diff --git a/neode-ui/src/views/Settings.vue b/neode-ui/src/views/Settings.vue
index b191c8f3..6e71a42c 100644
--- a/neode-ui/src/views/Settings.vue
+++ b/neode-ui/src/views/Settings.vue
@@ -68,40 +68,115 @@
           <Transition name="modal">
             <div v-if="showReleaseNotes" class="fixed inset-0 z-[3000] flex items-center justify-center p-4" @click="showReleaseNotes = false">
               <div class="absolute inset-0 bg-black/60 backdrop-blur-sm"></div>
-              <div @click.stop class="glass-card p-6 max-w-lg w-full relative z-10 max-h-[80vh] overflow-y-auto">
-                <div class="flex items-start justify-between gap-4 mb-5">
-                  <h3 class="text-xl font-semibold text-white">What's New in {{ version }}</h3>
+              <div @click.stop class="glass-card p-6 max-w-lg w-full relative z-10 flex flex-col" style="max-height: 85vh">
+                <div class="flex items-start justify-between gap-4 mb-5 shrink-0">
+                  <h3 class="text-xl font-semibold text-white">What's New</h3>
                   <button @click="showReleaseNotes = false" class="p-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors" aria-label="Close">
                     <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" /></svg>
                   </button>
                 </div>
-                <div class="space-y-4 text-sm text-white/80">
+                <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+                  <!-- alpha.9 — Current -->
                   <div>
-                    <h4 class="text-white font-medium mb-1">Mesh Radio Connection</h4>
-                    <p>Your LoRa mesh radio now connects reliably every time. If the USB port changes, the system automatically finds the device. A new "Connect" button lets you pick which radio to use.</p>
+                    <div class="flex items-center gap-2 mb-3">
+                      <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.2.0-alpha.9</span>
+                      <span class="text-xs text-white/40">Mar 18, 2026</span>
+                    </div>
+                    <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Security Hardening Complete</h4>
+                        <p>All 12 pentest findings fixed. CSRF tokens now survive restarts. Password hashing upgraded to Argon2id. Bitcoin RPC gets a unique random password on every install. Federation messages require ed25519 signatures.</p>
+                      </div>
+                      <div>
+                        <h4 class="text-white font-medium mb-1">7 Bugs Squashed</h4>
+                        <p>Random logouts fixed (P0). Uninstall dialog is now a proper full-screen modal with an "Uninstalling..." overlay. App cards no longer flicker between Start/Launch during container scans. ElectrumX index estimate corrected.</p>
+                      </div>
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Bitcoin Sync on Dashboard</h4>
+                        <p>Homepage System card now shows Bitcoin Core sync progress, block height, and green/orange status indicator when Bitcoin is running.</p>
+                      </div>
+                    </div>
                   </div>
+
+                  <!-- alpha.8 -->
                   <div>
-                    <h4 class="text-white font-medium mb-1">Rock-Solid Containers</h4>
-                    <p>Fixed crash loops that were causing apps to restart thousands of times. All containers now start cleanly and stay stable across reboots.</p>
+                    <div class="flex items-center gap-2 mb-3">
+                      <span class="text-xs font-mono px-2 py-0.5 rounded bg-white/10 text-white/60">v1.2.0-alpha.8</span>
+                      <span class="text-xs text-white/40">Mar 18, 2026</span>
+                    </div>
+                    <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Pentest Remediation (9/12)</h4>
+                        <p>Fixed 9 of 12 security findings: session auth on LND connect info, DEV_MODE removed from production, ed25519 signature verification on node messages, path traversal protection, NIP-07 origin validation, AIUI session checks, strict onion validation.</p>
+                      </div>
+                      <div>
+                        <h4 class="text-white font-medium mb-1">UI Polish Batch</h4>
+                        <p>Fedimint renamed to "Fedimint Guardian". Tab-launch icons. Marketplace sorts installed apps to end. Mesh mobile layout fixed. On-Chain first in receive modals. Federation shows names instead of DIDs. Cleaner iframe error screens.</p>
+                      </div>
+                    </div>
                   </div>
+
+                  <!-- alpha.7 -->
                   <div>
