diff --git a/CHANGELOG.alpha.md b/CHANGELOG.alpha.md
index a87dd49..83f0a0a 100644
--- a/CHANGELOG.alpha.md
+++ b/CHANGELOG.alpha.md
@@ -6,6 +6,22 @@ are upstreamed or promoted to stable. Alpha uses the dedicated
 `jsonbored/sure-aio-alpha` image repo so testing tags stay out of the stable
 `jsonbored/sure-aio` package.
 
+## 0.7.2-alpha.9-aio.1 - 2026-06-26
+
+### Build
+
+- Track upstream Sure Alpha 0.7.2-alpha.9.
+- Publish Docker Hub and GHCR tags with the configured component revision tag.
+
+### Component Customizations
+
+- Preserve the Sure AIO alpha import-limit overlay documented in `docs/alpha-lane.md`.
+- Preserve the strict SureImport preflight/failure overlay until the pinned upstream alpha includes equivalent behavior.
+- Preserve the route-parity importer overlay for Enhanced NDJSON split/transfer proof packages until upstream carries it.
+- Keep `SURE_IMPORT_MAX_NDJSON_SIZE_MB` and `SURE_IMPORT_MAX_ROWS` alpha-only.
+- Do not add dirty-target taxonomy merge as a Unraid template or environment control.
+- Keep alpha passkey/WebAuthn template controls separate from stable.
+
 ## 0.7.2-alpha.7-aio.2 - 2026-06-18
 
 ### Maintenance
diff --git a/Dockerfile.alpha b/Dockerfile.alpha
index b0c316b..23b1a1a 100644
--- a/Dockerfile.alpha
+++ b/Dockerfile.alpha
@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # checkov:skip=CKV_DOCKER_8: s6-overlay entrypoint must start as root so init scripts can prepare filesystem state before dropping privileges
 
-ARG UPSTREAM_VERSION=0.7.2-alpha.7
-ARG UPSTREAM_IMAGE_DIGEST=sha256:8eada80908cbb26dcb7a21fc7993df9ba8db953904742258345e2ebd1e793e81
-ARG AIO_REVISION=2
+ARG UPSTREAM_VERSION=0.7.2-alpha.9
+ARG UPSTREAM_IMAGE_DIGEST=sha256:ccf11a825b7978d9436024f90e913c8a71aa6daa47624bc0b4001888e53e37bd
+ARG AIO_REVISION=1
 ARG PGVECTOR_VERSION=0.8.2
 FROM jsonbored/aio-base:s6-3.2.1.0@sha256:07db479a01a95ba28480b4605f5d1cc8bedb574b77cf167ee46e29b9558fee90 AS aio-base