diff --git a/CHANGELOG.md b/CHANGELOG.md
index e7e9eb6..dc0d3d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-08-10
+
+The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL
+packaging on every page, and an internal split of `internal/web` ahead of
+domain-admin work. Upgrading runs one SQLite migration (empty defaults;
+existing DNS guidance is unchanged until you set a report address).
+
 ### Changed
 
 - `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
@@ -40,12 +47,6 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
-- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
-  is now `p=none` without `rua=` by default; *Settings* and each domain page
-  let you configure an optional aggregate-report address (profile default plus
-  per-domain inherit / none / custom). When `rua=` targets another domain, the
-  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
-  Domain export/import carries per-domain overrides.
 - `SECURITY.md` — how to report a vulnerability privately (GitHub private
   vulnerability reporting, `public@mixeme.ru` as fallback), which releases get
   fixes, and what is in and out of scope for a relay. No response time is
@@ -112,12 +113,6 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
-- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
-  is now `p=none` without `rua=` by default; *Settings* and each domain page
-  let you configure an optional aggregate-report address (profile default plus
-  per-domain inherit / none / custom). When `rua=` targets another domain, the
-  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
-  Domain export/import carries per-domain overrides.
 - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
   `mail.log` lines Postfix wrote about that message, oldest first — the
   connection to the receiving server, its reply, and the status that reply was
@@ -239,12 +234,6 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
-- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
-  is now `p=none` without `rua=` by default; *Settings* and each domain page
-  let you configure an optional aggregate-report address (profile default plus
-  per-domain inherit / none / custom). When `rua=` targets another domain, the
-  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
-  Domain export/import carries per-domain overrides.
 - A page per delivery (`/deliveries/{id}`), reached from the *Details* link on
   every send-log row. It carries what the log itself no longer shows — the
   sending domain, the application the message was submitted under, the Postfix
@@ -460,12 +449,6 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
-- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
-  is now `p=none` without `rua=` by default; *Settings* and each domain page
-  let you configure an optional aggregate-report address (profile default plus
-  per-domain inherit / none / custom). When `rua=` targets another domain, the
-  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
-  Domain export/import carries per-domain overrides.
 - Optional password encryption for the two secret-bearing downloads (plan
   phase 1.5, `docs/code-review.md`): an *Encrypt with a password* checkbox on
   the full-backup and domain-export forms writes a `.spbk` / `.spde` envelope
@@ -567,12 +550,6 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
-- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
-  is now `p=none` without `rua=` by default; *Settings* and each domain page
-  let you configure an optional aggregate-report address (profile default plus
-  per-domain inherit / none / custom). When `rua=` targets another domain, the
-  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
-  Domain export/import carries per-domain overrides.
 - The project's mark is now in use rather than only on file. The README opens
   with the full stamp; the panel carries the compact one at the left of its
   navigation bar, linking to the status page, and the full one above the card
@@ -805,12 +782,6 @@ of `docs/implementation-plan.md`).
 
 ### Added
 
-- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
-  is now `p=none` without `rua=` by default; *Settings* and each domain page
-  let you configure an optional aggregate-report address (profile default plus
-  per-domain inherit / none / custom). When `rua=` targets another domain, the
-  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
-  Domain export/import carries per-domain overrides.
 - Panel (Go, single static binary) with SQLite persistence, one-time
   crypto-random setup link, bcrypt admin auth, session cookies.
 - Domain management with per-domain DKIM (RSA-2048, generated in pure Go) and
diff --git a/README.md b/README.md
index 6c7bd4f..7dae4b9 100644
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:1.0.1
+  ghcr.io/mixeme/selfpost:1.1.0
 ```
 
 **Get the setup URL** (pick one):
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 6f803df..d4dd7b6 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -22,7 +22,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:1.0.1
+    image: ghcr.io/mixeme/selfpost:1.1.0
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
diff --git a/docs/development.md b/docs/development.md
index 072f4f1..e8b51e1 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -141,7 +141,7 @@ Requires Go 1.26+ and `CGO_ENABLED=0`.
 
 ```sh
 make build        # bin/panel, bin/selfpost-backup (VERSION=dev by default)
-make build VERSION=1.0.1
+make build VERSION=1.1.0
 ```
 
 Or directly:
diff --git a/docs/guide.md b/docs/guide.md
index 251b0a6..5378ee5 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -381,7 +381,7 @@ but it can look like an open port in external scans.
 ## Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `1.0.1`. Intermediate
+deliberately never `:latest`. The current pin is `1.1.0`. Intermediate
 CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
 image was published. Pinning matters because of the backup version check above:
 the panel binary's embedded version and the image tag that produced it are the
diff --git a/docs/plans/web-split.md b/docs/plans/web-split.md
index 2638d12..97c7b00 100644
--- a/docs/plans/web-split.md
+++ b/docs/plans/web-split.md
@@ -1,6 +1,6 @@
 # Plan: web-split (splitting `internal/web`)
 
-**Status:** done (see [CHANGELOG](../CHANGELOG.md) `[Unreleased]`)  
+**Status:** done (see [CHANGELOG](../CHANGELOG.md) `[1.1.0]`)  
 **Version:** `1.x`; an internal refactor, it does not force a break on its own.
 
 ---