diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8eee9b7..318b32c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,25 @@ permissions:
   contents: read
 
 jobs:
+  store:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          workspaces: desktop
+      - run: cargo test -p atlas-store --locked
+
   web:
     runs-on: ubuntu-latest
     timeout-minutes: 15
diff --git a/CLEANUP_TODO.md b/CLEANUP_TODO.md
index 80818f5..4ee30ea 100644
--- a/CLEANUP_TODO.md
+++ b/CLEANUP_TODO.md
@@ -18,14 +18,17 @@ original dependency declarations; it is not a claim about deployed versions.
 
 ## Current validation and release status
 
-The modular **0.4.3 release is published** with all 22 library artifacts and its
-integrity catalog. All 11 direct applications have been migrated in their local
-working trees to GitHub release URLs and canonical imports after isolated
-0.4.3 installs, typechecks, audits, CLI checks, and application tests passed.
+The modular **0.4.4 release is published** with all 22 library artifacts and its
+integrity catalog. All 11 direct applications use it in their local working trees,
+with frozen GitHub installs, typechecks, and the shipped CLI guard passing.
+Isolated 0.4.3 application suites passed; 0.4.4 changes dependency closure and the
+CLI guard, with a new isolated production UI render gate. Inkling's actual 0.4.4
+PostgreSQL suite also passes all 397 cases.
 Original files and lockfiles are retained in the private migration backup recorded
-by the local migration receipt. The 0.4.4 candidate adds explicit required external
-peers for production UI installs and excludes hidden checkouts from source checks;
-it must pass release verification before applications advance to it.
+by the local migration receipt. The 0.4.7 candidate preserves native credential
+backends and Linux entry names after the keyring upgrade. Old/new macOS credential
+interoperability passed with a disposable test entry; Linux and Windows checks
+must pass before this candidate is released or native clients advance to it.
 Distribution stays in `wess/atlas`; no npm token or local Atlas checkout is required.
 Production has only been inspected read-only; no application deployment has changed.
 
@@ -45,8 +48,8 @@ Production has only been inspected read-only; no application deployment has chan
   signup/login/post persistence, and admin API access for anonymous/user/admin roles.
   The fixture verifier is now required in CI and release workflows.
 - Pluck's Sharp security update is applied to its working tree and lockfile. Other
-  compatibility fixes are applied where they remain compatible with pinned Atlas;
-  the full Atlas dependency migrations remain pending publication.
+  compatibility fixes and modular library migrations are applied to the 11 direct
+  app working trees; downstream site and native-client updates remain in progress.
 - Web dependency audit reports no vulnerabilities or outdated packages. Desktop
   `cargo audit` reports zero vulnerabilities but 13 unmaintained dependency warnings
   (including duplicate versions). These are unresolved maintenance risks, not a
@@ -62,6 +65,11 @@ Production has only been inspected read-only; no application deployment has chan
   bytes RSS; the packed candidate peaked at 110,706,688 bytes (about 90% less).
   Total time was 582 ms versus 495 ms. These local results include the receiver
   in the same process and do not replace production latency or capacity testing.
+- A three-trial local HTTP comparison (32 concurrent clients, 20,000 measured
+  requests after warmup per trial) produced median throughput of 57,709 versus
+  57,688 requests/sec and p95 latency of 0.809 versus 0.841 ms. Median startup
+  was 12.62 versus 12.89 ms. This small server fixture shows similar performance;
+  it does not establish fleet-wide resource or latency changes.
 - Clean production installs use `bun install --production --omit=peer --frozen-lockfile`.
   Selected module closures and external peers are explicit application dependencies.
   The plain `--production` test retained the development CLI through optional peers;
diff --git a/desktop/Cargo.lock b/desktop/Cargo.lock
index a856922..cc6f4ca 100644
--- a/desktop/Cargo.lock
+++ b/desktop/Cargo.lock
@@ -15,22 +15,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
- "cipher 0.4.4",
+ "cipher",
  "cpufeatures 0.2.17",
  "zeroize",
 ]
 
