diff --git a/releases-manifest.json b/releases-manifest.json
index e9154df..a7e1243 100644
--- a/releases-manifest.json
+++ b/releases-manifest.json
@@ -8,15 +8,15 @@
     {
       "id": "theseus-navigator",
       "product": "Theseus Navigator",
-      "version": "0.3.58",
-      "date": "2026-09-27",
+      "version": "0.3.59",
+      "date": "2026-09-28",
       "platform": "win-x64",
       "signed": false,
       "signingAuthority": null,
-      "changes": "Two new protections, both on by default and managed under Settings › Performance: Shield blocks requests to known tracking and advertising hosts on every site (EasyList and EasyPrivacy, rules refreshed daily, one-click allow per site), and Cookie Pop-ups answers consent banners for you, rejecting all but the essentials (built on DuckDuckGo's autoconsent rules, one-click exclude per site). Page dialogs (alert, confirm, prompt) and Theseus's own prompts (install app or extension, remove, restart) are now drawn by Theseus in a sheet under the toolbar that names who is asking, instead of the bare system box titled theseus-navigator. Favorites chips share the row instead of running out of it. Settings pages have addresses (theseus://settings/privacy). Includes 0.3.57 (install any site as an app; two main-process crash fixes).",
+      "changes": "Privacy, regrouped: Settings › Privacy now opens with a status card and gathers tracking protection (Shield and Cookie Pop-ups with their per-site exceptions), device access, anti-fingerprinting, network and browsing data in one place. New there: DNS over HTTPS (on by default with Quad9; Cloudflare, Mullvad, AdGuard or your own resolver; an increased-protection mode that never falls back to plain DNS) and Global Privacy Control, which tells every site not to sell or share your data (the Sec-GPC header plus navigator.globalPrivacyControl). Every Settings page has an address you can copy and open, theseus://settings/privacy for example, with sub-pages for the longer lists. Search-engine icons ship inside Theseus and a custom engine's icon is cached once, so the toolbar, the picker and Settings look the same offline and opening the picker no longer asks a favicon service which engines you use; the default-engine control in Settings shows the icons too. A video's fullscreen now hides the toolbar and leaving it, switching tabs or closing the tab puts the window back (before, the window could stay fullscreen with no title-bar buttons); F11 toggles fullscreen. A name owner's subdomain rules (a blocked or redirected subdomain) now apply in Theseus for names it reaches directly by IP as well, not only through the gateway.",
       "files": {
-        "TheseusNavigator-0.3.58-portable.exe": "03efa9389e69b660e72b175bdad26e4549fd78b42d5efd4d9509e1aa1e71e9cb",
-        "TheseusNavigator-Setup-0.3.58.exe": "2e09be3eca7fa7929926e4fffbf14599eb23be2cbd1bb42ee48db61578d7a0c7"
+        "TheseusNavigator-0.3.59-portable.exe": "3fd83638c205b2ec42176031b5c775cb519c8ca24bf8acda63bf514a781b6f69",
+        "TheseusNavigator-Setup-0.3.59.exe": "82506429906f7dca5db4e1cb37f26b806f0217e8db35426a0345c339a8b4ced5"
       }
     },
     {
@@ -35,16 +35,16 @@
     {
       "id": "ariadne-android",
       "product": "Ariadne for Android",
-      "version": "0.20",
+      "version": "0.21",
       "date": "2026-09-28",
       "platform": "android",
       "minSdk": 21,
       "signed": true,
       "signingAuthority": null,
       "signingCertSha256": "46ebbbe5dc73148d66410fd0337b1e6683472128c983e8e2578200b9e3ca548c",
-      "changes": "Every live BNS TLD is claimed by the on-device resolver. The app took its TLD list from the registry's legacy advertised set (nine TLDs), so a name under a newer TLD was only intercepted once it had turned up in the local index; the app now reads the registry's routable list (every TLD on the public listing, 24 today), and ships a bootstrap list matching it for cold start. The cold-start snapshot it pulls from the CDN is now refreshed every ten minutes from the gateway's index instead of by hand, so a fresh install sees names registered minutes ago rather than weeks. Same signing key; installs over 0.19.",
+      "changes": "Fix: names whose only content record is a URL redirect (u) — hermes.x, prometheus.x, helios.x, silentmode.x — now open in the tab instead of crashing with a resolver error. The app was handing WebView a synthetic 302 response, which Androids WebResourceResponse forbids for any status in the [300, 399] range; redirects are now served as an HTML meta-refresh under status 200. As defence in depth, on-device fetches through the public relay also follow relay-side redirects automatically now.",
       "files": {
-        "ariadne-v0.20.apk": "e7362e356de14f010646f3c60908ccd4bbd8030914f7e6a5dc2722d9dcf5e51e"
+        "ariadne-v0.21.apk": "5ed400d8223dbaef3abc013855629d9c9822c4a02e767126547834180c7488ec"
       }
     },
     {
diff --git a/releases/index.html b/releases/index.html
index 4119a1c..ab33109 100644
--- a/releases/index.html
+++ b/releases/index.html
@@ -58,16 +58,16 @@
      mirror cannot change what you check against here.</p>
 
