diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1dfef51..ccb7950 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ replacing a module has to be a decision with visible consequences.
 
 ## Unreleased
 
+## 0.5.2
+
+- **The image takes Debian's zlib security fix** (zlib1g CVE-2026-76844 and CVE-2026-85091,
+  fixed in 1:1.3.dfsg+really1.3.1-1+deb13u1). Rebuild only, no code change.
+
 ## 0.5.1
 
 - **The image takes Debian's security fixes newer than its base** (apt, CVE-2026-109518).
diff --git a/systemgate/main.py b/systemgate/main.py
index 7d42d51..97ab242 100644
--- a/systemgate/main.py
+++ b/systemgate/main.py
@@ -85,7 +85,7 @@ async def lifespan(app: FastAPI):
 
 # One place, so /health and the OpenAPI document cannot disagree about
 # which version is running. They had: /health said 0.1.0 at tag v0.2.1.
-SERVICE_VERSION = "0.5.1"
+SERVICE_VERSION = "0.5.2"
 
 app = FastAPI(title="SystemGate", version=SERVICE_VERSION, lifespan=lifespan)