diff --git a/.github/VERSION b/.github/VERSION
index 80e78df6..95b25aee 100644
--- a/.github/VERSION
+++ b/.github/VERSION
@@ -1 +1 @@
-1.3.5
+1.3.6
diff --git a/.github/wiki/Changelog.md b/.github/wiki/Changelog.md
index febfe601..6a7d9bae 100644
--- a/.github/wiki/Changelog.md
+++ b/.github/wiki/Changelog.md
@@ -3,6 +3,33 @@
 All notable changes to the ɳSelf CLI are documented in this file. Format loosely
 follows Keep a Changelog, with Conventional Commit classification.
 
+## [1.3.6] — 2026-09-12
+
+Ships work that had merged to main but sat unreleased, including a doctor
+false-positive and three server/compose gap-closure features.
+
+### Fixed
+
+- **`nself doctor --deep`'s SEC-HARDENING-06 check fired a false CRITICAL against
+  nginx configs that do rate-limit their auth/API routes.** It only ever grepped
+  for the literal strings `/auth/login` and `/api/`, so nSelf's default one-
+  server-block-per-service layout always failed the check. It now also matches
+  by service identity (a server block's `server_name` against known auth/API
+  route names) and falls back to the original literal-path match for hand-
+  written gateway configs.
+
+### Added
+
+- **`nself server provision` / `list` / `resize` / `destroy`**: manage a
+  Hetzner server's lifecycle directly from the CLI.
+- **Custom services gain `CS_N_IMAGE`, `CS_N_ENV_FILE`, and `CS_N_VOLUMES`**,
+  extending the `CS_N_*` slots beyond image name to full env-file and volume-
+  mount configuration.
+- **`nself build`/`nself start` detect orphaned containers** (with a
+  `--remove-orphans` flag to clean them up) **and flag a compose healthcheck
+  that references a command the image doesn't have**, instead of failing
+  silently at runtime.
+
 ## [1.3.5] — 2026-08-30
 
 Infrastructure-only release. No CLI command or flag behavior changed.
diff --git a/internal/version/version.go b/internal/version/version.go
index bb9abfcd..93ec2f61 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -10,7 +10,7 @@ import (
 //
 //	go build -ldflags "-X nself/internal/version.Version=1.0.0 -X nself/internal/version.Commit=abc123 -X nself/internal/version.BuildDate=2026-01-01"
 var (
-	Version   string = "1.3.5"
+	Version   string = "1.3.6"
 	Commit    string = "unknown"
 	BuildDate string = "unknown"
 )
diff --git a/sdk/go/doc.go b/sdk/go/doc.go
index ec06e200..621aeb9b 100644
--- a/sdk/go/doc.go
+++ b/sdk/go/doc.go
@@ -97,4 +97,4 @@ package sdk
 //
 // This value is updated by the sdk-version-sync workflow on every CLI tag
 // to keep SDK and CLI versions in lockstep.
-const Version = "1.3.5"
+const Version = "1.3.6"
diff --git a/sdk/py/pyproject.toml b/sdk/py/pyproject.toml
index 8c7950f8..b8ec1ae0 100644
--- a/sdk/py/pyproject.toml
+++ b/sdk/py/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nself-plugin-sdk"
-version = "1.3.5"
+version = "1.3.6"
 description = "Python plugin authoring SDK for nSelf. Parity with the Go SDK at github.com/nself-org/cli/sdk/go."
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/sdk/ts-sdk/package.json b/sdk/ts-sdk/package.json
index 537660fc..9a860868 100644
--- a/sdk/ts-sdk/package.json
+++ b/sdk/ts-sdk/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@nself/sdk",
-  "version": "1.3.5",
-  "description": "TypeScript consumer SDK for nSelf \u2014 query GraphQL, manage plugins, auth, and admin from any TS/JS app.",
+  "version": "1.3.6",
+  "description": "TypeScript consumer SDK for nSelf — query GraphQL, manage plugins, auth, and admin from any TS/JS app.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
diff --git a/sdk/ts/package.json b/sdk/ts/package.json
index 21f47873..d9821e31 100644
--- a/sdk/ts/package.json
+++ b/sdk/ts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@nself/plugin-sdk",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "TypeScript/Node.js plugin authoring SDK for nSelf",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",