diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b97b8a..55021e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-08-11
+
+The second MINOR after 1.0.0: domain administrators with per-domain scope, a
+panel visual refresh on the SelfPost palette, and refinements to navigation and
+the send log. Upgrading runs one SQLite migration (`0005_panel_users`); the
+single administrator becomes a global user.
+
 ### Added
 
 - panel: **domain-admin role** — global administrators manage panel users and
@@ -17,6 +24,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Fixed
 
+- Docker build: `LICENSE` is no longer excluded by `.dockerignore`, so the
+  runtime image can copy it into `/usr/share/doc/selfpost/` as AGPL requires. A
+  clean build failed once the cached layer was invalidated.
 - panel: on signed-in pages with a narrow card (**Settings**, the user form)
   the heading, flash, card and footer now share one left edge. `.card.narrow`
   had overridden only `max-width` while `main > *` still centred siblings on
@@ -32,21 +42,24 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 - panel: `/` redirects domain administrators to `/domains`; global users still
   land on `/status`. Navigation hides global-only sections for domain
   administrators.
+- panel: **Sign out** in the navigation column uses the same type size and
+  weight as the page entries above it; only the red tint and border mark it as
+  destructive.
 - panel: **visual style** brought in line with the SelfPost mark — brick accent
   and warm paper in place of the blue-on-cool-grey defaults, IBM Plex Sans and
   IBM Plex Mono served by the panel itself, squarer corners, and column
   headings, status badges and small labels set in the mono face. Light and dark
   schemes both keep their contrast; no page, control or workflow changed. The
   send log stops breaking `Details` and `deferred` across two lines when a row
-  is tight.
+  is tight. Badge padding and line-height are tuned so lowercase labels sit
+  centred in the box. The three WOFF2 files add ~76 KB to the image and are
+  served from the panel's own origin, so the Content-Security-Policy is
+  unchanged (`default-src 'self'`).
 - panel: the send log's **status is a badge**, in the same ok/warn/error/unknown
   colours the status page and the DNS checks use, instead of the one place in
   the panel where a status was bare text. The mapping is the one the delivery
   page already applied — `sent` is ok, `deferred` a warning, `bounced` and
   `rejected` errors, `queued` unknown because nothing has gone wrong yet.
-  The three
-  WOFF2 files add ~76 KB to the image and are served from the panel's own origin,
-  so the Content-Security-Policy is unchanged (`default-src 'self'`).
 - docs: [roadmap.md](docs/roadmap.md) and [product.md](docs/product.md) no
   longer list domain-admin or visual-style as open work — both ship in this line.
   Completed plan files (`domain-admin`, `visual-style`, `web-split`,
diff --git a/README.md b/README.md
index 7dae4b9..579b823 100644
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:1.1.0
+  ghcr.io/mixeme/selfpost:1.2.0
 ```
 
 **Get the setup URL** (pick one):
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index d4dd7b6..1088faf 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -22,7 +22,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:1.1.0
+    image: ghcr.io/mixeme/selfpost:1.2.0
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
diff --git a/docs/development.md b/docs/development.md
index e8b51e1..ad6d860 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -141,7 +141,7 @@ Requires Go 1.26+ and `CGO_ENABLED=0`.
 
 ```sh
 make build        # bin/panel, bin/selfpost-backup (VERSION=dev by default)
-make build VERSION=1.1.0
+make build VERSION=1.2.0
 ```
 
 Or directly:
diff --git a/docs/guide.md b/docs/guide.md
index 5378ee5..1cafd8c 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -381,7 +381,7 @@ but it can look like an open port in external scans.
 ## Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `1.1.0`. Intermediate
+deliberately never `:latest`. The current pin is `1.2.0`. Intermediate
 CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
 image was published. Pinning matters because of the backup version check above:
 the panel binary's embedded version and the image tag that produced it are the
diff --git a/docs/plans/inbound-relay.md b/docs/plans/inbound-relay.md
index a9e4e63..6291ebd 100644
--- a/docs/plans/inbound-relay.md
+++ b/docs/plans/inbound-relay.md
@@ -5,7 +5,7 @@
 the implementation lands (do not fix a major in advance).  
 **Order:** recommended next among agreed 1.x+ items (after `internal/web` split
 and the domain-admin role, both shipped — see [CHANGELOG](../CHANGELOG.md)
-`[1.1.0]` and `[Unreleased]`).
+`[1.2.0]`).
 
 ---