diff --git a/CHANGELOG.md b/CHANGELOG.md
index 565ee21..d91de72 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,37 @@
+## v0.322.0 — the hub key opens no route on the box; Go 1.27.2; two Data tab leftovers; the install form's dead branches (2026-10-16)
+
+**MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task:
+burndown 2 (felhom.eu `REPORT-burndown2-2026-10-16.md`).
+
+- **R-970 — the box's own hub API key opens no route.** `/api/config`, `/api/config/hash`, `/api/config/apply` are
+  removed: they read `controller.yaml` with every secret in it and replaced it, reachable with the hub key as a Bearer
+  token, unsigned — against `01-topology-and-trust.md` §4/§10. Nothing called them (the hub never connects to a box).
+  The hub-key door on `/api/selfupdate/` and `/api/geo/` is gone too (the dashboard keeps using them with a session),
+  and with it the CSRF exemption for that key. The route table is `buildMux`, so `TestR970_HubKeyOpensNoDoor` drives
+  the real one: every method on every former door, with the key and no session, is refused and the planted settings
+  file is neither served nor changed. Also `TestR970_ConfigRoutesAreGone`, `TestR970_HubKeyIsNoCSRFExemption`; each
+  red-proved. Retired with the route: the three `TestConfigApply_*` tests and `config_perms_test.go`.
+- **R-972 — Go 1.27.2** (was 1.24.13, no security fixes left), golang.org/x/crypto v0.58.0 (was v0.31.0). The builder
+  `golang:1.27.2-trixie`, the runtime `debian:12.13-slim` (was `bookworm-slim`), both pinned by digest, plus
+  `apt-get upgrade` in the build. **The runtime stays on Debian 12 on purpose:** Debian 13 ships restic 0.18.0, and the
+  off-site engine's measured behaviour is restic 0.14.0's — that move is R-1105 with its own re-proof. Scanner,
+  controller image: critical 16 → 6 (fixable 12 → 2 before the upgrade line), high fixable 64 → 12; the binary's
+  govulncheck 62 → 1 (a module-level note on `x/crypto/openpgp`, which is not linked).
+- **Data tab:** the export password field is `autocomplete="new-password"` with a non-login name (the browser filled
+  the saved dashboard password into it); the 2nd copy's status rows that repeated the form are gone — the no-target
+  reason moved into the form.
+- **R-1103:** `app_fields.html` loses its installed-only branches (no page serves them since R-1095). Retired, each
+  with where its rule lives now: `TestDeployPage_DeployedApp_DoesNotCarryTheSecret` → `TestAppPage_LoginPairPanel`
+  + `TestR255_NoPlantedSecretReachesAnyPage`; `TestR709_AnInstalledAppsPasswordIsNotInThePage` → the same two, its
+  install-form half kept as `TestR709_TheInstallFormKeepsItsGenerator`; `TestR694_TheDeployPageDoesNotOfferAGeneratedLogin`
+  → `TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin` (red-proved); parity cases `deploy_installed` and
+  `deploy_installed_restored` removed.
+- Parity fixtures re-captured (8): `app_data_deployed`, `app_data_export`, `app_data_notarget_disabled`,
+  `app_data_target_auto`, `app_data_target_ssd` (the rows, the export key), `deploy_new`, `deploy_new_blocked`
+  (whitespace only — proven by comparing with all whitespace removed), `deploy_new_memory_blocked` (whitespace, and
+  the „not available" drive option its test data set for a NOT-installed app, which production never does). Every
+  other fixture byte-identical.
+
 ## v0.321.0 — FileBrowser's stale password and its own banners, one backup section on the Data tab, the install address of an installed app (2026-10-16)
 
 **MinAgent: 0.158.1** — the floor's, carried from v0.320.0. Nothing here calls the agent. No golden (`09` §3 decision
diff --git a/controller/Dockerfile b/controller/Dockerfile
index 6c64814..18f11c3 100644
--- a/controller/Dockerfile
+++ b/controller/Dockerfile
@@ -64,7 +64,9 @@ FROM debian:12.13-slim@sha256:67b30a61dc87758f0caf819646104f29ecbda97d920aaf5edc
 # - openssh-client: restic's sftp backend shells out to `ssh` (the SFTP transport); also ssh-copy-id/sftp
 #   for the SLICE-2 offsite apply-bridge key install
 # - sshpass: feeds the one-time storage-box password to ssh-copy-id -s -f (offsite apply-bridge)
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# R-972: `apt-get upgrade` first — the Debian security fixes newer than the base image's point release (gnutls, pcre2,
+# libcap2 were fixable on 12.13 on 2026-10-16). Within Debian 12 only, so restic stays 0.14.0.
+RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
     gnupg \