diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2d006ef..4e65d0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 ## Changelog
 
+### v0.126.2 — stylesheet cache-bust (2026-07-13)
+
+0.126.1 live QA: Cloudflare edge-caches `/static/style.css` for 4h (`Cf-Cache-Status: HIT`), so
+every controller release kept serving the PREVIOUS release's CSS to customers until TTL. The
+stylesheet link now carries `?v={{.Version}}` — busts automatically on every release (the same
+gotcha class as the hub v0.47.0 /style.css finding, now extinct on the controller too).
+
 ### v0.126.1 — .form-input/.form-row finally have CSS (2026-07-13)
 
 Live QA on 0.126.0 (drill box) showed the .fab password field STILL browser-default: the
diff --git a/controller/internal/web/templates/layout.html b/controller/internal/web/templates/layout.html
index 7eeed11..fe4b260 100644
--- a/controller/internal/web/templates/layout.html
+++ b/controller/internal/web/templates/layout.html
@@ -6,7 +6,10 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{.Title}} — Felhom.eu</title>
     <link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
-    <link rel="stylesheet" href="/static/style.css">
+    {{/* ?v= cache-bust: Cloudflare edge-caches /static/* for 4h — an unversioned URL keeps
+         serving the PREVIOUS release's CSS after a deploy (0.126.1 live QA hit this). The
+         controller version busts it automatically on every release. */}}
+    <link rel="stylesheet" href="/static/style.css?v={{.Version}}">
     <meta name="csrf-token" content="{{.CSRFToken}}">
     <script>
     function csrfHeaders(){var el=document.querySelector('meta[name="csrf-token"]');return el?{'X-CSRF-Token':el.content}:{};}