diff --git a/CHANGELOG.md b/CHANGELOG.md
index d2f2f0e..653892f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,26 @@
+## 1.56.1
+
+A maintenance release: dependency constraints only. No API change, no behaviour
+change; the suite passes unmodified against these versions.
+
+### Changed
+
+- **[omnyhub](https://pub.dev/packages/omnyhub) `^1.5.1`** (from `^1.3.0`). 1.4.0
+  and 1.5.0 are on-demand TLS releases (async `DomainPolicy`,
+  `LetsEncryptTls.autoIssue`, `LetsEncryptTls.renewBefore`) and 1.5.1 is a
+  dependency bump beneath them. Their changes are confined to the Let's Encrypt
+  TLS provider, which OmnyShell does not use: the hub listener builds its TLS from
+  `ReloadableFileTls.directory` or `StaticTls.context`, and nothing in the package
+  touches `LetsEncryptTls` or `DomainPolicy`. 1.4.0's one breaking change —
+  `LetsEncryptTls.isAllowed` now returning `Future<bool>` — has no caller here.
+  The surfaces OmnyShell is built on — `OmnyHub`, `Service`, `TlsProvider`, and
+  the node protocol — are unchanged.
+- **[omnydrive](https://pub.dev/packages/omnydrive) `^1.12.3`** (from `^1.12.2`),
+  itself only a restatement of the omnyhub constraint above.
+- **Routine bumps.** `asn1lib: ^1.6.5` (from `^1.6.0`), `ffi: ^2.2.0` (from
+  `^2.1.0`), `http: ^1.6.0` (from `^1.2.0`), `meta: ^1.19.0` (from `^1.18.3`),
+  `path: ^1.9.1` (from `^1.9.0`).
+
 ## 1.56.0
 
 The Hub broker can now be hosted on a listener OmnyShell does not own, so another
diff --git a/lib/src/version.dart b/lib/src/version.dart
index 16a3561..80ad9d2 100644
--- a/lib/src/version.dart
+++ b/lib/src/version.dart
@@ -3,4 +3,4 @@
 /// This is the single source of truth for "what build is this": it is rendered
 /// in the CLI banner and is the default a node reports as its
 /// [NodeConfig.agentVersion] / [PlatformInfo.agentVersion].
-const String omnyShellVersion = '1.56.0';
+const String omnyShellVersion = '1.56.1';
diff --git a/pubspec.yaml b/pubspec.yaml
index 4861254..f7d24a7 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -4,7 +4,7 @@ description: >-
   connect to a Hub by node identity (not host:port); the Hub authenticates,
   authorizes and brokers encrypted sessions to Nodes over WebSocket-on-TLS.
   Ships Hub, Node, Client and CLI implementations behind first-class Dart APIs.
-version: 1.56.0
+version: 1.56.1
 repository: https://github.com/OmnyGrid/omnyshell
 
 environment:
@@ -15,16 +15,16 @@ executables:
 
 dependencies:
   args: ^2.7.0
-  asn1lib: ^1.6.0
+  asn1lib: ^1.6.5
   command_shield: ^1.4.0
   cryptography: ^2.9.0
   dart_service_manager: ^1.3.1
-  ffi: ^2.1.0
-  http: ^1.2.0
-  meta: ^1.18.3
-  omnydrive: ^1.12.2
-  omnyhub: ^1.3.0
-  path: ^1.9.0
+  ffi: ^2.2.0
+  http: ^1.6.0
+  meta: ^1.19.0
+  omnydrive: ^1.12.3
+  omnyhub: ^1.5.1
+  path: ^1.9.1
   pointycastle: ^4.0.0
   #portable_pty: ^0.0.5  # waiting crash fix.
   tcp_tunnel: ^2.1.0