diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74d5bc7b..a5c4c745 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## v1.4.461 (2026-07-28)
+
+### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection
+
+- **Fix:** Shell-escape extension values to prevent command injection in the extension executor, which previously ran commands via `sh -c` with unescaped, user-controlled values interpolated into the command string. All user-controlled values are now wrapped in single quotes with embedded-single-quote escaping prior to interpolation, ensuring the shell treats them as literal arguments. A regression test (`ShellInjectionBlocked`) has been added to verify that malicious input (e.g., `hello; touch /marker`) does not execute unintended shell commands.
+
 ## v1.4.460 (2026-07-24)
 
 ### PR [#2166](https://github.com/danielmiessler/Fabric/pull/2166) by [ksylvan](https://github.com/ksylvan): feat: add Claude Opus 5 support and refresh dependencies
diff --git a/cmd/fabric/version.go b/cmd/fabric/version.go
index 12ec9071..0f595fc8 100644
--- a/cmd/fabric/version.go
+++ b/cmd/fabric/version.go
@@ -1,3 +1,3 @@
 package main
 
-var version = "v1.4.460"
+var version = "v1.4.461"
diff --git a/cmd/generate_changelog/changelog.db b/cmd/generate_changelog/changelog.db
index b383f3e3..2105f7b8 100644
Binary files a/cmd/generate_changelog/changelog.db and b/cmd/generate_changelog/changelog.db differ
diff --git a/cmd/generate_changelog/incoming/2152.txt b/cmd/generate_changelog/incoming/2152.txt
deleted file mode 100644
index 5808eccf..00000000
--- a/cmd/generate_changelog/incoming/2152.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection
-
-- **Fix:** Shell-escape extension values to prevent command injection in the extension executor, which previously ran commands via `sh -c` with unescaped, user-controlled values interpolated into the command string. All user-controlled values are now wrapped in single quotes with embedded-single-quote escaping prior to interpolation, ensuring the shell treats them as literal arguments. A regression test (`ShellInjectionBlocked`) has been added to verify that malicious input (e.g., `hello; touch /marker`) does not execute unintended shell commands.
diff --git a/nix/pkgs/fabric/version.nix b/nix/pkgs/fabric/version.nix
index 6f1ad7b9..a86de663 100644
--- a/nix/pkgs/fabric/version.nix
+++ b/nix/pkgs/fabric/version.nix
@@ -1 +1 @@
-"1.4.460"
+"1.4.461"