diff --git a/README.md b/README.md
index 21e04bf..15e8119 100644
--- a/README.md
+++ b/README.md
@@ -141,7 +141,7 @@ Notes:
 
 - **Exactly one instance.** The relay keeps the list of connected browsers in memory; with several instances, analysts on different instances would not see each other. Do not scale out.
 - **Web sockets must be on**, otherwise the board stays offline. **Always On** prevents the app from idling and dropping connections.
-- Prefer a pinned version (`k3mpaxl/factgraph:0.5.3`) over `latest` during an incident, so a restart never changes the version.
+- Prefer a pinned version (`k3mpaxl/factgraph:0.5.4`) over `latest` during an incident, so a restart never changes the version.
 - App Service **HTTP logging** is off by default. If you enable it, it records request URLs, which contain board IDs.
 - **WebSocket limits per plan:** every open FactGraph tab holds one connection. App Service allows 5 per instance on **F1 (Free)**, 35 on Shared and 350 from **B1**; above the limit, browsers get HTTP 429 and stay offline. Use B1 or higher. Browsers send a heartbeat, and the server closes connections that stay silent (closed laptops, changed networks), so slots are freed without restarting the app.
 - **App Service Authentication** (Entra ID sign-in) can be put in front of the UI. Agents and scripts then also need an Entra token, and if the incident involves your own tenant, an identity provider you cannot trust is no protection. IP access restrictions are often the better choice there.
@@ -469,8 +469,8 @@ cd web && npm run build && DOCS_SCREENSHOTS=1 npx playwright test e2e/docs-scree
 - **Publish Docker image** builds the image for `linux/amd64` and `linux/arm64` on a version tag (`v*.*.*`) or via **Run workflow**, and publishes it as `latest` and with the version number. It requires the repository secrets `DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` (a Docker Hub access token with write permission).
 
 ```bash
-git tag v0.5.3
-git push origin v0.5.3
+git tag v0.5.4
+git push origin v0.5.4
 ```
 
 A manual multi-arch build is possible with `./deploy/publish-multiarch.sh` (`FACTGRAPH_IMAGE` and `FACTGRAPH_VERSION` override namespace and version).
diff --git a/app/main.py b/app/main.py
index cede776..45e51fe 100644
--- a/app/main.py
+++ b/app/main.py
@@ -58,9 +58,9 @@
 Times: ISO 8601; a time without a zone is UTC. Compromise marks you set are "suspected" unless you pass level "confirmed" and the evidence proves it.
 Tool profile: this server shows a compact agent tool set by default; with FACTGRAPH_MCP_TOOLS=full it exposes one rest_<operation> tool per REST endpoint instead.
 """
-mcp = FastMCP("FactGraph Browser Boards", version="0.5.3", instructions=MCP_INSTRUCTIONS)
+mcp = FastMCP("FactGraph Browser Boards", version="0.5.4", instructions=MCP_INSTRUCTIONS)
 mcp_app = mcp.http_app(path="/")
-app = FastAPI(title="FactGraph API", version="0.5.3", lifespan=mcp_app.lifespan)
+app = FastAPI(title="FactGraph API", version="0.5.4", lifespan=mcp_app.lifespan)
 
 
 @dataclass
diff --git a/deploy/publish-multiarch.sh b/deploy/publish-multiarch.sh
index 01d8bb1..180b4d5 100755
--- a/deploy/publish-multiarch.sh
+++ b/deploy/publish-multiarch.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 image="${FACTGRAPH_IMAGE:-k3mpaxl/factgraph}"
-version="${FACTGRAPH_VERSION:-0.5.3}"
+version="${FACTGRAPH_VERSION:-0.5.4}"
 
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
diff --git a/web/package-lock.json b/web/package-lock.json
index 8208992..893e741 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "factgraph-web",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "factgraph-web",
-      "version": "0.5.3",
+      "version": "0.5.4",
       "dependencies": {
         "@xyflow/react": "^12.12.0",
         "d3-force": "^3.0.0",
diff --git a/web/package.json b/web/package.json
index 4ba2a89..bc71fb4 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "factgraph-web",
   "private": true,
-  "version": "0.5.3",
+  "version": "0.5.4",
   "type": "module",
   "scripts": {
     "dev": "vite --host 127.0.0.1",