diff --git a/package-lock.json b/package-lock.json
index 0a46a99..f52c793 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.7.39",
+  "version": "1.7.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.7.39",
+      "version": "1.7.40",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",
diff --git a/package.json b/package.json
index 77d0f6d..b7052bd 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.7.39",
+  "version": "1.7.40",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",
diff --git a/release-notes.txt b/release-notes.txt
index 354f624..98ffcc4 100644
--- a/release-notes.txt
+++ b/release-notes.txt
@@ -1,3 +1,12 @@
+🩹 Fix native white/black reload loop
+- Native installs now clear any old app-shell service worker and
+  `skate-spots-shell-*` cache from `https://localhost` before the bundle runs.
+  A stale worker could serve an old index.html whose hashed chunks no longer
+  existed, causing the white/black reload loop after an upgrade.
+- Web installs are unchanged; the app-shell worker still updates normally.
+
+---
+
 🧪 Zero known production vulnerabilities + profile services
 - Replaced the write-only SheetJS xlsx package with a small local OOXML writer.
   `npm audit --omit=dev` is now **0 vulnerabilities**.