diff --git a/CHANGELOG.md b/CHANGELOG.md
index bea5586..de91041 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,17 @@
 
 No changes yet.
 
+## 1.2.8 — 2026-10-24
+
+- Publish the loaded environment name list (`SYMFONY_DOTENV_VARS`) once per parsed file and once per cache restore instead of once per variable; restoring n cached values no longer costs n list rebuilds.
+- Sample each process environment value once per reader. A `putenv()` made later in the same request is not observed until the next request; `docs/environment.md` states the contract.
+- Ignore CGI request metadata in `$_SERVER` as configuration, for direct reads and for `${NAME}` interpolation: the exact CGI meta-variable names plus `HTTP_*`, `REDIRECT_*` and `PHP_AUTH_*` are read only from `$_ENV` or the real process environment. Operator values with other names passed through `fastcgi_param` or `SetEnv` keep working.
+- `doctor --production` reports `production.env-dir-readonly` once a deployment dump exists: the environment directory must not be writable by the PHP runtime identity because the generated configuration executes the dump and cache files from it. Another identity or root yields `unknown`.
+- Document that the compatibility `getenv` filter exposes every environment value to plugins, that the `string` type HTML-escapes values, and that `SYMPRESS_KERNEL_BUILD_ID` is best exported in the environment.
+- Report the current release version in the standalone CLI.
+
+See the [1.2.8 upgrade notes](docs/releases/1.2.8.md).
+
 ## 1.2.7 — 2026-10-23
 
 - Stop probing absent optional environment files with a suppressed `stat()`. The warning stayed in PHP's `error_get_last()`, so WordPress added the `php-error` admin body class and shifted the sidebar by 2em. Cache signatures are unchanged.
diff --git a/docs/releases/1.2.8.md b/docs/releases/1.2.8.md
new file mode 100644
index 0000000..4e946a6
--- /dev/null
+++ b/docs/releases/1.2.8.md
@@ -0,0 +1,26 @@
+# Runtime 1.2.8
+
+Update `sympress/runtime` with Composer and review the resulting lockfile.
+
+The environment reader changed, so the generated parser payload has a new
+fingerprint. Run `vendor/bin/runtime` (or `composer install`) to regenerate the
+configuration, ship the new `var/runtime/<fingerprint>/` directory with the
+release and keep the previous one until rollback is no longer needed. Rebuild
+deployment dumps with `vendor/bin/runtime dump-env <environment>`; existing
+`.env.cached.php` files are replaced on the next request.
+
+Values the web server places in `$_SERVER` under CGI meta-variable names
+(`REQUEST_URI`, `QUERY_STRING`, `REMOTE_ADDR`, `SERVER_NAME`, `HTTPS`, …) and
+under `HTTP_*`, `REDIRECT_*` or `PHP_AUTH_*` are no longer read as configuration
+or interpolation sources. A project that relied on one of those exact names must
+supply it through the real process environment or `$_ENV`. Other names passed
+through `fastcgi_param` or `SetEnv` are unaffected.
+
+Within one request the reader now samples each process variable once. Code that
+calls `putenv()` after the configuration booted and expects the new value from
+`sympress_runtime_getenv()` in the same request must read `getenv()` directly.
+
+`doctor --production` adds `production.env-dir-readonly`: with a deployment dump
+the environment directory must not be writable by the PHP runtime identity. A
+deployment that still lets PHP-FPM write there now fails the strict gate; make
+the directory read-only after `dump-env`. The standalone CLI reports version 1.2.8.
diff --git a/src/Console/Application.php b/src/Console/Application.php
index b1ddf95..a729832 100644
--- a/src/Console/Application.php
+++ b/src/Console/Application.php
@@ -31,7 +31,7 @@ public static function main(array $arguments, string $root, string $vendor, ?arr
         $installed = is_file($installedFile) ? json_decode((string) file_get_contents($installedFile), true, 512, JSON_THROW_ON_ERROR) : [];
         $dev = !is_array($installed) || ($installed['dev'] ?? true) !== false;
         $context = $data === null ? new RunContext($root, $vendor, $bin, dev: $dev, manifest: $manifestFile) : RunContext::fromArray($data);
-        $application = new ConsoleApplication('SymPress Runtime', '1.2.7');
+        $application = new ConsoleApplication('SymPress Runtime', '1.2.8');
         $application->setAutoExit(false);
         foreach (['run', ...Registry::RESERVED] as $operation) {
             $application->addCommand(new RuntimeCommand($context, $operation));