diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1768c95..0cc1156c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,17 @@ Pithead ships as **one product, one version** — the version lives in the top-l
 [`VERSION`](VERSION) file and every released image is tagged with it. Releases are cut
 per the process in [`docs/dev/releasing.md`](docs/dev/releasing.md).
 
-## [1.18.0] - 2026-08-13
+## [1.18.1] - 2026-08-14
+
+Supersedes 1.18.0, withdrawn before general adoption. Investigating its missing bundle signature
+surfaced the real state: release signing (#376) had never engaged — the key pair was generated on
+the release box but `cosign.pub` was never committed, so every release to date shipped its bundle
+unsigned and no install holds a key to verify with. 1.18.1 draws the line: it commits
+`cosign.pub`, carries every 1.18.0 change, and is the first release signed end to end. Installs
+that upgrade to it come out holding the key and verify every release after; immutable release
+assets mean 1.18.0 itself can never be amended, hence the new number.
+
+## [1.18.0] - 2026-08-13 (withdrawn — unsigned install bundle; use 1.18.1)
 
 ### Added
 
diff --git a/VERSION b/VERSION
index 84cc5294..ec6d649b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.18.0
+1.18.1
diff --git a/build/dashboard/pyproject.toml b/build/dashboard/pyproject.toml
index 68d3d3ef..f0a91b61 100644
--- a/build/dashboard/pyproject.toml
+++ b/build/dashboard/pyproject.toml
@@ -7,7 +7,7 @@ name = "mining-dashboard"
 # Keep in lockstep with the top-level VERSION file — the single source of truth for the stack version
 # (#44). A shell test (tests/stack/run.sh) fails if these drift; the dashboard *displays* the version
 # from VERSION (baked in as PITHEAD_VERSION, #58), so this is packaging metadata only.
-version = "1.18.0"
+version = "1.18.1"
 description = "Monitoring dashboard and XvB switching engine for Pithead"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/build/dashboard/uv.lock b/build/dashboard/uv.lock
index 775437f3..97f194a7 100644
--- a/build/dashboard/uv.lock
+++ b/build/dashboard/uv.lock
@@ -786,7 +786,7 @@ wheels = [
 
 [[package]]
 name = "mining-dashboard"
-version = "1.18.0"
+version = "1.18.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiofiles" },
diff --git a/cosign.pub b/cosign.pub
new file mode 100644
index 00000000..92a2d11c
--- /dev/null
+++ b/cosign.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEe1TGGjQyKKDDFtBmAU6Vg3egDXTA
+9gVysXBv+ppF9f7u4LL/5uf28n8bc6pyJjqpUxkRfJYc/eKFts0ho6HEEQ==
+-----END PUBLIC KEY-----