diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 99e8e2b..6c070b6 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,10 +1,6 @@
-# Default reviewer: each PR auto-requests the squad lead listed here.
-# Either reviewer can approve to satisfy branch protection (1 approval required).
-# Specific paths below override this default for security-sensitive code.
+# Narrow CODEOWNERS — security backstop only.
+# Author picks reviewers for everything else.
 
-*    @saadqbal @saqlainsyed007
-
-# === Narrow security CODEOWNERS (preserved from prior PRs) ===
 /client/templates/                                      @saadqbal
 /client/values.schema.json                              @saadqbal
 /client/values.yaml                                     @saadqbal
diff --git a/client/Chart.yaml b/client/Chart.yaml
index fec33e8..afbcdcf 100644
--- a/client/Chart.yaml
+++ b/client/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: client
 description: A unified Helm chart for tracebloc on AKS, EKS, bare-metal, and OpenShift
 type: application
-version: 1.3.0
-appVersion: "1.3.0"
+version: 1.3.1
+appVersion: "1.3.1"
 keywords:
   - tracebloc
   - kubernetes
diff --git a/client/MIGRATION.md b/client/MIGRATION.md
index 653c793..90e3a90 100644
--- a/client/MIGRATION.md
+++ b/client/MIGRATION.md
@@ -10,6 +10,10 @@ Releases of 1.3.0+ install a `<release>-auto-upgrade` CronJob that polls
 published. This closes [tracebloc/client#69](https://github.com/tracebloc/client/issues/69) —
 older deployed clients stop drifting from the latest secure / stable release.
 
+> **Verified end-to-end on `tb-client-dev-templates` during the 1.3.1 release**:
+> a `tracebloc` release at 1.3.0 self-upgraded to 1.3.1 within a single
+> CronJob tick after publish, with no operator intervention.
+
 > **Operator note for the 1.x → 1.3.0 jump.** Use `--reset-then-reuse-values`
 > on the *manual* upgrade command too, not plain `--reuse-values`. The new
 > `autoUpgrade` block was added in 1.3.0; with `--reuse-values` Helm reuses