diff --git a/CHANGELOG.md b/CHANGELOG.md
index 36d035c..9c51214 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,14 @@
+## v0.92.1 — ship the guestnet sudoers grant with the binary (supersedes v0.92.0) (2026-07-21)
+
+**Supersedes v0.92.0; that artifact is materially incomplete — do not vouch it.** It was published
+before live verification revealed the watchdog had no sudoers grant for three of its four probes,
+so it carries neither the `FELHOM_GUESTNET` alias nor the `guestnet-*` capability rows that make a
+host missing that alias visible. Left in place rather than overwritten — a published version stays
+immutable (the v0.91.0 → v0.91.1 precedent).
+
+No behaviour change beyond the capability rows; the watchdog code is byte-identical to v0.92.0. The
+functional fix is `configs/felhom-agent.sudoers`, which **must be deployed with the binary**.
+
 ## v0.92.0 — the guest network gets a watchdog (R-54) (2026-07-21)
 
 **Host-tier only — no controller coupling, no wire change the hub must understand today** (the
diff --git a/cmd/felhom-agent/main.go b/cmd/felhom-agent/main.go
index c9c8fdd..74af922 100644
--- a/cmd/felhom-agent/main.go
+++ b/cmd/felhom-agent/main.go
@@ -58,7 +58,7 @@ import (
 
 // version is the agent version. Overridable at build time with
 // -ldflags "-X main.version=<v>"; defaults to the in-repo CHANGELOG version.
-var version = "0.92.0"
+var version = "0.92.1"
 
 // runGuestHook is the PVE hook body (`felhom-agent guest-hook <vmid> <phase>`). On pre-start it
 // creates placeholder dirs for any absent bind-mount source so the guest always boots (the C1 net);