diff --git a/_data/products.yml b/_data/products.yml
index c54cec6b6..0f93da4c7 100644
--- a/_data/products.yml
+++ b/_data/products.yml
@@ -47,7 +47,7 @@ openvox:
       label: "9.x"
       collection: _openvox_9x
       base: /openvox/9.x/
-      ref: "9.0.0-rc1"
+      ref: "9.x"
     - id: 8x
       label: "8.x"
       collection: _openvox_8x
@@ -63,7 +63,7 @@ openfact:
       label: "6.x"
       collection: _openfact_6x
       base: /openfact/6.x/
-      ref: "6.0.0"
+      ref: "6.x"
     - id: 5x
       label: "5.x"
       collection: _openfact_5x
diff --git a/docs/_openfact_6x/release_notes.md b/docs/_openfact_6x/release_notes.md
index 2c2a58a49..f2a39fe8e 100644
--- a/docs/_openfact_6x/release_notes.md
+++ b/docs/_openfact_6x/release_notes.md
@@ -7,6 +7,24 @@ This page documents the history of the OpenFact 6 series. OpenFact 6 is bundled
 `openvox-agent` 9.x; for the series bundled with the 8.x agent, see the
 [OpenFact 5 release notes](/openfact/5.x/release_notes.html).
 
+## OpenFact 6.2.1
+
+Released on September 29, 2026. This is the version bundled with `openvox-agent` 9.0.0.
+
+A failed EC2 root metadata request is treated as no metadata. See the [GitHub OpenFact release page](https://github.com/OpenVoxProject/openfact/releases/tag/6.2.1).
+
+## OpenFact 6.2.0
+
+Released on September 23, 2026.
+
+The FQDN lookup in the hostname resolvers is bounded, so a slow or unresponsive resolver no longer stalls fact collection indefinitely. See the [GitHub OpenFact release page](https://github.com/OpenVoxProject/openfact/releases/tag/6.2.0).
+
+## OpenFact 6.1.0
+
+Released on September 11, 2026.
+
+Partial EC2 metadata results are rejected, log timestamp formatting is fixed, and the documentation and comments use the OpenVox and OpenFact names. See the [GitHub OpenFact release page](https://github.com/OpenVoxProject/openfact/releases/tag/6.1.0).
+
 ## OpenFact 6.0.0
 
 Released on July 31, 2026
diff --git a/docs/_openvox-server_9x/index.markdown b/docs/_openvox-server_9x/index.markdown
index c791277ec..c3ff779b4 100644
--- a/docs/_openvox-server_9x/index.markdown
+++ b/docs/_openvox-server_9x/index.markdown
@@ -3,9 +3,6 @@ layout: default
 title: "OpenVox Server 9"
 ---
 
-> **OpenVox Server 9 is in prerelease.** See the [release notes](release_notes.html) for
-> the current build and expect breaking changes before the stable 9.0.0 release.
-
 OpenVox Server is the primary server component in an OpenVox agent/server deployment.
 It compiles configuration catalogs for managed nodes, serves files, manages certificates,
 and receives reports from agents.
diff --git a/docs/_openvox-server_9x/known_issues.markdown b/docs/_openvox-server_9x/known_issues.markdown
index bfe48f497..1acf9d1a5 100644
--- a/docs/_openvox-server_9x/known_issues.markdown
+++ b/docs/_openvox-server_9x/known_issues.markdown
@@ -5,6 +5,10 @@ title: "OpenVox Server: Known Issues"
 
 For a list of all known issues, visit the [OpenVox Server issue tracker](https://github.com/OpenVoxProject/openvox-server/issues).
 
+## FIPS packages ship older Bouncy Castle jars
+
+The FIPS builds of `openvox-server` 9.0.1 ship an older set of Bouncy Castle FIPS 1.x jars. The latest Bouncy Castle FIPS 1.x release has a small issue that could cause problems in a very constrained, non-default configuration, so the project is not updating to it. OpenVox Server 9.1 will move to the Bouncy Castle FIPS 2.x line, which is the one fully certified for FIPS on Java 21.
+
 ## Potential JAVA ARGS settings
 
 If you're working outside of lab environment, increase `ReservedCodeCache` to `512m` under normal load. If you're working with 6-12 JRuby instances (or a `max-requests-per-instance` value significantly less
diff --git a/docs/_openvox-server_9x/release_notes.markdown b/docs/_openvox-server_9x/release_notes.markdown
index f0b7fbe6b..460141838 100644
--- a/docs/_openvox-server_9x/release_notes.markdown
+++ b/docs/_openvox-server_9x/release_notes.markdown
@@ -3,20 +3,130 @@ layout: default
 title: "OpenVox Server: Release Notes"
 ---
 
-> **OpenVox Server 9 is in prerelease.** This page tracks the beta and release-candidate
-> builds ahead of the stable 9.0.0 release. Expect breaking changes between prereleases; see
-> [known issues](known_issues.html) for anything discovered so far.
-
 OpenVox Server 9 pairs with OpenVox 9 (the agent): the `openvox-server` 9.x package
 depends on `openvox-agent` 9.x on the same host. For the changes on the agent side,
 see the [OpenVox 9 release notes](/openvox/9.x/release_notes.html).
 
