diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24bbe27..1f86e7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.1] - 2026-09-27
+
+### Changed
+
+- hackney `~> 4.8.0` (locked at 4.8.3, pulling quic 2.0.1 and
+  webtransport 0.4.7), h2 `~> 0.12.0` (locked at 0.12.3), h1
+  `~> 0.9.0`. Each dependency now accepts any patch release of its
+  minor series.
+- rebar3_lint 6.0.0.
+
 ## [4.1.0] - 2026-09-23
 
 Everything is additive. A server whose auth provider does not export
diff --git a/README.md b/README.md
index cc78713..d112f4d 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ Add to your `rebar.config`:
 {deps, [
     {barrel_mcp,
         {git, "https://github.com/barrel-platform/barrel_mcp.git",
-              {tag, "v4.1.0"}}}
+              {tag, "v4.1.1"}}}
 ]}.
 ```
 
@@ -678,7 +678,7 @@ Your application's entry point should call `barrel_mcp:start_stdio()`.
 
 ## Pending features
 
-Nothing is pending as of 4.1.0: the library implements every released
+Nothing is pending as of 4.1.1: the library implements every released
 revision of the specification, and both halves of the `ext-auth`
 extension. [`docs/pending-features.md`](docs/pending-features.md)
 records what is deliberately out of scope. Open an issue if you want
diff --git a/docs/pending-features.md b/docs/pending-features.md
index 6fb8787..c16c959 100644
--- a/docs/pending-features.md
+++ b/docs/pending-features.md
@@ -3,7 +3,7 @@
 Design notes for features that are **not yet implemented** and likely
 worth doing. Each entry is sized to be picked up as one focused PR.
 
-**Nothing is pending as of 4.1.0.** The last entry here, Dynamic Client
+**Nothing is pending as of 4.1.1.** The last entry here, Dynamic Client
 Registration (RFC 7591), shipped and has since been deprecated by the
 specification in favour of Client ID Metadata Documents, which shipped
 alongside it. See [Client registration](../guides/authentication.md#client-registration).
diff --git a/rebar.config b/rebar.config
index c3a509b..174e956 100644
--- a/rebar.config
+++ b/rebar.config
@@ -4,9 +4,9 @@
     %% hex package is `erlang_h1' (the short name `h1' was taken);
     %% the OTP app/dep stays `h1' so call sites and the app graph
     %% use `h1' consistently.
-    {h1, "~> 0.9.1", {pkg, erlang_h1}},
+    {h1, "~> 0.9.0", {pkg, erlang_h1}},
     {h2, "~> 0.12.0"},
-    {hackney, "~> 4.7.4"}
+    {hackney, "~> 4.8.0"}
 ]}.
 
 {shell, [{apps, [barrel_mcp]}]}.
@@ -43,7 +43,7 @@
 %% Documentation
 {project_plugins, [
     {erlfmt, "1.8.0"},
-    {rebar3_lint, "5.0.4"},
+    {rebar3_lint, "6.0.0"},
     rebar3_ex_doc
 ]}.
 
diff --git a/rebar.lock b/rebar.lock
index a24d37c..0e8b35e 100644
--- a/rebar.lock
+++ b/rebar.lock
@@ -1,35 +1,35 @@
 {"1.2.0",
 [{<<"certifi">>,{pkg,<<"certifi">>,<<"2.17.0">>},1},
  {<<"h1">>,{pkg,<<"erlang_h1">>,<<"0.9.1">>},0},
- {<<"h2">>,{pkg,<<"h2">>,<<"0.12.0">>},0},
- {<<"hackney">>,{pkg,<<"hackney">>,<<"4.7.4">>},0},
+ {<<"h2">>,{pkg,<<"h2">>,<<"0.12.3">>},0},
+ {<<"hackney">>,{pkg,<<"hackney">>,<<"4.8.3">>},0},
  {<<"idna">>,{pkg,<<"idna">>,<<"7.1.0">>},1},
  {<<"mimerl">>,{pkg,<<"mimerl">>,<<"1.5.0">>},1},
  {<<"parse_trans">>,{pkg,<<"parse_trans">>,<<"3.4.2">>},1},
- {<<"quic">>,{pkg,<<"quic">>,<<"1.8.1">>},2},
+ {<<"quic">>,{pkg,<<"quic">>,<<"2.0.1">>},1},
  {<<"ssl_verify_fun">>,{pkg,<<"ssl_verify_fun">>,<<"1.1.7">>},1},
- {<<"webtransport">>,{pkg,<<"webtransport">>,<<"0.4.5">>},1}]}.
+ {<<"webtransport">>,{pkg,<<"webtransport">>,<<"0.4.7">>},1}]}.
