diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index c9b5d4deeb..de306769f0 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,18 @@
 # Compatibility Contract
 
+## Server v1.6.521 published
+
+The [official release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
+is the immutable image
+`ghcr.io/pasturestack/server:v1.6.521@sha256:bd368b3ac58c7b161442906241aa7ef2a41360a164cb3ca181d0b84742fb2194`.
+It packages Web Console `1.6.181` and Orchestration Engine `v0.183.337`.
+The image has 22 layers; publication identifies producer
+`d478d917f989903dafc6bb834b7f9017126a68bd` and protected-main merge
+`d0d1b417833c25e4a6b765e27e3a52f450d7c0e1`.
+See the [release note](docs/releases/server-1.6.521.md) for audit identity scope.
+Install examples use the published numeric tag; immutable identities stay in
+release records. This is not C-03, C-05 live or full-matrix acceptance.
+
 ## Server v1.6.518 published
 
 Immutable image:
diff --git a/README.md b/README.md
index eac088ea09..b1b22d3328 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,8 @@ stack and resource selectors close before dependent loading or verification.
 Failed Key edits use a consistent public Key ID in audit records. Per-Key audit
 also reads historical numeric-ID records within the same ownership and environment
 authorization checks; existing records are not rewritten.
-See the [release note](docs/releases/server-1.6.521.md) for exact
+See the [published v1.6.521 release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
+and [release note](docs/releases/server-1.6.521.md) for exact
 component identities and verification boundaries. A version or packaged feature
 does not establish that every resource/role/hardware combination has been tested.
 
diff --git a/docs/README.md b/docs/README.md
index 59ee69192d..2e0ccfe4d2 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,6 +7,13 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.521](releases/server-1.6.521.md) — officially published with
+  Engine `0.183.337` and Web Console `1.6.181`; canonical API Key audit identifiers
+  and historical numeric-ID reads retain ownership and environment checks.
+  [Official release](https://github.com/PastureStack/server/releases/tag/v1.6.521).
+  Component and scoped evidence do not establish C-03, C-05 live or full-matrix
+  acceptance; exact identities and limits remain in the versioned release note.
+
 - [Server v1.6.518](releases/server-1.6.518.md) — officially published with Catalog v0.3.13 / Network Plugin Manager v0.8.22 CNI configuration migration fixes, Web Console 1.6.180 / audit broker full-retained-time query and export, and the official FreeType security fix; artifact readback and scoped isolated-QA deployment/read-only checks verified. Known limits remain in the release note.
 
 - [Server v1.6.517](releases/server-1.6.517.md) — officially published with Web Console 1.6.179; isolated start/restart, browser login and focused API acceptance passed. Known limits remain in the versioned release note.
diff --git a/docs/performance/README.md b/docs/performance/README.md
index 2924dc7dec..9c36c507f9 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -11,7 +11,7 @@ profile; measure the real workload before increasing it further.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.518
+    image: ghcr.io/pasturestack/server:v1.6.521
     restart: unless-stopped
     ports:
       - "8080:8080"
diff --git a/docs/releases/server-1.6.521.md b/docs/releases/server-1.6.521.md
index 692b8f16e6..052ce14b9d 100644
--- a/docs/releases/server-1.6.521.md
+++ b/docs/releases/server-1.6.521.md
@@ -2,6 +2,14 @@
 
 Packages Engine `v0.183.337` and unchanged Web Console `1.6.181`.
 
+## Published identity
+
+The [official v1.6.521 release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
+identifies the immutable image
+`ghcr.io/pasturestack/server:v1.6.521@sha256:bd368b3ac58c7b161442906241aa7ef2a41360a164cb3ca181d0b84742fb2194`,
+with 22 layers, from producer `d478d917f989903dafc6bb834b7f9017126a68bd`.
+This publication identity does not establish full functional-matrix acceptance.
+
 ## API Key audit identity
 
 Rejected Key edits after request validation could be recorded under an internal