diff --git a/CHECKSUMS.txt b/CHECKSUMS.txt
index 521f8e6..6733cec 100644
--- a/CHECKSUMS.txt
+++ b/CHECKSUMS.txt
@@ -11,7 +11,6 @@
 4BE89F930738813EDBEAF483B71263D7C93CF04C090EB7F5722E9BAA91E3339E  TASK-SEQUENCE.md
 72113F7FDCEC707FDBCC0825F696EE67C419B0BF01963A2A48755C582047FA14  CODE_OF_CONDUCT.md
 77EFEA7044A969E429538D0863AFD5C05B481A4E97AD7B4B437F5E1CAA43950C  assets/README.md
-785F1C9CD791EA87EA53E0E4C058D26C0499AD44B614FB5CDFB5D56623A509F2  RELEASE-NOTES.md
 8173AF643AB11708ADB706F8EE258B64F697A500951E67ED3BA8B4C26B9CD140  .gitignore
 8BB5536BD0A7529406371E507C01F76757A84EB52453E71F600E5E35AF7AB73D  docs/COMPATIBILITY-MATRIX.md
 8C5A69942136345CF522BD11A014104AA8D4FE6FE80EFC335C731A923158F99C  SECURITY.md
@@ -29,3 +28,4 @@ BFE846987094295386DD402ABB9114B5D104C70FAF7615AB48CCA02A9E35BB63  .github/ISSUE_
 CE16C3B2F70009ECC731E23ED6168AC7F99693D60DF794327DCBEFB7596610C0  assets/css/style.scss
 DF3A074261544800B739DEE93B071DE5383EFE796B874D7673AD69A5548F7A4A  .github/FUNDING.yml
 EE0AE7CB2CDBA1FCE9931C070088CB6111695425DAD8C5EDF42522695B018B05  assets/banner-compact.svg
+EE311DF99A2C7D0296DFB1518266256ABFB266C5463C14751072DBCD7769A6E0  RELEASE-NOTES.md
diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md
index df5e81c..1fbed2e 100644
--- a/RELEASE-NOTES.md
+++ b/RELEASE-NOTES.md
@@ -1,5 +1,33 @@
 # Release notes
 
+## v1.0.1
+
+Version 1.0.1 is a safety and integrity maintenance release.
+
+### Fixed
+
+- Rejects task-sequence content and script paths that use a DNS alias resolving
+  to the local computer, and fails closed when a UNC host cannot be resolved.
+- Verifies every maintained file against `CHECKSUMS.txt`, rejecting malformed,
+  duplicate, missing, extra, or mismatched entries.
+- Defines deterministic repository line endings for reproducible script and
+  manifest bytes.
+
+### Updated
+
+- Documents the Windows 11 26H1 new-hardware boundary, the ConfigMgr 2603+
+  requirement for Windows 11 26H2, current ADK architecture constraints, and
+  MDT retirement.
+- Expands automated coverage for local FQDNs, alternate local DNS aliases, and
+  unresolved network hosts.
+
+### Validation boundary
+
+Windows PowerShell 5.1 validation passed all 63 Pester tests, PSScriptAnalyzer,
+root/package byte parity, and complete checksum verification. Live ConfigMgr,
+WinPE, firmware, storage-driver, OS-image, and disposable-disk acceptance
+testing remains required before rollout. Version 1.0.1 is not field-certified.
+
 ## v1.0.0
 
 This is the **2026-10-06 consolidated v1.0.0 baseline**. Earlier downloads with