diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7128950..8dd66932 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,8 @@ exhaustive.
 
 ## [Unreleased]
 
+Planned version: **1.5.3**.
+
 ## [1.5.2] - 2026-10-24
 
 ### Added
diff --git a/Directory.Build.props b/Directory.Build.props
index 8cc885c7..4a80dcf3 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -16,7 +16,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>latest</LangVersion>
-    <Version>1.5.2</Version>
+    <Version>1.5.3</Version>
   </PropertyGroup>
 
   <!--
diff --git a/README.md b/README.md
index 08464402..185ad907 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 <div align="center">
 
+<img src="docs/images/logo.png" alt="NodePilot logo" width="180">
+
 # NodePilot
 
 **Open-source Windows and PowerShell workflow automation. Self-hosted, agentless execution over WinRM, with an import path for System Center Orchestrator runbooks.**
diff --git a/docs/images/logo.png b/docs/images/logo.png
new file mode 100644
index 00000000..0ebcc2af
Binary files /dev/null and b/docs/images/logo.png differ
diff --git a/scripts/release-lab/README.md b/scripts/release-lab/README.md
index 4ea417a8..5e7e348f 100644
--- a/scripts/release-lab/README.md
+++ b/scripts/release-lab/README.md
@@ -53,8 +53,8 @@ ready within five minutes, and logs no error entry.
 
 **A** passes when `Start-Service` returns within 30 s while the database is down, the wait line
 names the connection error, and the service becomes ready on its own once the database is back,
-without an error entry. **B** passes when the setup refuses before installing anything and says the
-certificate's revocation status could not be checked.
+without an error entry. **B** passes when the setup refuses before installing anything and its abort message
+names the failed certificate revocation validation.
 
 **P1** sets the machine execution policy to `AllSigned` the way a GPO does, then runs
 `allsigned-workflow.json` instead of the smoke workflow: a script step in the default Windows
diff --git a/scripts/release-lab/server/Invoke-ServerMatrix.ps1 b/scripts/release-lab/server/Invoke-ServerMatrix.ps1
index 13c44823..9dae32f1 100644
--- a/scripts/release-lab/server/Invoke-ServerMatrix.ps1
+++ b/scripts/release-lab/server/Invoke-ServerMatrix.ps1
@@ -200,7 +200,7 @@ foreach ($s in $scenarios) {
             }
             if ($s.check -eq 'crlMissing') {
                 $inno = Invoke-Command -Session $session -ScriptBlock { Get-Content 'C:\NP-Test\B-inno.log' -Raw -ErrorAction SilentlyContinue }
-                $refused = $r.setupExit -ne 0 -and $inno -match 'certificate revocation could not be checked'
+                $refused = $r.setupExit -ne 0 -and $inno -match 'certificate revocation validation failed'
                 $r | Add-Member -NotePropertyName preflightRefused -NotePropertyValue $refused -Force
                 $r.verdict = if ($refused) { 'PASS' } else { 'FAIL' }
             }
diff --git a/src/nodepilot-desktop/package-lock.json b/src/nodepilot-desktop/package-lock.json
index 7c7c7791..4a064611 100644
--- a/src/nodepilot-desktop/package-lock.json
+++ b/src/nodepilot-desktop/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "nodepilot-desktop",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nodepilot-desktop",
-      "version": "1.5.2",
+      "version": "1.5.3",
       "license": "Apache-2.0",
       "devDependencies": {
         "@electron-internal/extract-zip": "1.0.5",
diff --git a/src/nodepilot-desktop/package.json b/src/nodepilot-desktop/package.json
index a16315f4..ae4caecb 100644
--- a/src/nodepilot-desktop/package.json
+++ b/src/nodepilot-desktop/package.json
@@ -1,7 +1,7 @@
 {
   "name": "nodepilot-desktop",
   "productName": "NodePilot",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "NodePilot desktop shell — a thin Electron viewer for the locally-hosted NodePilot backend.",
   "private": true,
   "license": "Apache-2.0",
diff --git a/src/nodepilot-docs-ui/package-lock.json b/src/nodepilot-docs-ui/package-lock.json
index 065932bc..09e305f6 100644
--- a/src/nodepilot-docs-ui/package-lock.json
+++ b/src/nodepilot-docs-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "nodepilot-docs-ui",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nodepilot-docs-ui",
-      "version": "1.5.2",
+      "version": "1.5.3",
       "dependencies": {
         "@carbon/icons-react": "^11.90.0",
         "@fontsource-variable/geist": "^5.2.8",
diff --git a/src/nodepilot-docs-ui/package.json b/src/nodepilot-docs-ui/package.json
index 72f51ce4..0b3c1f32 100644
--- a/src/nodepilot-docs-ui/package.json
+++ b/src/nodepilot-docs-ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nodepilot-docs-ui",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "NodePilot documentation website - React SPA.",
   "type": "module",
   "private": true,
diff --git a/src/nodepilot-ui/package-lock.json b/src/nodepilot-ui/package-lock.json
index 27088a38..e214a62b 100644
--- a/src/nodepilot-ui/package-lock.json
+++ b/src/nodepilot-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "nodepilot-ui",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nodepilot-ui",
-      "version": "1.5.2",
+      "version": "1.5.3",
       "dependencies": {
         "@carbon/icons-react": "^11.90.0",
         "@codemirror/autocomplete": "^6.20.3",
diff --git a/src/nodepilot-ui/package.json b/src/nodepilot-ui/package.json
index 5b992e13..c0d9f67b 100644
--- a/src/nodepilot-ui/package.json
+++ b/src/nodepilot-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "nodepilot-ui",
   "private": true,
-  "version": "1.5.2",
+  "version": "1.5.3",
   "type": "module",
   "engines": {
     "node": ">=22.22.0"