-[[package]]
-name = "aes"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
-dependencies = [
- "cipher 0.5.2",
- "cpubits",
- "cpufeatures 0.3.1",
-]
-
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -442,7 +431,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-bridge"
-version = "0.1.1"
+version = "0.1.4"
 dependencies = [
  "futures",
  "gpui",
@@ -451,11 +440,11 @@ dependencies = [
 
 [[package]]
 name = "atlas-build"
-version = "0.1.1"
+version = "0.1.4"
 
 [[package]]
 name = "atlas-core"
-version = "0.1.1"
+version = "0.1.4"
 dependencies = [
  "chrono",
  "uuid",
@@ -463,7 +452,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-desktop"
-version = "0.1.1"
+version = "0.1.4"
 dependencies = [
  "atlas-bridge",
  "atlas-core",
@@ -475,7 +464,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-shell"
-version = "0.1.1"
+version = "0.1.4"
 dependencies = [
  "gpui",
  "guise-ui",
@@ -483,14 +472,17 @@ dependencies = [
 
 [[package]]
 name = "atlas-store"
-version = "0.1.1"
+version = "0.1.4"
 dependencies = [
+ "apple-native-keyring-store",
  "dirs 7.0.0",
- "keyring",
+ "keyring-core",
+ "linux-keyutils-keyring-store",
  "serde",
  "serde_json",
  "tempfile",
  "tracing",
+ "windows-native-keyring-store",
 ]
 
 [[package]]
@@ -713,15 +705,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-padding"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -836,16 +819,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
 dependencies = [
- "cipher 0.4.4",
-]
-
-[[package]]
-name = "cbc"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
-dependencies = [
- "cipher 0.5.2",
+ "cipher",
 ]
 
 [[package]]
@@ -940,20 +914,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout 0.1.4",
+ "inout",
  "zeroize",
 ]
 
-[[package]]
-name = "cipher"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
-dependencies = [
- "crypto-common 0.2.2",
- "inout 0.2.5",
-]
-
 [[package]]
 name = "clang-sys"
 version = "1.9.1"
@@ -965,12 +929,6 @@ dependencies = [
  "libloading",
 ]
 
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
 [[package]]
 name = "cocoa"
 version = "0.25.0"
@@ -1281,12 +1239,6 @@ dependencies = [
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "cpubits"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1390,15 +1342,6 @@ version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2931af7e13dc045d8e9d26afccc6fa115d64e115c9c84b1166288b46f6782c2"
 
-[[package]]
-name = "ctutils"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
-dependencies = [
- "cmov",
-]
-
 [[package]]
 name = "data-url"
 version = "0.3.2"
@@ -1444,7 +1387,6 @@ dependencies = [
  "block-buffer 0.12.1",
  "const-oid",
  "crypto-common 0.2.2",
- "ctutils",
 ]
 
 [[package]]
@@ -2611,16 +2553,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac 0.12.1",
-]
-
-[[package]]
-name = "hkdf"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
-dependencies = [
- "hmac 0.13.0",
+ "hmac",
 ]
 
 [[package]]
@@ -2632,15 +2565,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
-
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -2948,20 +2872,10 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding 0.3.3",
+ "block-padding",
  "generic-array",
 ]
 