 [
 {pkg_hash,[
  {<<"certifi">>, <<"835748414307E15E05B17D0E518190228CE648B08D569A5CC93A85A40F3E5C9B">>},
  {<<"h1">>, <<"A20CE059E74F953D7ED21E06BD58ADF53D746F5AA026B4FDD29D81E23B22DCA1">>},
- {<<"h2">>, <<"F393539EE2728F8118FB2024B6D5F3E2C45E40CEB31B18B4E9BF5E50D028F80F">>},
- {<<"hackney">>, <<"8FE2DDAA3CA27DE99D68E682D72B66D07D2331DA680F77C8000580A0122C69E6">>},
+ {<<"h2">>, <<"20E3FD0E384EC6F586E4736ACD409A57EA87B4A56002D8DCF1132514B3D7600A">>},
+ {<<"hackney">>, <<"4AAD9FEE1E2937BBCE840F619D87C3DE98FAB95902295D91FF4A4AFE613C5E53">>},
  {<<"idna">>, <<"1067A13043538129602D2F2CE6899D8713125C7D19734AA557CE2E3EA55BD4F1">>},
  {<<"mimerl">>, <<"F35ACA6F23242339B3666E0AC0702379E362B469D0AEA167F6CC713547E777ED">>},
  {<<"parse_trans">>, <<"C352DDC1A0D5E54F9B1654D45F9C432EEF76F9CEA371C55DDFF769EF688FDB74">>},
- {<<"quic">>, <<"51415525C490D80F97073E39E17D289EBACDA5468154CFB661AC04DB5B1A5E95">>},
+ {<<"quic">>, <<"45AD1FFEDD9A177277F78482BC28D07DE93710D8A641F06345C1C27767C754EA">>},
  {<<"ssl_verify_fun">>, <<"354C321CF377240C7B8716899E182CE4890C5938111A1296ADD3EC74CF1715DF">>},
- {<<"webtransport">>, <<"0E387202BBE707389FE81373EF8C56FAA9D5AA321BB4800FA4765EE7C1399785">>}]},
+ {<<"webtransport">>, <<"8E0ABD5875DAAB05C7020B8FC0C3B318FE93AA9329302FE5ECDA2A0F953CF688">>}]},
 {pkg_hash_ext,[
  {<<"certifi">>, <<"8122798A17F0293C80DAADA25D0F81C7F4D708C73FEF782C7C9B1950E26E4D21">>},
  {<<"h1">>, <<"F6C7D1C0947CBE56AB7494E5E131CADAC626E7D5FA42396314B6CCE1380B0C73">>},
- {<<"h2">>, <<"BEAAFC93C54CDC5D623247334D3970CDF4BC66B6B8B296B74BA1D7C7513C3DFC">>},
- {<<"hackney">>, <<"D07D7E1358353AB6CC75132F058C155287F3E013D43F709FBB79D79EEAB98195">>},
+ {<<"h2">>, <<"996AF98698F7DC68BCC7688D70D97384B53DDD0286BA07E6D4A9AC54F1970D32">>},
+ {<<"hackney">>, <<"3D5B6E06FC5AFF30FDCC7C66097AE59DC61AA6D531FAC1E0E6DB8B82DCFC1D14">>},
  {<<"idna">>, <<"6AE959A025BF36DF61A8CAB8508D9654891B5426A84C44D82DEAFFD6DDF8C71F">>},
  {<<"mimerl">>, <<"DB648CE065BAE14EA84CA8B5DD123F42F49417CEF693541110BF6F9E9BE9ECC4">>},
  {<<"parse_trans">>, <<"4C25347DE3B7C35732D32E69AB43D1CEEE0BEAE3F3B3ADE1B59CBD3DD224D9CA">>},
- {<<"quic">>, <<"884A7D30CB048D8D1ACB97EB2B905D30D4C29B8928C0DB3AB3060DE7CDC97688">>},
+ {<<"quic">>, <<"D907A5898467C3DED1D50DD12726577C342BB3BD6F8F40F5FE679805147D0B81">>},
  {<<"ssl_verify_fun">>, <<"FE4C190E8F37401D30167C8C405EDA19469F34577987C76DDE613E838BBC67F8">>},
- {<<"webtransport">>, <<"BCB512239E48E551D5BD5C667312A9A7DE4F29B89D84B1D33C5AF44E1F3F730D">>}]}
+ {<<"webtransport">>, <<"9D2FCBFC561A172CF6F2EEF00B89FC89774C039CE850414356964C147707F85E">>}]}
 ].
diff --git a/src/barrel_mcp.app.src b/src/barrel_mcp.app.src
index 9e4c6df..8693240 100644
--- a/src/barrel_mcp.app.src
+++ b/src/barrel_mcp.app.src
@@ -1,6 +1,6 @@
 {application, barrel_mcp, [
     {description, "MCP Protocol Library for Erlang"},
-    {vsn, "4.1.0"},
+    {vsn, "4.1.1"},
     {registered, [
         barrel_mcp_registry,
         barrel_mcp_sup,