diff --git a/releases-manifest.json b/releases-manifest.json
index 5f45ff5..36fbcec 100644
--- a/releases-manifest.json
+++ b/releases-manifest.json
@@ -22,14 +22,14 @@
     {
       "id": "ariadne-resolver",
       "product": "Ariadne Resolver (Windows)",
-      "version": "0.1.4",
+      "version": "0.1.5",
       "date": "2026-09-27",
       "platform": "win-x64",
       "signed": false,
       "signingAuthority": null,
-      "changes": "Fixes \"resolver is installed and DNS answers, but every .bch site fails in every browser except Theseus\": if the machine had a stale \"BNS Local Root CA\" left over from an earlier install (e.g. an unconstrained root from before 2026-07), the new install used to add its own root alongside instead of replacing it, and Chromium/Edge/Firefox chain-builders would refuse to try both candidates. install.ps1 now sweeps every prior BNS root whose thumbprint differs from the one being trusted, so exactly one BNS Local Root CA remains after install. uninstall.ps1 switched to X509Store direct (Cert: PSDrive is not always loaded in Inno's UninstallRun context). Same daemon, same NRPT, upgrades in place.",
+      "changes": "Other browsers open .x and every other live BNS TLD again. The installer took its TLD list from the legacy tlds.bch record (nine TLDs) while the registry had moved to per-TLD ownership with twenty, and the daemon read its certificate allow-list from a bundled config rather than the CA it had just minted, so only .bch, .p2p, .deviant and .nav actually worked outside Theseus. 0.1.5 routes and certifies every TLD on the public registry listing (asm, bch, bit, cex, coin, dea, dex, hub, nav, neo, nt, os, p2p, sia, test, vpn, x, deviant, dgb, lm), leaves ICANN-delegated collision TLDs (.cash, .gt, .sc, .sm) to the normal resolver so the local CA never covers a real internet TLD, and the daemon now takes its allow-list from the installed root CA itself. The root CA is regenerated on upgrade: restart Firefox once after installing. Upgrades in place.",
       "files": {
-        "AriadneResolver-Setup-0.1.4.exe": "30ed5e3bb6d6da5325f854c97976410b4fc63067ed52c810a55e9d2e1bdc4e17"
+        "AriadneResolver-Setup-0.1.5.exe": "b73a21207df81dc09bf6ff6898d00be30335a3b6a7fa9b3db4f2d4e8371d626b"
       }
     },
     {
diff --git a/releases/index.html b/releases/index.html
index 7b51ea9..af662d4 100644
--- a/releases/index.html
+++ b/releases/index.html
@@ -72,12 +72,12 @@
   </div>
 
   <div class="rel">
-    <h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.4</span></h2>
-    <div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-27 · <b>Stale-root sweep</b> — fixes the "resolver is installed, DNS answers, but every .bch site fails in every browser except Theseus" state. If the machine had a stale <code style="display:inline">BNS Local Root CA</code> left over from an earlier install (an unconstrained root from before 2026-07, or a rotated one), the new install used to add its own root alongside instead of replacing it, and Chromium/Edge/Firefox chain-builders would refuse to try both candidates and fail with <code style="display:inline">ERR_CERT_AUTHORITY_INVALID</code> / <code style="display:inline">SEC_ERROR_BAD_SIGNATURE</code>. install.ps1 now sweeps every prior BNS root whose thumbprint differs from the one being trusted, so exactly one <code style="display:inline">BNS Local Root CA</code> remains after install. uninstall.ps1 switched to <code style="display:inline">X509Store</code> direct (the <code style="display:inline">Cert:</code> PSDrive is not always loaded in Inno's <code style="display:inline">UninstallRun</code> context). Same daemon, same NRPT rules, upgrades in place.</div>
+    <h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.5</span></h2>
+    <div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-27 · <b>0.1.5 — every live BNS TLD reaches other browsers again</b> — Other browsers open .x and every other live BNS TLD again. The installer took its TLD list from the legacy tlds.bch record (nine TLDs) while the registry had moved to per-TLD ownership with twenty, and the daemon read its certificate allow-list from a bundled config rather than the CA it had just minted, so only .bch, .p2p, .deviant and .nav actually worked outside Theseus. 0.1.5 routes and certifies every TLD on the public registry listing (asm, bch, bit, cex, coin, dea, dex, hub, nav, neo, nt, os, p2p, sia, test, vpn, x, deviant, dgb, lm), leaves ICANN-delegated collision TLDs (.cash, .gt, .sc, .sm) to the normal resolver so the local CA never covers a real internet TLD, and the daemon now takes its allow-list from the installed root CA itself. The root CA is regenerated on upgrade: restart Firefox once after installing. Upgrades in place.</div>
 
     <div class="file">
-      <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.4.exe">AriadneResolver-Setup-0.1.4.exe</a> — ~24 MB</div>
-      <code>30ed5e3bb6d6da5325f854c97976410b4fc63067ed52c810a55e9d2e1bdc4e17</code>
+      <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.5.exe">AriadneResolver-Setup-0.1.5.exe</a> — ~24 MB</div>
+      <code>b73a21207df81dc09bf6ff6898d00be30335a3b6a7fa9b3db4f2d4e8371d626b</code>
     </div>
   </div>