-[[package]]
-name = "inout"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b5cf4372d022092674a83b8febf5865f7a573cc0c5baec5e49c879b6a20978f"
-dependencies = [
- "block-padding 0.4.2",
- "hybrid-array",
-]
-
 [[package]]
 name = "instant"
 version = "0.1.13"
@@ -3073,18 +2987,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "keyring"
-version = "4.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2270074a3d26bcac93c1dc5d2845eb4c089e8d761ccf6e0ea266a16004640627"
-dependencies = [
- "apple-native-keyring-store",
- "keyring-core",
- "windows-native-keyring-store",
- "zbus-secret-service-keyring-store",
-]
-
 [[package]]
 name = "keyring-core"
 version = "1.0.1"
@@ -3195,6 +3097,26 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "linux-keyutils"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83270a18e9f90d0707c41e9f35efada77b64c0e6f3f1810e71c8368a864d5590"
+dependencies = [
+ "bitflags 2.13.2",
+ "libc",
+]
+
+[[package]]
+name = "linux-keyutils-keyring-store"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39fbed79f71dc21eb21d3d07c0e908a3c58ff9a1fdbf5cf44230fb3deb6d994b"
+dependencies = [
+ "keyring-core",
+ "linux-keyutils",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -3815,21 +3737,21 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3299dd401feaf1d45afd8fd1c0586f10fcfb22f244bb9afa942cec73503b89d"
 dependencies = [
- "aes 0.8.4",
+ "aes",
  "ashpd 0.12.3",
  "async-fs",
  "async-io",
  "async-lock",
  "blocking",
- "cbc 0.1.2",
- "cipher 0.4.4",
+ "cbc",
+ "cipher",
  "digest 0.10.7",
  "endi",
  "futures-lite 2.6.1",
  "futures-util",
  "getrandom 0.3.4",
- "hkdf 0.12.4",
- "hmac 0.12.1",
+ "hkdf",
+ "hmac",
  "md-5",
  "num",
  "num-bigint-dig",
@@ -3943,7 +3865,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
  "digest 0.10.7",
- "hmac 0.12.1",
+ "hmac",
 ]
 
 [[package]]
@@ -4904,25 +4826,6 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
-[[package]]
-name = "secret-service"
-version = "5.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5107b24b91445dd2aa449a258a1807b63240942157292354dc5bfdbeb8bc6db8"
-dependencies = [
- "aes 0.9.3",
- "cbc 0.2.1",
- "futures-util",
- "getrandom 0.4.3",
- "hkdf 0.13.0",
- "hybrid-array",
- "num",
- "once_cell",
- "serde",
- "sha2 0.11.1",
- "zbus",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -7205,17 +7108,6 @@ dependencies = [
  "zvariant",
 ]
 
-[[package]]
-name = "zbus-secret-service-keyring-store"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74801d001b9e7729adb4f1825b67b398185fed424749aa3d8bacf70417137d9a"
-dependencies = [
- "keyring-core",
- "secret-service",
- "zbus",
-]
-
 [[package]]
 name = "zbus_macros"
 version = "5.19.0"
diff --git a/desktop/Cargo.toml b/desktop/Cargo.toml
index 57f5313..f9cf059 100644
--- a/desktop/Cargo.toml
+++ b/desktop/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 exclude = ["templates"]
 
 [workspace.package]
-version = "0.1.1"
+version = "0.1.4"
 edition = "2021"
 license = "MIT"
 authors = ["Wess Cope <opensource@wess.io>"]
@@ -41,7 +41,7 @@ chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1", features = ["v4"] }
 dirs = "7.0.0"
 tracing = "0.1"
-keyring = "4.2.0"
+keyring-core = "1.0.1"
 
