diff --git a/AGENTS.md b/AGENTS.md
index 8b89180..ca1a2b5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2232,7 +2232,7 @@ Rules:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH`.
     Complete non-interactive publish:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH; zsp publish --quiet zapstore.yaml`
-    ✅ **Published 1.6.1–1.6.8 on 2026-10-12/26** — the app's usual path is an **inline
+    ✅ **Published 1.6.1–1.7.0 on 2026-10-12/26** — the app's usual path is an **inline
     `SIGN_WITH=<nsec1…>`** (the value lives only in the shell/history, never in
     the repo); verify the signer is the app identity first (`nak key public` →
     `npub1yrnuj…` / hex `20e7c953…`). Use **`~/go/bin/zsp`** (v0.4.11) — the
diff --git a/package-lock.json b/package-lock.json
index 6cb872b..24e3b23 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.6.8",
+  "version": "1.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.6.8",
+      "version": "1.7.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",
diff --git a/package.json b/package.json
index bd42ea2..20165a6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.6.8",
+  "version": "1.7.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",
diff --git a/release-notes.txt b/release-notes.txt
index 126a578..5fbbea2 100644
--- a/release-notes.txt
+++ b/release-notes.txt
@@ -1,3 +1,25 @@
+🗺 The map is authoritative again
+- Spots and shops on the map now come only from the SkateSpots community relay,
+  so everyone sees the same pins — and it fixes the empty map some of you hit.
+- A missing spot was restored to the community relay.
+
+📲 Pass SkateSpots on
+- On Android, the About page now has a "Share SkateSpots" card: show a QR, use
+  the share sheet, or write the install link to an NFC tag.
+
+🔑 A clearer way in
+- Sign-in now leads with three plain choices — browser extension, signer app, or
+  sign in with your phone — plus a quiet secret-key option.
+- On desktop the welcome sign-in appears once per session for logged-out
+  visitors (dismissible).
+
+🛡 Security & stability
+- Updated core libraries (router, validation, Nostr client) and cleared the
+  known app-facing vulnerabilities; the dependency scanner now runs in the
+  scheduled job too.
+
+---
+
 🔑 A clearer way in
 - Sign-in now leads with three clear choices — browser extension, signer app
   (bunker/Amber), or scan a code to sign in with your phone — plus a quiet