diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 6462b17..4c3e4a4 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -27,6 +27,10 @@ on:
         description: Exact approved release-manifest.json SHA-256
         required: true
         type: string
+      immutable_releases_verified:
+        description: Release approver verified enabled=true and enforced_by_owner=true via the admin API
+        required: true
+        type: boolean
 
 permissions: {}
 
@@ -44,6 +48,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Require authorized immutable-release preflight
+        env:
+          IMMUTABLE_RELEASES_VERIFIED: ${{ inputs.immutable_releases_verified }}
+        run: |
+          test "$IMMUTABLE_RELEASES_VERIFIED" = true
       - name: Verify dispatch and candidate build identity
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/README.md b/README.md
index ab12096..80749c8 100644
--- a/README.md
+++ b/README.md
@@ -20,12 +20,15 @@ the package, and publishes the package, `SHA256SUMS`, and
 just check
 just dist
 just sigil-check
-sigil plugin install codec@1.1.1
+sigil plugin install codec@1.1.2
 sigil run examples/visible.lua
 ```
 
-Version 1.1.1 is the first keyless-provenance release. Sigil verifies and pins
-its exact repository, workflow, source commit, protected environment, package,
-manifest, and public transparency proof before installation or evaluation.
-Earlier releases remain historical bootstrap-digest evidence and are never
-promoted in place.
+Version 1.1.2 is the first accepted keyless-provenance release. Sigil verifies
+and pins its exact repository, workflow, source commit, protected environment,
+package, manifest, and public transparency proof before installation or
+evaluation.
+Version 1.1.1 was published while GitHub release immutability was disabled and
+is permanently burned and emergency-denied; its tag and assets are preserved,
+never replaced or deleted. Earlier releases remain historical bootstrap-digest
+evidence and are never promoted in place.
diff --git a/plugin.toml b/plugin.toml
index 9c371aa..d62dc5c 100644
--- a/plugin.toml
+++ b/plugin.toml
@@ -1,6 +1,6 @@
 schema_version = 1
 name = "codec"
-version = "1.1.1"
+version = "1.1.2"
 description = "capability-free reference codec for Sigil plugins"
 license = "MIT"