diff --git a/BACKLOG.md b/BACKLOG.md
index d61b3fc..e426183 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -16,9 +16,10 @@
 - **result:** Root cause: routes used `/:serviceId/credentials` (missing `/services/` segment). All 3 credential routes (POST/DELETE/GET) in `routes/services.js` had the wrong path. Fixed to `/services/:serviceId/credentials` — matches the URL pattern used by the live frontend and all 759 tests pass.
 
 ### DC-002: Sync VERSION file
-- **status:** in-progress
+- **status:** done
 - **owner:** hermes
 - **details:** `/root/dashcaddy/VERSION` says `1.13.0` but `package.json` says `1.13.4`. VERSION file should always match package.json. Add a pre-commit or post-version bump hook to keep them in sync.
+- **result:** Fixed root VERSION to 1.13.4. Updated `scripts/release.sh` to write both `dashcaddy-api/package.json` AND root `VERSION` on every release — also stages VERSION in the release commit. No more drift.
 
 ### DC-003: Remove stale test/debug files from repo root
 - **status:** todo
diff --git a/VERSION b/VERSION
index feaae22..80138e7 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.13.0
+1.13.4
diff --git a/scripts/release.sh b/scripts/release.sh
index c0b42f9..2ea5d8e 100644
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -43,14 +43,17 @@ echo "  release: $RELEASE_HOST"
 echo "  mirror:  $MIRROR_HOST"
 echo
 
-# ── 1. Bump dashcaddy-api/package.json ────────────────────────────────────
-echo "[1/6] Bumping dashcaddy-api/package.json"
+# ── 1. Bump dashcaddy-api/package.json + root VERSION file ──────────────
+echo "[1/6] Bumping dashcaddy-api/package.json + VERSION"
 node -e "
   const fs = require('fs');
   const pkg = require('./dashcaddy-api/package.json');
   pkg.version = '$VERSION';
   fs.writeFileSync('./dashcaddy-api/package.json', JSON.stringify(pkg, null, 2) + '\n');
 "
+# Keep root VERSION in sync with package.json — otherwise downstream tooling
+# (installer, status page, rollback checks) reads a stale version.
+echo "$VERSION" > VERSION
 
 # ── 2. Rebuild status frontend so dist/*.js matches source ────────────────
 if [[ -f status/build.js ]]; then
@@ -60,7 +63,7 @@ fi
 
 # ── 3. Commit + push ──────────────────────────────────────────────────────
 echo "[3/6] Committing + pushing"
-git add dashcaddy-api/package.json
+git add dashcaddy-api/package.json VERSION
 # Everything the build rewrites must be staged or the tarball ships stale
 # copies. status/dist/ is .gitignored (-f bypasses); index.html and sw.js are
 # tracked but get rewritten by build.js (CSP hash + SW cache tag derived from