diff --git a/.github/prerelease-please-manifest.json b/.github/prerelease-please-manifest.json
index 7869441993..614d5788a2 100644
--- a/.github/prerelease-please-manifest.json
+++ b/.github/prerelease-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "9.25.0"
+  ".": "9.26.0-rc"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2df70fa9dc..68988a924a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,37 @@
 # Changelog
 
+## [9.26.0-rc](https://github.com/cloud-pi-native/console/compare/v9.25.0...v9.26.0-rc) (2026-09-10)
+
+
+### Features
+
+* **server-nestjs:** configurable Harbor robot expiration with enforced rotation headroom ([c55fe13](https://github.com/cloud-pi-native/console/commit/c55fe136b40c641e93821c0d64ef32e7d6553bd8)), closes [#2679](https://github.com/cloud-pi-native/console/issues/2679)
+* **server-nestjs:** proactive GitLab mirror token rotation with enforced headroom ([f0139b6](https://github.com/cloud-pi-native/console/commit/f0139b6cf41513ce00a0facccb7c4020d8d01891)), closes [#2691](https://github.com/cloud-pi-native/console/issues/2691)
+
+
+### Bug Fixes
+
+* **ci:** fix hotfixes being performed with main as target branch ([ff26269](https://github.com/cloud-pi-native/console/commit/ff262692fbe1ab90f273bd60b1f7d8450ffdee4f))
+* **client:** clarify values file path hint per value source type ([52ac9a3](https://github.com/cloud-pi-native/console/commit/52ac9a3dd0c1d2187bc82384a2478d543fcfa546))
+* **client:** guard syncRepository against cleared selectedRepo after await ([d647925](https://github.com/cloud-pi-native/console/commit/d647925e5c104bf64c2be696a6df178669c60c02))
+* **client:** use bundled ri icon for deployment sources ([9498ecc](https://github.com/cloud-pi-native/console/commit/9498eccbc9435623ef96a42d8bf18adb18c58357))
+* **deployment:** send value source paths to ArgoCD without <env> substitution ([4e48cbc](https://github.com/cloud-pi-native/console/commit/4e48cbcaaef94548298a45f32893a98eb3340060))
+* **nexus:** re-add NexusError import dropped by idempotence refactor ([749373b](https://github.com/cloud-pi-native/console/commit/749373b7d7e7fbbc8169d577333c5dfa5a9dca1a))
+* **observability:** restore legacy dual-bucket Grafana RBAC sync ([2ad58c1](https://github.com/cloud-pi-native/console/commit/2ad58c1dc9572194dbc818976a6c64143dd227c5)), closes [#2686](https://github.com/cloud-pi-native/console/issues/2686)
+* OpenCDS should have been enabled though plugin service not from main ([2967d92](https://github.com/cloud-pi-native/console/commit/2967d926ea63f9682c81479e490eb3850611853e))
+* **server-nestjs:** backfill default system roles on roleless projects ([796870c](https://github.com/cloud-pi-native/console/commit/796870c3bcc9f3fb9efe078d8d50808b3169f3fb)), closes [#2684](https://github.com/cloud-pi-native/console/issues/2684)
+* **server-nestjs:** make Nexus create paths idempotent (409 conflict tolerance) ([d1fea06](https://github.com/cloud-pi-native/console/commit/d1fea06b0189582cbe759582d57b49b61b994077)), closes [#2619](https://github.com/cloud-pi-native/console/issues/2619)
+* **server-nestjs:** make SonarQube user creation idempotent on create race ([1b29ad6](https://github.com/cloud-pi-native/console/commit/1b29ad6831e580a3d7293a0b950fa1bc419030c7)), closes [#2633](https://github.com/cloud-pi-native/console/issues/2633)
+
+
+### Refactoring
+
+* **admin-role:** remove dead testing-utils exports ([9ed26e0](https://github.com/cloud-pi-native/console/commit/9ed26e07577fd057e0cfa0ce8d756baeef9ee1ea))
+* **admin-roles:** migrate from server ([bec5bc9](https://github.com/cloud-pi-native/console/commit/bec5bc99d71e3dd5dd511278a2afa3c7ac6571e5))
+* **gitlab:** rename ensureCreated to ensure and extract race detection ([7ebaf97](https://github.com/cloud-pi-native/console/commit/7ebaf97a6a78c35470f1db0fbce0f57f8c8b945c))
+* **server-nestjs:** route Keycloak group creation through shared ensure util ([f3095b4](https://github.com/cloud-pi-native/console/commit/f3095b4578cfe55bdba80c7849803c7b0ad270b1))
+* **shared:** add token pair generation and expiration schema ([2d8c83b](https://github.com/cloud-pi-native/console/commit/2d8c83b64ac2d1756872a74066d66344cbb8a7aa))
+
 ## [9.25.0](https://github.com/cloud-pi-native/console/compare/v9.24.0...v9.25.0) (2026-09-02)
 
 
diff --git a/apps/client/package.json b/apps/client/package.json
index 7f4735bed5..0fce1b1785 100644
--- a/apps/client/package.json
+++ b/apps/client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cpn-console/client",
   "type": "module",
-  "version": "9.25.0",
+  "version": "9.26.0-rc",
   "private": false,
   "description": "cpn-console client",
   "repository": {
diff --git a/apps/server-nestjs/package.json b/apps/server-nestjs/package.json
index 7aa450619a..2e883a6823 100644
--- a/apps/server-nestjs/package.json
+++ b/apps/server-nestjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cpn-console/server-nestjs",
-  "version": "9.25.0",
+  "version": "9.26.0-rc",
   "private": true,
   "description": "",
   "author": "",
diff --git a/apps/server/package.json b/apps/server/package.json
index f99de34ec4..51e3d6bff4 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cpn-console/server",
   "type": "module",
-  "version": "9.25.0",
+  "version": "9.26.0-rc",
   "description": "cpn-console server",
   "repository": {
     "type": "git",
diff --git a/package.json b/package.json
index aca6a43f30..39be688bb9 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cpn-console/root",
   "type": "module",
-  "version": "9.25.0",
+  "version": "9.26.0-rc",
   "private": true,
   "packageManager": "pnpm@11.8.0+sha512.c1f5e7c4cb241c8f174b743851d82f42b802324afc8b0f116b96adb15aa06664948dde36960a3ba1079ba5b4b29dd0140135b94b5b5f5263592249d68e555f26",
   "repository": {