diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a1481e0..f05a10a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,15 +25,15 @@ jobs:
         with:
           persist-credentials: false
 
-      # The engine dependency: guard-core-jvm pinned at 6cde4af (full SHA for the
+      # The engine dependency: guard-core-jvm pinned at 7711606 (full SHA for the
       # actions/checkout fetch), checked
       # out as the sibling directory ./guard-core-jvm and substituted for the
       # declared com.guardcore:guard-core coordinates by settings.gradle.kts.
-      - name: Checkout engine (guard-core-jvm @ 6cde4af)
+      - name: Checkout engine (guard-core-jvm @ 7711606)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
+          ref: 77116062fc7d88dcb610b1f588e2bc78e63848ad
           path: guard-core-jvm
           persist-credentials: false
 
diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml
index c4b1bf4..fed491b 100644
--- a/.github/workflows/code-ql.yml
+++ b/.github/workflows/code-ql.yml
@@ -23,11 +23,11 @@ jobs:
 
       # The engine dependency: the composite includeBuild needs the pinned
       # guard-core-jvm checkout next to the repository (same as ci.yml).
-      - name: Checkout engine (guard-core-jvm @ 6cde4af)
+      - name: Checkout engine (guard-core-jvm @ 7711606)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
+          ref: 77116062fc7d88dcb610b1f588e2bc78e63848ad
           path: guard-core-jvm
           persist-credentials: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1b0c03..de5af22 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,11 +72,11 @@ jobs:
           persist-credentials: false
 
       # Same engine checkout as ci.yml (the composite default for tests).
-      - name: Checkout engine (guard-core-jvm @ 6cde4af)
+      - name: Checkout engine (guard-core-jvm @ 7711606)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
+          ref: 77116062fc7d88dcb610b1f588e2bc78e63848ad
           path: guard-core-jvm
           persist-credentials: false
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e73cfa4..35e7283 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## [1.1.0] - 2026-10-16
 
 ### Added
 
@@ -8,6 +8,7 @@
 
 ### Changed
 
+- Builds against guard-core-jvm 4.4.0 (`guardCore = "4.4.0"`, now on Maven Central), and the pinned guard-core-jvm engine ref moves to 7711606, the v4.4.0 release commit.
 - The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central.
 - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55).
 - Telemetry agent support: an `AgentHandlerProtocol` bean (for example guard-agent-jvm's `GuardAgentTelemetry`) is now injected into `GuardMiddleware` by the auto-configuration, adopted into the engine composite on initialization, and stopped through the new `GuardMiddleware.shutdown()` when the context closes. Before this, `guard.enable-agent=true` always degraded with a "W7 artifact" message, because the middleware had no way to receive a handler. The degrade path now only applies when no handler bean is registered. The pinned guard-core-jvm engine ref moves to 9067b7b, whose agent telemetry wiring fix (Guard-Core/guard-core-jvm#48) the handler needs to receive anything.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 53f18d2..8fc8420 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -22,7 +22,7 @@ side in the same directory) at the pinned ref:
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm
-git -C ../guard-core-jvm checkout 6cde4af
+git -C ../guard-core-jvm checkout 7711606
 ./gradlew build          # detekt + ktfmt check + tests (redis-backed tests skip when redis is down)
 ```
 
diff --git a/README.md b/README.md
index 26c1f07..b4f8c0e 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ Published on Maven Central:
 
 ```kotlin
 dependencies {
-    implementation("com.guard-core:spring-boot-guard:1.0.0")
+    implementation("com.guard-core:spring-boot-guard:1.1.0")
 }
 ```
 
@@ -132,7 +132,7 @@ logs the same "eager init not honored" warning as fastapi-guard.
 
 The engine artifact `com.guard-core:guard-core` (groupId is the Central Portal namespace; Kotlin
 packages stay `com.guardcore.*`) is on Maven Central for consumers. This repository's own build pins the engine from source instead: CI and local builds check out `Guard-Core/guard-core-jvm` at the
-pinned ref `6cde4af` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
+pinned ref `7711606` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
 substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` /
 `com.guard-core:guard-core-engine:4.3.3` with the included build's projects (the Gradle analog of
 the Rust path+version pattern). The declared dependency coordinates stay
@@ -152,7 +152,7 @@ Local checkout:
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 6cde4af
+git -C guard-core-jvm checkout 7711606
 ./gradlew build
 ```
 
diff --git a/build.gradle.kts b/build.gradle.kts
index 6739ac8..50a3bcf 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -15,7 +15,7 @@ plugins {
 // standard practice for hyphenated domains.
 group = "com.guard-core"
 
-version = "1.0.0"
+version = "1.1.0"
 
