diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9792d5fa..47332a0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,11 +3,23 @@
 
 ## [02.56.08] --- 2026-07-05
 
-## [02.56.08] --- 2026-07-05
+### Fixed
+- Component manifest `<name>` reverted to the element-safe `MokoSuiteBackup`. The "Type - Name" display convention made Joomla derive the component element as `com_component-mokosuitebackup`, registering a duplicate component and leaving the real `com_mokosuitebackup` orphaned on the old version — the admin component appeared "stuck" and served the old UI (broken remote-destinations tab, legacy fields). (#213)
 
 ## [02.56.07] --- 2026-07-05
 
-## [02.56.07] --- 2026-07-05
+### Security
+- Mask the FTP password in `AjaxController::maskSecrets()`/`mergeExistingSecrets()` — stored FTP remotes no longer leak their password via `listRemotes`. (#169)
+- Stop the API single-item view (`Backups/JsonapiView`) leaking the server `absolute_path`. (#187)
+- SFTP uploader uses `StrictHostKeyChecking=accept-new` instead of `no`. (#182)
+
+### Fixed
+- `DatabaseDumper` writes a real newline after `DROP TABLE` (was a literal `\n`), fixing streamed dumps. (#179)
+- Profile-picker forms order by `id` instead of the dropped `ordering` column (query failed on upgraded sites). (#180)
+- `uninstall.mysql.sql` now drops the snapshots table. (#181)
+- CLI snapshot delete uses the real `data_file` column (was `file_path`, so files were never removed). (#184)
+- Remove the duplicate pre-update backup — the content plugin no longer subscribes to `onExtensionBeforeUpdate` (owned by the system plugin). (#186)
+- `DatabaseImporter` collects non-fatal statement errors (`getErrors()`/`hasErrors()`) so restores are no longer silent. (#188)
 
 ## [02.56.05] --- 2026-07-05