diff --git a/CHANGELOG.md b/CHANGELOG.md
index faf3ddd835..8881870b8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,8 +14,9 @@ All notable changes to MokoGitea are documented here. Versions follow the format
     * Domain restriction on packages and keys (comma-separated allowed domains)
     * RepoScope enforcement — packages scoped to specific repos
     * Configurable license key prefix per organization
-    * Master key always visible with Regenerate button
+    * Master key auto-generates, sorts first in key list
     * License package creation at repo level via modal
+    * Key generation modal with licensee name, email, and domain fields
     * Manual release-to-stream mapping with UI selector
     * Double confirmation modals for permanent deletion
     * Combolist channel picker (replaces checkboxes)
@@ -35,14 +36,20 @@ All notable changes to MokoGitea are documented here. Versions follow the format
     * Feed always public — downloads gated separately
     * Stream-name tags supported alongside version tags
     * Omit `<client>` for package extension types
-    * No `<downloadkey>` when require_key is off
+    * `<downloadkey>` only when download_gating is prerelease or all
+    * Version extracted from asset filename (matches actual download)
+    * Joomla tag values verified: dev, alpha, beta, rc, stable
   * feat(orgs): enterprise sub-org hierarchy with parent-child relationships
   * feat(repos): three-level visibility — Public (200), Private (403), Hidden (404)
   * feat(settings): Update Server settings page with enable toggle in Advanced Settings
   * feat(settings): advanced settings on dedicated page with dividing headers
   * feat(settings): icons on all settings navbars (repo, org, user, admin)
   * feat(ui): styled 403 Access Denied page with inline login form
-  * feat(issues): custom fields foundation — model, migration, settings UI
+  * feat(issues): custom fields with inline editing in issue sidebar
+  * feat(ui): two-in-one Update Server / Licenses tab
+    * No gating: shows "Update Server" tab with feed URLs only
+    * Gated: shows "Licenses" tab with full key management
+    * `<downloadkey>` only appears when downloads are gated
 * SECURITY
   * fix(security): ownership guards on all API handlers (cross-org prevention)
   * fix(security): RepoScope JSON parsing (substring matching bug)
@@ -62,6 +69,10 @@ All notable changes to MokoGitea are documented here. Versions follow the format
   * fix(build): permanent fixes for AI migration, feed/file.go, unused imports
   * fix(updateserver): version extracted from asset filename (not release title)
   * fix(updateserver): omit `<client>` for package types per Joomla spec
+  * fix(updateserver): `<downloadkey>` only shown when downloads are gated
+  * fix(updateserver): prevent stream name tag from overriding asset-derived version
+  * fix(build): restore build/ directory after accidental deletion
+  * fix(licenses): master key banner removed, master keys sort first in table
 
 ## [v1.26.1-moko.05] - 2026-05-31
 
diff --git a/routers/web/repo/licenses.go b/routers/web/repo/licenses.go
index f3b4c0f7f5..78106ce40b 100644
--- a/routers/web/repo/licenses.go
+++ b/routers/web/repo/licenses.go
@@ -258,7 +258,12 @@ func LicensesRegenerateMasterKey(ctx *context.Context) {
 
 // LicensesGenerateKey handles POST to generate a new key from a package.
 func LicensesGenerateKey(ctx *context.Context) {
-	packageID, _ := strconv.ParseInt(ctx.FormString("package_id"), 10, 64)
+	// Accept package_id from form body or query string (modal sets it via form action URL).
+	pkgIDStr := ctx.FormString("package_id")
+	if pkgIDStr == "" {
+		pkgIDStr = ctx.Req.URL.Query().Get("package_id")
+	}
+	packageID, _ := strconv.ParseInt(pkgIDStr, 10, 64)
 	if packageID == 0 {
 		ctx.Flash.Error("Invalid package")
 		ctx.Redirect(ctx.Repo.RepoLink + "/licenses")
diff --git a/templates/repo/licenses.tmpl b/templates/repo/licenses.tmpl
index 217017853a..4744aa8d16 100644
--- a/templates/repo/licenses.tmpl
+++ b/templates/repo/licenses.tmpl
@@ -58,9 +58,7 @@
 									<td class="tw-text-right tw-flex tw-gap-1 tw-justify-end">
 										<button class="ui tiny primary button show-modal"
 											data-modal="#generate-key-modal"
-											data-modal-generate-key-modal-package-id="{{.ID}}"
-											data-modal-generate-key-modal-package-name="{{.Name}}"
-											data-modal-generate-key-modal-package-domain="{{.DomainRestriction}}"
+											data-modal-form.action="{{$.RepoLink}}/licenses/keys/generate?package_id={{.ID}}"
 											title="{{ctx.Locale.Tr "repo.licenses.generate_key"}}">
 											{{svg "octicon-plus" 14}}
 										</button>
@@ -321,7 +319,6 @@
 	<div class="content">
 		<form class="ui form" method="post" action="{{.RepoLink}}/licenses/keys/generate">
 			{{.CsrfTokenHtml}}
-			<input type="hidden" name="package_id" value="">
 			<div class="field">
 				<label>{{ctx.Locale.Tr "repo.licenses.licensee_name"}}</label>
 				<input name="licensee_name" placeholder="Customer name">