diff --git a/releases-manifest.json b/releases-manifest.json
index a7e1243..52a2792 100644
--- a/releases-manifest.json
+++ b/releases-manifest.json
@@ -22,14 +22,14 @@
     {
       "id": "ariadne-resolver",
       "product": "Ariadne Resolver (Windows)",
-      "version": "0.1.7",
+      "version": "0.1.8",
       "date": "2026-09-28",
       "platform": "win-x64",
       "signed": false,
       "signingAuthority": null,
-      "changes": "Collision policy is now runtime-switchable machine-wide. The daemon hot-reloads C:\\ProgramData\\Ariadne\\policy.json every 5 seconds -- change {\"policy\":\"bcnr-first\"} to \"icann-first\" (or back) and every browser on the machine flips within seconds, no restart or reinstall. Install seeds the file with the current -Policy default and grants BUILTIN\\Users Modify on it, so an unprivileged app (Theseus's Ariadne panel, a text editor) can rewrite it without a UAC prompt. Invalid values keep the last good policy. Also fixes an intermittent \"config unreadable\" at daemon start when the config file had a UTF-8 BOM (same class of bug 0.1.6 fixed in the TLD-sync path). Includes 0.1.6 (daemon self-syncs routing + CA to the BNS registry every 6 hours). Upgrades in place.",
+      "changes": "BNS names with an `ip` record and an on-chain `tls` fingerprint pin now load cleanly in every browser -- game.x, hephaestus.x and any other site that pins its origin cert. Previously the daemon returned the raw `ip` and browsers hit the site's own server directly; if that server's cert was not browser-trusted (which is the whole point of publishing an on-chain pin), users got ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. 0.1.8 answers DNS with 127.0.0.1 whenever `ip`+`tls` are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS -- validating the origin cert against the on-chain fingerprint (same algorithm Theseus uses in main.js:pinnedHttpsGet, cert.fingerprint256 lower-case, colons stripped). Names with just `ip` (no pin) keep direct routing unchanged. Also carries 0.1.7 (runtime-switchable collision policy via C:\\ProgramData\\Ariadne\\policy.json) and 0.1.6 (self-syncing routing + CA). Upgrades in place.",
       "files": {
-        "AriadneResolver-Setup-0.1.7.exe": "742f8005c2dfb47929287c009cddf7738f0d12bd56fb8f8a837df3e9b435f47f"
+        "AriadneResolver-Setup-0.1.8.exe": "47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb"
       }
     },
     {
diff --git a/releases/index.html b/releases/index.html
index ab33109..ec5d2ef 100644
--- a/releases/index.html
+++ b/releases/index.html
@@ -72,12 +72,12 @@
   </div>
 
   <div class="rel">
-    <h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.7</span></h2>
-    <div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.7 — collision policy is runtime-switchable machine-wide</b> — Pick <code style="display:inline">bcnr-first</code> or <code style="display:inline">icann-first</code> for the whole machine by writing <code style="display:inline">C:\ProgramData\Ariadne\policy.json</code>; the daemon hot-reloads it every 5 seconds and every browser on the box flips with it — no restart, no reinstall, no UAC. Install seeds the file with the current install-time default and grants <code style="display:inline">BUILTIN\Users</code> Modify so Theseus (or a text editor) can rewrite it unprivileged. Invalid values keep the last good policy. Also fixes a "config unreadable" at daemon start when the config file had a UTF-8 BOM. Includes 0.1.6 (daemon self-syncs routing + CA to the BNS registry every 6 hours). Upgrades in place.</div>
+    <h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.8</span></h2>
+    <div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.8 — pinned-origin proxy for `ip`+`tls` names</b> — BNS names that publish an <code style="display:inline">ip</code> record with an on-chain <code style="display:inline">tls</code> fingerprint pin (game.x, hephaestus.x, and any other site that pins its origin cert) now load cleanly in every browser. Before 0.1.8 the daemon returned the raw <code style="display:inline">ip</code> and browsers hit the origin directly; if that origin's cert was not browser-trusted (which is the whole point of publishing an on-chain pin) users got <code style="display:inline">ERR_CERT_AUTHORITY_INVALID</code> / <code style="display:inline">SEC_ERROR_UNKNOWN_ISSUER</code>. 0.1.8 answers DNS with <code style="display:inline">127.0.0.1</code> whenever <code style="display:inline">ip</code>+<code style="display:inline">tls</code> are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin — same algorithm Theseus uses in <code style="display:inline">pinnedHttpsGet</code>. Names with just <code style="display:inline">ip</code> (no pin) keep direct routing unchanged, so nothing regresses. Includes 0.1.7 (runtime-switchable collision policy) and 0.1.6 (self-syncing routing + CA). Upgrades in place.</div>
 
     <div class="file">
-      <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.7.exe">AriadneResolver-Setup-0.1.7.exe</a> — ~24 MB</div>
-      <code>742f8005c2dfb47929287c009cddf7738f0d12bd56fb8f8a837df3e9b435f47f</code>
+      <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe">AriadneResolver-Setup-0.1.8.exe</a> — ~24 MB</div>
+      <code>47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb</code>
     </div>
   </div>