diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4e4de399e..ed71ee3e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,41 @@
 # Changelog
 
+## [1.38.24] — 2026-09-16
+
+Insights loads when the assistant is switched off, and the bundled
+database no longer ages behind its own security fixes.
+
+### Fixed
+
+- **Insights loads with the assistant switched off.** An operator who turned
+  the assistant off on the server got an error in place of the whole Insights
+  overview. Its main read and several tiles were tied to the assistant switch
+  even though none of them uses a model, so the derived tiles, the ECG list and
+  the device-flagged rhythm events stayed dark, and a watch ECG sent from the
+  phone was refused. These reads follow the Insights module now, and the parts
+  a model writes still disappear when the assistant is off. Thanks to
+  @CritLoren for the log in #975 that showed which requests failed.
+- **The trends row leaves mood out when the mood module is off.** Switching
+  the mood module off already hid the Mood tab on Insights, but the overview
+  still drew a mood chart in its trends row. It skips mood now, the same way
+  the tab strip does.
+
+### Changed
+
+- **The bundled database moves to PostgreSQL 16.15, and stays current from
+  here.** The compose file pinned 16.14, and the pin is deliberate: a database
+  change should be something you can read before it happens. What was missing
+  was anything watching it, so it sat five weeks behind a release that carried
+  security and data-corruption fixes. New PostgreSQL minor releases now arrive
+  as an update we review and ship. Upgrading within PostgreSQL 16 needs no dump
+  or restore. If you run your own PostgreSQL instead of the bundled one,
+  nothing here affects you. Thanks to @tarantila for #987.
+- **Supply chain.** The container scanner's installer is fetched from a commit
+  and checked against its hash before it runs, PostgreSQL major versions no
+  longer arrive as automatic update proposals, and the app moves to nodemailer
+  10 along with updates to sax, sonner, jose, the canvas renderer and the
+  virtual-list helper. Nothing changes in how the app behaves.
+
 ## [1.38.23] — 2026-09-15
 
 Connecting an AI assistant through MCP works in Chrome and Edge again, and
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index a2de22e9a..fcadfa331 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.38.23
+  version: 1.38.24
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index 53cb39e02..67bb09461 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.38.23",
+  "version": "1.38.24",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index c5bf23928..a71c1ec3e 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.38.23";
+  /* @sw-version-fallback */ "v1.38.24";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`