 # The Atlas crates themselves.
 atlas-core = { version = "0.1.0", path = "crates/core" }
diff --git a/desktop/crates/store/Cargo.toml b/desktop/crates/store/Cargo.toml
index 39af4e7..9f113db 100644
--- a/desktop/crates/store/Cargo.toml
+++ b/desktop/crates/store/Cargo.toml
@@ -15,6 +15,15 @@ path = "src/lib.rs"
 serde = { workspace = true }
 serde_json = { workspace = true }
 dirs = { workspace = true }
-keyring = { workspace = true }
+keyring-core = { workspace = true }
 tracing = { workspace = true }
 tempfile = "3"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+apple-native-keyring-store = { version = "1.0.2", features = ["keychain"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+linux-keyutils-keyring-store = "1.0.0"
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-native-keyring-store = "1.1.0"
diff --git a/desktop/crates/store/src/json.rs b/desktop/crates/store/src/json.rs
index 0743a10..1d9528f 100644
--- a/desktop/crates/store/src/json.rs
+++ b/desktop/crates/store/src/json.rs
@@ -58,7 +58,10 @@ pub fn write<T: Serialize>(path: &Path, value: &T) -> std::io::Result<()> {
         writer.flush()?;
     }
     tmp.as_file().sync_all()?;
-    tmp.persist(path).map_err(|e| e.error)?;
+    // std handles open destination readers on Windows; tempfile's persist does not
+    let mut tmp = tmp.into_temp_path();
+    std::fs::rename(&tmp, path)?;
+    tmp.disable_cleanup(true);
     Ok(())
 }
 
diff --git a/desktop/crates/store/src/keychain.rs b/desktop/crates/store/src/keychain.rs
index 2618241..2babd24 100644
--- a/desktop/crates/store/src/keychain.rs
+++ b/desktop/crates/store/src/keychain.rs
@@ -9,13 +9,16 @@
 //! — so every document is written as single-line JSON, and that is asserted
 //! rather than assumed.
 //!
-//! Every operation degrades to `None`/`false` rather than panicking. A machine
-//! with no keychain (a headless Linux box with no secret service running) must
-//! still start the app; it just cannot remember a password.
+//! Every operation degrades to `None`/`false` rather than panicking when the
+//! native store is unavailable. macOS uses the login keychain, Windows uses
+//! Credential Manager, and Linux keeps kernel keyutils and its existing key names.
 
+use keyring_core as keyring;
 use serde::de::DeserializeOwned;
 use serde::Serialize;
 
+mod store;
+
 #[derive(Clone, Debug)]
 pub struct Keychain {
     service: String,
@@ -31,7 +34,7 @@ impl Keychain {
     }
 
     fn entry(&self, key: &str) -> Option<keyring::Entry> {
-        match keyring::Entry::new(&self.service, key) {
+        match store::entry(&self.service, key) {
             Ok(entry) => Some(entry),
             Err(e) => {
                 tracing::warn!("keychain unavailable for {key}: {e}");
diff --git a/desktop/crates/store/src/keychain/store.rs b/desktop/crates/store/src/keychain/store.rs
new file mode 100644
index 0000000..259f7f5
--- /dev/null
+++ b/desktop/crates/store/src/keychain/store.rs
@@ -0,0 +1,38 @@
+use std::sync::{Arc, LazyLock};
+
+use keyring_core::{CredentialStore, Entry, Error, Result};
+
+static STORE: LazyLock<Result<Arc<CredentialStore>>> = LazyLock::new(open);
+
+#[cfg(target_os = "macos")]
+fn open() -> Result<Arc<CredentialStore>> {
+  Ok(apple_native_keyring_store::keychain::Store::new()?)
+}
+
+#[cfg(target_os = "linux")]
+fn open() -> Result<Arc<CredentialStore>> {
+  Ok(linux_keyutils_keyring_store::Store::new()?)
+}
+
+#[cfg(target_os = "windows")]
+fn open() -> Result<Arc<CredentialStore>> {
+  Ok(windows_native_keyring_store::Store::new()?)
+}
+
+#[cfg(not(any(target_os = "macos", target_os = "linux", target_os = "windows")))]
+fn open() -> Result<Arc<CredentialStore>> {
+  Err(Error::NoDefaultStore)
+}
+
+pub(super) fn entry(service: &str, key: &str) -> Result<Entry> {
+  let store = STORE.as_ref().map_err(|_| Error::NoDefaultStore)?;
+  #[cfg(target_os = "linux")]
+  {
+    // keep the v3 kernel-key identity; the new provider defaults to another format
+    let description = format!("keyring-rs:{key}@{service}");
+    let modifiers = std::collections::HashMap::from([("description", description.as_str())]);
+    store.build(service, key, Some(&modifiers))
+  }
+  #[cfg(not(target_os = "linux"))]
+  store.build(service, key, None)
+}
diff --git a/desktop/crates/store/tests/json.rs b/desktop/crates/store/tests/json.rs
index 713fac9..2e00e55 100644
--- a/desktop/crates/store/tests/json.rs
+++ b/desktop/crates/store/tests/json.rs
@@ -1,5 +1,34 @@
 use atlasstore::json;
 