-                    <h4 class="text-white font-medium mb-1">Smarter App Store</h4>
-                    <p>Apps that are still starting up now show their progress instead of appearing as available to install again. No more accidentally re-installing running apps.</p>
+                    <div class="flex items-center gap-2 mb-3">
+                      <span class="text-xs font-mono px-2 py-0.5 rounded bg-white/10 text-white/60">v1.2.0-alpha.7</span>
+                      <span class="text-xs text-white/40">Mar 18, 2026</span>
+                    </div>
+                    <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Marketplace & Credentials</h4>
+                        <p>29 containers running rootless. Marketplace app aliases working. Credential injection for inter-container authentication.</p>
+                      </div>
+                    </div>
                   </div>
+
+                  <!-- alpha.4–6 -->
                   <div>
-                    <h4 class="text-white font-medium mb-1">Security Hardening</h4>
-                    <p>Backend services now run with strict sandboxing: read-only filesystem, restricted system calls, and least-privilege access. Your node is locked down by default.</p>
+                    <div class="flex items-center gap-2 mb-3">
+                      <span class="text-xs font-mono px-2 py-0.5 rounded bg-white/10 text-white/60">v1.2.0-alpha.4–6</span>
+                      <span class="text-xs text-white/40">Mar 18, 2026</span>
+                    </div>
+                    <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Rootless Podman Migration</h4>
+                        <p>Migrated all containers from root to rootless Podman. UID namespace mapping, volume ownership fixes, sysctl tuning. Bitcoin RPC verified, all web services confirmed healthy. 29 containers up and running.</p>
+                      </div>
+                    </div>
                   </div>
+
+                  <!-- alpha.2–3 -->
                   <div>
-                    <h4 class="text-white font-medium mb-1">Tor by Default</h4>
-                    <p>Bitcoin and Lightning now route through Tor automatically for maximum privacy. Your node's network traffic is protected out of the box.</p>
+                    <div class="flex items-center gap-2 mb-3">
+                      <span class="text-xs font-mono px-2 py-0.5 rounded bg-white/10 text-white/60">v1.2.0-alpha.2–3</span>
+                      <span class="text-xs text-white/40">Mar 18, 2026</span>
+                    </div>
+                    <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Systemd Hardening Restored</h4>
+                        <p>Full systemd security sandbox restored now that containers run rootless. NoNewPrivileges, restricted namespaces, and system call filtering re-enabled. Session persistence and boot sequence fixes.</p>
+                      </div>
+                    </div>
                   </div>
+
+                  <!-- alpha.1 -->
                   <div>
-                    <h4 class="text-white font-medium mb-1">Off-Grid Bitcoin</h4>
-                    <p>Receive Bitcoin block headers over mesh radio. A dead man's switch can broadcast your location to trusted contacts if you go silent. GPS sharing is opt-in only.</p>
+                    <div class="flex items-center gap-2 mb-3">
+                      <span class="text-xs font-mono px-2 py-0.5 rounded bg-white/10 text-white/60">v1.2.0-alpha.1</span>
+                      <span class="text-xs text-white/40">Mar 18, 2026</span>
+                    </div>
+                    <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Mesh Radio & Container Stability</h4>
+                        <p>LoRa mesh radio auto-detects USB port changes with a new Connect button. Fixed container crash loops — all apps start cleanly and stay stable. Apps starting up show progress instead of re-appearing in the store. Tor routing enabled by default for Bitcoin and Lightning.</p>
+                      </div>
+                      <div>
+                        <h4 class="text-white font-medium mb-1">Off-Grid Bitcoin</h4>
+                        <p>Receive Bitcoin block headers over mesh radio. Dead man's switch broadcasts location to trusted contacts if you go silent. GPS sharing is opt-in only.</p>
+                      </div>
+                    </div>
                   </div>
                 </div>
-                <button @click="showReleaseNotes = false" class="glass-button w-full mt-6 py-2 text-sm">Close</button>
+                <button @click="showReleaseNotes = false" class="glass-button w-full mt-4 py-2 text-sm shrink-0">Close</button>
               </div>
             </div>
           </Transition>