   <div class="rel">
-    <h2>Theseus Navigator <span style="color:var(--acid)">0.3.58</span></h2>
-    <div class="meta">Windows 64-bit · unsigned · 2026-09-27 · <b>0.3.58 — Shield, Cookie Pop-ups, and dialogs that look like Theseus</b> — Two new protections, both on by default and managed under Settings › Performance: Shield blocks requests to known tracking and advertising hosts on every site (EasyList and EasyPrivacy, rules refreshed daily, one-click allow per site), and Cookie Pop-ups answers consent banners for you, rejecting all but the essentials (built on DuckDuckGo's autoconsent rules, one-click exclude per site). Page dialogs (alert, confirm, prompt) and Theseus's own prompts (install app or extension, remove, restart) are now drawn by Theseus in a sheet under the toolbar that names who is asking, instead of the bare system box titled theseus-navigator. Favorites chips share the row instead of running out of it. Settings pages have addresses (theseus://settings/privacy). Includes 0.3.57 (install any site as an app; two main-process crash fixes).</div>
+    <h2>Theseus Navigator <span style="color:var(--acid)">0.3.59</span></h2>
+    <div class="meta">Windows 64-bit · unsigned · 2026-09-28 · <b>0.3.59 — DNS over HTTPS, Global Privacy Control, Settings pages with addresses</b> — Privacy, regrouped: Settings › Privacy now opens with a status card and gathers tracking protection (Shield and Cookie Pop-ups with their per-site exceptions), device access, anti-fingerprinting, network and browsing data in one place. New there: DNS over HTTPS (on by default with Quad9; Cloudflare, Mullvad, AdGuard or your own resolver; an increased-protection mode that never falls back to plain DNS) and Global Privacy Control, which tells every site not to sell or share your data (the Sec-GPC header plus navigator.globalPrivacyControl). Every Settings page has an address you can copy and open, theseus://settings/privacy for example, with sub-pages for the longer lists. Search-engine icons ship inside Theseus and a custom engine's icon is cached once, so the toolbar, the picker and Settings look the same offline and opening the picker no longer asks a favicon service which engines you use; the default-engine control in Settings shows the icons too. A video's fullscreen now hides the toolbar and leaving it, switching tabs or closing the tab puts the window back (before, the window could stay fullscreen with no title-bar buttons); F11 toggles fullscreen. A name owner's subdomain rules (a blocked or redirected subdomain) now apply in Theseus for names it reaches directly by IP as well, not only through the gateway.</div>
 
     <div class="file">
-      <div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-Setup-0.3.58.exe">TheseusNavigator-Setup-0.3.58.exe</a> — installer</div>
-      <code>2e09be3eca7fa7929926e4fffbf14599eb23be2cbd1bb42ee48db61578d7a0c7</code>
+      <div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-Setup-0.3.59.exe">TheseusNavigator-Setup-0.3.59.exe</a> — installer</div>
+      <code>82506429906f7dca5db4e1cb37f26b806f0217e8db35426a0345c339a8b4ced5</code>
     </div>
     <div class="file">
-      <div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-0.3.58-portable.exe">TheseusNavigator-0.3.58-portable.exe</a> — portable</div>
-      <code>03efa9389e69b660e72b175bdad26e4549fd78b42d5efd4d9509e1aa1e71e9cb</code>
+      <div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-0.3.59-portable.exe">TheseusNavigator-0.3.59-portable.exe</a> — portable</div>
+      <code>3fd83638c205b2ec42176031b5c775cb519c8ca24bf8acda63bf514a781b6f69</code>
     </div>
   </div>
 
diff --git a/theseus/index.html b/theseus/index.html
index 24c8c73..39f9736 100644
--- a/theseus/index.html
+++ b/theseus/index.html
@@ -144,7 +144,7 @@
         <h3>Theseus for Windows</h3>
         <p class="desc">Full-window desktop browser with Tor toggle, search bar, password
            vault and add-ons. macOS and Linux not yet packaged.</p>
-        <div class="meta">v0.3.58 · installer ~137 MB · portable ~137 MB · unsigned</div>
+        <div class="meta">v0.3.59 · installer ~137 MB · portable ~137 MB · unsigned</div>
         <div class="buttons">
           <a class="btn acid" href="https://dl.silentmode.st/latest/TheseusNavigator-Setup.exe">Installer</a>
           <a class="btn ghost" href="https://dl.silentmode.st/latest/TheseusNavigator-portable.exe">Portable .exe</a>