+#[test]
+fn open_readers_keep_the_previous_document_during_replacement() {
+    use std::io::Read;
+
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("state.json");
+    json::write(&path, &"previous").unwrap();
+    let mut previous = std::fs::File::open(&path).unwrap();
+    json::write(&path, &"updated").unwrap();
+
+    let mut text = String::new();
+    previous.read_to_string(&mut text).unwrap();
+    assert_eq!(serde_json::from_str::<String>(&text).unwrap(), "previous");
+    assert_eq!(json::read::<String>(&path).unwrap().unwrap(), "updated");
+    assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+}
+
+#[test]
+fn failed_replacement_preserves_the_destination_and_removes_the_temporary_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("state.json");
+    std::fs::create_dir(&path).unwrap();
+    std::fs::write(path.join("keep"), "untouched").unwrap();
+
+    assert!(json::write(&path, &"updated").is_err());
+    assert_eq!(std::fs::read_to_string(path.join("keep")).unwrap(), "untouched");
+    assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+}
+
 #[test]
 fn simultaneous_writes_leave_one_complete_document() {
     let dir = tempfile::tempdir().unwrap();
diff --git a/desktop/crates/store/tests/keychain.rs b/desktop/crates/store/tests/keychain.rs
new file mode 100644
index 0000000..6f8470c
--- /dev/null
+++ b/desktop/crates/store/tests/keychain.rs
@@ -0,0 +1,31 @@
+#[cfg(target_os = "linux")]
+#[test]
+fn credentials_keep_the_existing_kernel_key_identity() {
+  use atlasstore::Keychain;
+  use keyring_core::api::CredentialStoreApi;
+  use std::collections::HashMap;
+  use std::time::{SystemTime, UNIX_EPOCH};
+
+  let id = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos();
+  let service = format!("io.wess.atlas.tests.{}.{}", std::process::id(), id);
+  let description = format!("keyring-rs:legacy@{service}");
+  let modifiers = HashMap::from([("description", description.as_str())]);
+  let legacy = linux_keyutils_keyring_store::Store::new()
+    .unwrap()
+    .build(&service, "legacy", Some(&modifiers))
+    .unwrap();
+  legacy.set_password("previous-test-value").unwrap();
+
+  let vault = Keychain::new(&service);
+  let previous = vault.get("legacy");
+  let written = vault.put("legacy", "updated-test-value");
+  let updated = legacy.get_password();
+  vault.delete("legacy");
+  let removed = matches!(legacy.get_password(), Err(keyring_core::Error::NoEntry));
+  let _ = legacy.delete_credential();
+
+  assert_eq!(previous.as_deref(), Some("previous-test-value"));
+  assert!(written);
+  assert_eq!(updated.unwrap(), "updated-test-value");
+  assert!(removed);
+}
diff --git a/desktop/docs/architecture.md b/desktop/docs/architecture.md
index 0a6de03..c8c58ef 100644
--- a/desktop/docs/architecture.md
+++ b/desktop/docs/architecture.md
@@ -102,6 +102,12 @@ Secrets go to the keychain, never into the JSON. The values are written as
 single-line JSON because **the macOS keychain hex-encodes a value containing a
 newline**, which silently corrupts it on read.
 
