diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23e6122..475794a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.7.3.1] - 2026-06-18
+
+### Changed
+
+- **EGB-677 stage-1 structural cleanups (EGB-701)** — tech-debt dedup with one
+  new safety warning; no behavior change for the manifest-driven (v2) happy path.
+  - **`secrets which` now reuses the one external-entry extractor** the push/pull
+    path uses (`_json_external_entries`) instead of its own duplicated `jq` 
+    projection. So `which` applies the same `properties`→`gradle-properties`
+    normalization and skips (with a warning) the same malformed external entries
+    the sync path drops — `which` shows exactly what will sync, not a stale raw
+    projection that could drift from the real behavior.
+  - **The two external-manifest read guards are factored into shared helpers** —
+    `_json_readable` (plain regular file, silent) and `_legacy_readable` (warns
+    and skips a symlinked `.secrets-files`) — so `_external_entries_for_push` and
+    `_external_entries_for_pull` can't drift apart.
+
+### Fixed
+
+- **Legacy (manifest-less) `pull` no longer silently under-restores (EGB-701)** —
+  the manifest-less pull path globs only top-level `*.age`/`.*.age`, so a nested
+  dotenv blob (`<project>/<relpath>.age`) written by a manifest-driven push on
+  another machine was invisible: restored nothing, counted nothing, said nothing.
+  It now **warns** and names each nested blob it can't reach (external blobs are
+  excluded — `pull_external_files` handles those), pointing at committing a
+  `.secrets.json` as the fix. The manifest-driven pull already restored nesting
+  correctly; this only closes the legacy path's blind spot.
+
 ## [0.7.3.0] - 2026-06-08
 
 ### Added
diff --git a/VERSION b/VERSION
index 934346d..512d674 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.7.3.0
+0.7.3.1