diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69b2cf8..574a868 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,26 @@
+## The six versions the twenty-eight proved go live (2026-09-22, R-462)
+
+Operator-approved from `DRILL-the-28-2026-09-22.md`'s promotion list. One commit per app,
+`catalog_since: "2026-09-22"` on each, every gate run before each commit.
+
+| app | move |
+|---|---|
+| emby | `4.10.0.20` -> `4.11.0.1` |
+| ghost | `6.53.0-alpine` -> `6.64.0-alpine` |
+| immich | `v3.0.3` -> `v3.2.2` |
+| radarr | `6.3.0` -> `6.4.4` |
+| sonarr | `4.0.19` -> `4.0.20` |
+| termix | `2.5.0` -> `2.8.0` |
+
+Each was walked on scratch guest 9202 through the product's own guarded Update, **seeded and read
+back through the app's own front door both before and after**, and then restored from its own copy.
+Every `to` tag was re-resolved against its registry immediately before the move.
+
+**None of the six is installed on either demo box** (checked, not assumed: demo-hp runs
+adventurelog, bentopdf, bookstack, calibre-web, docmost, kimai, opengist, paperless-ngx, privatebin
+and romm; demo-felhom runs opengist). So these moves change a badge and nothing else until a
+household presses Update.
+
 ## romm runs TWO web workers, not four — the actual cause (2026-09-22, R-635)
 
 `WEB_SERVER_CONCURRENCY=2`, with the limit left at the 768M of the previous entry. **No `image:`