+The native provider is explicit: macOS login Keychain, Windows Credential Manager,
+and Linux kernel keyutils. Linux retains the existing `keyring-rs:<key>@<service>`
+description when dependencies change. Provider entries are built directly, without
+changing another library's process-wide credential store. No credential migration
+or Secret Service dependency is required.
+
 ## The chrome
 
 `atlas-shell` is everything that draws and is not the product:
diff --git a/package.json b/package.json
index 77e343f..b9d988f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.4",
+  "version": "0.4.7",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/AGENTS.md b/web/AGENTS.md
index 3e5e002..4ef13d2 100644
--- a/web/AGENTS.md
+++ b/web/AGENTS.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/CLAUDE.md b/web/CLAUDE.md
index 198f0f8..10008f1 100644
--- a/web/CLAUDE.md
+++ b/web/CLAUDE.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/README.md b/web/README.md
index a585386..484038c 100644
--- a/web/README.md
+++ b/web/README.md
@@ -12,11 +12,11 @@ No framework lock-in. No classes. Just functions and immutable data flowing thro
 
 ## Install
 
-Install the coordinated `0.4.4` libraries from this repository's GitHub release
+Install the coordinated `0.4.7` libraries from this repository's GitHub release
 assets. The release workflow verifies all artifacts before making them available.
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server config db/query db/postgres
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server config db/query db/postgres
 ```
 
 The installer records exact GitHub release URLs, tested external versions, and the dependency closure for
@@ -89,7 +89,7 @@ Build a user API with authentication in 60 lines.
 ```bash
 mkdir myapp && cd myapp
 bun init -y
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
 ```
 
 The example below uses public `@wess/atlas/<pkg>` exports from the selected libraries.
diff --git a/web/docs/agents.md b/web/docs/agents.md
index 3e64c06..b11a8ca 100644
--- a/web/docs/agents.md
+++ b/web/docs/agents.md
@@ -33,7 +33,7 @@ the document head.
 Select released library modules with the Atlas installer:
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server config db/postgres db/query
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server config db/postgres db/query
 ```
 
 See README.md for the release candidate's publication status. Import public
diff --git a/web/package.json b/web/package.json
index 2ab6dc3..0d38ec5 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.4",
+  "version": "0.4.7",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/packages/cli/AGENTS.md b/web/packages/cli/AGENTS.md
index 71e1833..de79de9 100644
--- a/web/packages/cli/AGENTS.md
+++ b/web/packages/cli/AGENTS.md
@@ -86,7 +86,7 @@ atlas add               # lists available packages
 Check an application's manifests, Bun lockfile, installed Atlas links, source imports,
 and TypeScript aliases. Atlas facade and backing libraries must use the same exact
 stable version. Local paths, legacy aliases, and links outside node_modules fail the check.
-Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas check` in application CI after a frozen install.
+Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas check` in application CI after a frozen install.
 
 ### atlas dev
 
@@ -147,7 +147,7 @@ const questions = getQuestionSpec()
 ## Global Installation
 
 ```sh
-bun add -g https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz
+bun add -g https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz
 atlas init
 ```
 
diff --git a/web/packages/cli/modules/catalog.json b/web/packages/cli/modules/catalog.json
index 236d177..872423e 100644
--- a/web/packages/cli/modules/catalog.json
+++ b/web/packages/cli/modules/catalog.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.4.4",
+  "version": "0.4.7",
   "exports": {
     "./admin": {
       "entry": "packages/admin/index.ts",
diff --git a/web/packages/cli/test/init.test.ts b/web/packages/cli/test/init.test.ts
index c98285e..067a5ec 100644
--- a/web/packages/cli/test/init.test.ts
+++ b/web/packages/cli/test/init.test.ts
@@ -72,11 +72,11 @@ test("applyDefaults accepts partial overrides", () => {
 test("generated projects select versioned Atlas libraries", () => {
   const answers = applyDefaults({ template: "custom", features: ["auth", "storage", "admin"] });
   const pkg = JSON.parse(generatePackageJson(answers));
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.4"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.7"));
   expect(Object.values(pkg.dependencies).some((value) => /^(file:|link:|workspace:|github:)/.test(String(value)))).toBe(
     false,
   );
@@ -107,8 +107,8 @@ test("frontend scaffolds declare the UI peer dependencies", () => {
   const pkg = JSON.parse(generatePackageJson(applyDefaults({ template: "custom", frontend: true })));
   expect(pkg.dependencies.react).toBeDefined();
   expect(pkg.dependencies["@mantine/core"]).toBeDefined();
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.4"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.7"));
   expect(pkg.dependencies["@tanstack/react-table"]).toBeUndefined();
 });
 
