diff --git a/Cargo.lock b/Cargo.lock
index 90f6a4d..a73e46c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1754,7 +1754,7 @@ dependencies = [
 
 [[package]]
 name = "picloud"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1783,7 +1783,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-cli"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -1804,7 +1804,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-executor"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "anyhow",
  "picloud-executor-core",
@@ -1816,7 +1816,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-executor-core"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "async-trait",
  "base64",
@@ -1840,7 +1840,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-manager"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "anyhow",
  "picloud-manager-core",
@@ -1852,7 +1852,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-manager-core"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "argon2",
  "async-trait",
@@ -1883,7 +1883,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-orchestrator"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "anyhow",
  "picloud-orchestrator-core",
@@ -1895,7 +1895,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-orchestrator-core"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "async-trait",
  "axum",
@@ -1918,7 +1918,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-shared"
-version = "1.1.7"
+version = "1.1.8"
 dependencies = [
  "aes-gcm",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index 91639ef..1350f47 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.1.7"
+version = "1.1.8"
 edition = "2021"
 rust-version = "1.92"
 license = "MIT OR Apache-2.0"
diff --git a/crates/shared/src/version.rs b/crates/shared/src/version.rs
index ca92fb2..dd4f982 100644
--- a/crates/shared/src/version.rs
+++ b/crates/shared/src/version.rs
@@ -66,7 +66,18 @@ pub const PRODUCT_VERSION: &str = env!("CARGO_PKG_VERSION");
 /// `email:receive`-trigger handlers (inbound email POSTed to the webhook
 /// receiver). The `Services` bundle gains `secrets: Arc<dyn
 /// SecretsService>` and `email: Arc<dyn EmailService>`.
-pub const SDK_VERSION: &str = "1.8";
+///
+/// 1.9 additions (v1.1.8): `users::*` — data-plane user management
+/// (CRUD, login/verify/logout, email verification, password reset,
+/// invitations, string-tagged per-app roles). The `Services` bundle
+/// gains `users: Arc<dyn UsersService>`. Realtime topics gain a third
+/// auth mode `'session'` so SSE subscribers can authenticate against
+/// users::login-minted session tokens (server-side; no new script
+/// SDK affordance for the realtime auth itself — scripts already had
+/// `pubsub::subscriber_token` for the v1.1.6 token path, and
+/// `users::login` returns the bearer the client presents on the SSE
+/// request).
+pub const SDK_VERSION: &str = "1.9";
 
 /// HTTP API major version. Appears in URL paths as `/api/v{N}/...`.
 /// Bump (new integer + new URL prefix) when the request/response
diff --git a/dashboard/package.json b/dashboard/package.json
index 6464627..95fa9a1 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "picloud-dashboard",
-	"version": "0.13.0",
+	"version": "0.14.0",
 	"private": true,
 	"type": "module",
 	"scripts": {