diff --git a/.github/workflows/runtime-security.yml b/.github/workflows/runtime-security.yml
index 69f11ec..30fa757 100644
--- a/.github/workflows/runtime-security.yml
+++ b/.github/workflows/runtime-security.yml
@@ -48,7 +48,7 @@ jobs:
           set -euo pipefail
           test "$GITHUB_REF" = refs/heads/main
           [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          test "$RELEASE_TAG" = 'v0.17.14'
+          test "$RELEASE_TAG" = 'v0.17.15'
           test -z "$(git status --porcelain)"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)" = "$GITHUB_SHA"
@@ -104,7 +104,7 @@ jobs:
           docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
             -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
             image --skip-db-update --format cyclonedx --output /evidence/image.cdx.json "$TESTED_IMAGE"
-          bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a'
+          bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19'
           mkdir -p evidence/bundle-tools
           bundle_container=$(docker create "$bundle_image" unused)
           trap 'docker rm "$bundle_container" >/dev/null' EXIT
@@ -118,7 +118,7 @@ jobs:
           python3 evidence/bundle-tools/verify-consumer-evidence.py \
             --evidence-dir evidence/ubuntu-backports --sbom evidence/image.cdx.json \
             --bundle-checksums evidence/bundle-tools/SHA256SUMS \
-            --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json
+            --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > evidence/ubuntu-backports-validation.json
           # Only native Trivy interprets the exact qualified OpenVEX statements.
           docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
             -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
diff --git a/README.md b/README.md
index adbf219..de2a681 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
 # Internal DNS
 
-Linux runtime **`v0.17.14`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+Linux runtime **`v0.17.15`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+
+The shared bundle includes the official Brotli decoder fix for CVE-2026-111497.
 
 The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`.
 
@@ -29,10 +31,10 @@ make build
 ```
 
 `scripts/build` also cross-compiles `windows/amd64`. The Linux image is
-`ghcr.io/pasturestack/internal-dns:v0.17.14`; Catalog selection follows its release and integration gates.
+`ghcr.io/pasturestack/internal-dns:v0.17.15`; Catalog selection follows its release and integration gates.
 The separately versioned Windows Server 2022 image remains
-`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. This Linux preparation
-does not rebuild or revalidate that Windows image.
+`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. The Windows image remains separately
+versioned and is not rebuilt by this Linux release.
 
 Linux integration tests require `bats`, `dig`, free local TCP/UDP port 15353, and controlled recursive DNS access:
 
diff --git a/package/linux/amd64/Dockerfile b/package/linux/amd64/Dockerfile
index 71b4b1d..c49d457 100644
--- a/package/linux/amd64/Dockerfile
+++ b/package/linux/amd64/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7
-FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports
+FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 ARG UBUNTU_SNAPSHOT=20260825T000000Z
@@ -55,7 +55,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/
     for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \
         cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \
     done; \
-    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \
+    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \
     (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \
     dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
     rm -f /var/cache/ldconfig/aux-cache