's "Issues" column) after the policy no longer applied to the host (e.g. the host changed teams, or the policy's platform or label scope changed). Stale results are now cleaned up when the host reports its policy results.
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index a7898ee8fe..017d7ee4fa 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -4,11 +4,11 @@ name: fleet
 keywords:
   - fleet
   - osquery
-version: v7.0.14
+version: v7.0.15
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
-appVersion: v4.89.2
+appVersion: v4.90.0
 dependencies:
   - name: mysql
     condition: mysql.enabled
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index a4bbed7010..b73114bdc5 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -4,7 +4,7 @@ hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
 revisionHistoryLimit: 10 # Number of old ReplicaSets for Fleet deployment to retain for rollback (set to 0 for unlimited)
 imageRepository: fleetdm/fleet
-imageTag: v4.89.0 # Version of Fleet to deploy
+imageTag: v4.90.0 # Version of Fleet to deploy
 # imagePullPolicy is optional. If unset, Kubernetes defaults to IfNotPresent
 # for tagged images and Always for the :latest tag. Valid values: Always,
 # IfNotPresent, Never.
diff --git a/infrastructure/dogfood/terraform/aws/variables.tf b/infrastructure/dogfood/terraform/aws/variables.tf
index f1cea5908a..3fa119e8d4 100644
--- a/infrastructure/dogfood/terraform/aws/variables.tf
+++ b/infrastructure/dogfood/terraform/aws/variables.tf
@@ -56,7 +56,7 @@ variable "database_name" {
 
 variable "fleet_image" {
   description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.89.0"
+  default     = "fleetdm/fleet:v4.90.0"
 }
 
 variable "software_inventory" {
diff --git a/infrastructure/dogfood/terraform/gcp/variables.tf b/infrastructure/dogfood/terraform/gcp/variables.tf
index 8d322f552e..9e9c021580 100644
--- a/infrastructure/dogfood/terraform/gcp/variables.tf
+++ b/infrastructure/dogfood/terraform/gcp/variables.tf
@@ -68,7 +68,7 @@ variable "redis_mem" {
 }
 
 variable "image" {
-  default = "fleetdm/fleet:v4.89.0"
+  default = "fleetdm/fleet:v4.90.0"
 }
 
 variable "software_installers_bucket_name" {
diff --git a/tools/fleetctl-npm/package.json b/tools/fleetctl-npm/package.json
index 3f61eea3a5..134682e5f3 100644
--- a/tools/fleetctl-npm/package.json
+++ b/tools/fleetctl-npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fleetctl",
-  "version": "v4.89.0",
+  "version": "v4.90.0",
   "description": "Installer for the fleetctl CLI tool",
   "bin": {
     "fleetctl": "./run.js"