 // Section 14.3 lockfile analog: every configuration resolves against the
 // committed gradle.lockfile. A dependency change without
diff --git a/docs/examples.md b/docs/examples.md
index fd22279..bd2c36c 100644
--- a/docs/examples.md
+++ b/docs/examples.md
@@ -7,7 +7,7 @@ routes, live Redis-backed rate limiting, and per-route decorator configs.
 git clone https://github.com/Guard-Core/spring-boot-guard.git
 cd spring-boot-guard
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 6cde4af
+git -C guard-core-jvm checkout 7711606
 docker run -d -p 6379:6379 redis:7-alpine
 ./gradlew :examples:demo-boot:bootRun
 ```
diff --git a/docs/installation.md b/docs/installation.md
index 479cfcb..e2967e1 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -13,7 +13,7 @@ Published on Maven Central:
 
 ```kotlin
 dependencies {
-    implementation("com.guard-core:spring-boot-guard:1.0.0")
+    implementation("com.guard-core:spring-boot-guard:1.1.0")
 }
 ```
 
@@ -23,7 +23,7 @@ packages stay `com.guardcore.*`.
 ## Engine dependency (includeBuild + dependency substitution)
 
 Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and
-local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af`
+local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `7711606`
 as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
 substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` /
 `com.guard-core:guard-core-engine:4.3.3` with the included build's projects.
@@ -32,7 +32,7 @@ The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3`
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 6cde4af
+git -C guard-core-jvm checkout 7711606
 ./gradlew build
 ```
 
diff --git a/examples/demo-boot/README.md b/examples/demo-boot/README.md
index 2b5107a..a0335bd 100644
--- a/examples/demo-boot/README.md
+++ b/examples/demo-boot/README.md
@@ -21,12 +21,12 @@ engine's `SecurityConfig` field names).
 
 Prerequisites:
 
-1. Clone Guard-Core/guard-core-jvm at the pinned ref `6cde4af` next to this repository
+1. Clone Guard-Core/guard-core-jvm at the pinned ref `7711606` next to this repository
    (the engine builds from source via includeBuild until the artifacts publish):
 
    ```bash
    git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-   git -C guard-core-jvm checkout 6cde4af
+   git -C guard-core-jvm checkout 7711606
    ```
 
 2. A Redis on `localhost:6379` (rate limiting), or set `guard.enable-redis: false` in
diff --git a/examples/demo-boot/settings.gradle.kts b/examples/demo-boot/settings.gradle.kts
index 22d73d3..7c53a80 100644
--- a/examples/demo-boot/settings.gradle.kts
+++ b/examples/demo-boot/settings.gradle.kts
@@ -15,7 +15,7 @@ rootProject.name = "demo-boot"
 
 // The adapter and the engine are consumed from source until both publish:
 // the adapter repo sits two levels up and the engine at the pinned ref
-// 6cde4af sits next to it (the same includeBuild convention as the adapter).
+// 7711606 sits next to it (the same includeBuild convention as the adapter).
 includeBuild("../../") {
   dependencySubstitution {
     substitute(module("com.guardcore:spring-boot-guard")).using(project(":"))
@@ -35,7 +35,7 @@ val engineDir: File = run {
       )
   roots.firstOrNull { it.resolve("settings.gradle.kts").isFile }
       ?: throw GradleException(
-          "Clone Guard-Core/guard-core-jvm at the pinned ref 6cde4af next to the " +
+          "Clone Guard-Core/guard-core-jvm at the pinned ref 7711606 next to the " +
               "spring-boot-guard repository first (or point -PguardCoreJvmDir / " +
               "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " +
               roots.joinToString(", ") { it.path },
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 39a30a6..d0a717e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -6,7 +6,7 @@ spotless = "8.10.4"
 detekt = "1.23.8"
 # Engine facade coordinates (groupId com.guard-core, the Central Portal namespace): substituted with the pinned includeBuild checkout
 # (see settings.gradle.kts) until the artifact publishes to Maven Central.
-guardCore = "4.3.3"
+guardCore = "4.4.0"
 netty = "4.1.139.Final"
 
 [libraries]
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 42b979e..618107e 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -13,7 +13,7 @@ pluginManagement {
 // GUARD_CORE_USE_COMPOSITE (environment variable):
 //   unset / "1" / "true"  -> composite ON (default). The engine is built from
 //     source via includeBuild + dependency substitution: CI (and local builds)
-//     check out Guard-Core/guard-core-jvm at the PINNED REF 6cde4af as the
+//     check out Guard-Core/guard-core-jvm at the PINNED REF 7711606 as the
 //     sibling directory ./guard-core-jvm, and the block below substitutes the
 //     declared coordinates com.guard-core:guard-core /
 //     com.guard-core:guard-core-engine with the included build's projects.
@@ -63,7 +63,7 @@ if (useComposite) {
     roots.firstOrNull { it.resolve("settings.gradle.kts").isFile }
         ?: throw GradleException(
             "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " +
-                "at the pinned ref 6cde4af next to this repository (or point -PguardCoreJvmDir / " +
+                "at the pinned ref 7711606 next to this repository (or point -PguardCoreJvmDir / " +
                 "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " +
                 roots.joinToString(", ") { it.path },
         )