diff --git a/web/templates/admin/package.json b/web/templates/admin/package.json
index 9d15976..dd4683b 100644
--- a/web/templates/admin/package.json
+++ b/web/templates/admin/package.json
@@ -11,18 +11,18 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-admin-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-admin-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/ai/package.json b/web/templates/ai/package.json
index bcf23e5..307ca83 100644
--- a/web/templates/ai/package.json
+++ b/web/templates/ai/package.json
@@ -10,16 +10,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-ai-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-ai-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/api/package.json b/web/templates/api/package.json
index e4bd64e..173fa0c 100644
--- a/web/templates/api/package.json
+++ b/web/templates/api/package.json
@@ -11,16 +11,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/cms/package.json b/web/templates/cms/package.json
index e23a142..033f1f1 100644
--- a/web/templates/cms/package.json
+++ b/web/templates/cms/package.json
@@ -9,20 +9,20 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-admin-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-admin-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-migrate-0.4.4.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-storage-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-request-0.4.4.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-migrate-0.4.7.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-storage-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-request-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/edge/package.json b/web/templates/edge/package.json
index da047a5..299f255 100644
--- a/web/templates/edge/package.json
+++ b/web/templates/edge/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint ."
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-edge-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-edge-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/fullstack/package.json b/web/templates/fullstack/package.json
index 7aa2829..23c3883 100644
--- a/web/templates/fullstack/package.json
+++ b/web/templates/fullstack/package.json
@@ -15,11 +15,11 @@
     "@mantine/hooks": "^9.7.3",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-ui-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-ui-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
@@ -27,6 +27,6 @@
     "@types/react-dom": "^19.3.0",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/minimal/package.json b/web/templates/minimal/package.json
index 1d358bf..d3417d6 100644
--- a/web/templates/minimal/package.json
+++ b/web/templates/minimal/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/realtime/package.json b/web/templates/realtime/package.json
index a95bcf6..2df1adc 100644
--- a/web/templates/realtime/package.json
+++ b/web/templates/realtime/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/socialnetwork/package.json b/web/templates/socialnetwork/package.json
index 22eac4a..4d8e35d 100644
--- a/web/templates/socialnetwork/package.json
+++ b/web/templates/socialnetwork/package.json
@@ -9,19 +9,19 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-admin-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-admin-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-migrate-0.4.4.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-storage-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-migrate-0.4.7.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-storage-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/worker/package.json b/web/templates/worker/package.json
index 11a87f0..e1f8cf8 100644
--- a/web/templates/worker/package.json
+++ b/web/templates/worker/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cache-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cache-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/validation/fleet.ts b/web/validation/fleet.ts
index f20e3a9..733c1d2 100644
--- a/web/validation/fleet.ts
+++ b/web/validation/fleet.ts
@@ -73,7 +73,7 @@ export async function validateFleet(
     }
     const intended = structuredClone(app);
     // the next Inkling tag must be released with GitHub-backed Atlas dependencies
-    intended.dependencies.inkling = "github:wess/inkling#v1.24.0";
+    intended.dependencies.inkling = `github:wess/inkling#v${manifest.version}`;
     intended.engines = { ...intended.engines, bun: ">=1.4.4" };
     await Bun.write(join(directory, "migration.json"), JSON.stringify(intended, null, 2));
     app.dependencies.inkling = tarball;