+## OpenVox Server 9.0.1
+
+Released October 2, 2026.
+
+This is the first stable release of OpenVox Server 9. There is no 9.0.0 release: that
+version number was taken by an artifact published to Clojars by mistake during the beta
+(see 9.0.0-beta4 below), so the series starts at 9.0.1. See the
+[project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.1)
+for the full list of changes and the
+[OpenVox 9 release notes](/openvox/9.x/release_notes.html) for the agent-side changes,
+including the "Upgrading from OpenVox 8" checklist linked from there.
+
+Breaking changes compared with OpenVox Server 8:
+
+- **Java 21 or 25 is required.** The package depends on a Java 25 or Java 21 runtime
+  package and prefers Java 25 wherever the platform provides it; Enterprise Linux 8
+  provides Java 21 only. The FIPS packages run on Java 21 only, because the Bouncy
+  Castle FIPS libraries are certified up to Java 21. Java 17 is no longer supported.
+- **The systemd unit runs the JVM directly.** It starts
+  `/opt/puppetlabs/server/apps/puppetserver/bin/java`, a launcher that runs the first
+  installed Java from the supported list (25, then 21). The unit is `Type=notify`, so
+  systemd reports the service as started only once OpenVox Server is up; on systemd 253
+  or newer (Debian 13, Ubuntu 24.04 and 26.04, EL 10, Fedora, SLES 16) it is
+  `Type=notify-reload`, while EL 8, EL 9, Amazon Linux 2023, SLES 15, Ubuntu 22.04, and
+  the FIPS packages keep the `puppetserver reload` subcommand behind `ExecReload`.
+  `systemctl reload puppetserver` works everywhere. The `puppetserver start` and
+  `puppetserver stop` subcommands are removed; use `systemctl`. `puppetserver foreground`
+  remains.
+- **`JAVA_BIN` in the defaults file is optional.** The shipped
+  `/etc/sysconfig/puppetserver` and `/etc/default/puppetserver` no longer set it, and a
+  `JAVA_BIN="/usr/bin/java"` line left over from an 8.x install is ignored. Any other
+  value is used as it is without validation, so it must point at Java 21 or 25, or at
+  Java 21 for a FIPS package. `JAVA_ARGS`,
+  `JAVA_ARGS_CLI`, and `TK_ARGS` work as before. The unit adds the `--add-opens` and
+  `--enable-native-access` options the JVM needs through `JAVA_ARGS_DIST`, and
+  `-Djruby.logger.class=...Slf4jLogger` is no longer part of the default `JAVA_ARGS`.
+- **JRuby 10.1.** Server-side Ruby code (functions, report processors, custom types and
+  providers used during compilation, and gems installed with `puppetserver gem`) runs on
+  JRuby 10.1, which targets Ruby 4.0.
+- **Filebucket reads require an administrative certificate.** The default
+  [`auth.conf`](./config_file_auth.html) allows `GET` and `POST` on
+  `/puppet/v3/file_bucket_file` only to certificates with the `pp_cli_auth` extension.
+  Agents keep `HEAD` and `PUT`, which is all they need to store backups. The package
+  manager keeps a modified `auth.conf` and drops the new default next to it as
+  `auth.conf.rpmnew` or `auth.conf.dpkg-dist`; merge it to pick up this rule and the
+  environment-cache rule below.
+- **The embedded web server is Jetty 12**, and the `gettext` gem is no longer vendored
+  with the JRuby gems.
+- **The package requires `openvox-agent` 9.0.0 or newer** on the same host.
+- **The `pe_serverversion` fact is removed.**
+- **Reports are off by default**, because the agent's `reports` setting now defaults to
+  `none`. Set `reports = store` on the server if you rely on YAML reports in `reportdir`.
+- **Platforms.** Packages are no longer built for Debian 11, Debian 12, Ubuntu 25.04,
+  Amazon Linux 2, or Fedora 42; see
+  [Supported platforms](/openvox/9.x/supported_platforms.html).
+
+Other notable changes:
+
+- The server can clear its own environment cache after a code deployment: the default
+  `auth.conf` allows `DELETE /puppet-admin-api/v1/environment-cache` for certificates with
+  the `pp_cli_auth` extension, which the server's own certificate carries. An r10k or g10k
+  post-deploy hook can call the API with the server's certificate.
+- Requests that include the system trust store, such as report processors posting to
+  external HTTPS endpoints, fall back to the PEM bundle at
+  `/opt/puppetlabs/puppet/ssl/cert.pem`, because the OpenVox 9 agent runtime no longer
+  ships a Java keystore.
+- `puppetserver gem`, `puppetserver ruby`, and `puppetserver irb` use JRuby's standard
+  error logger instead of printing debug logging, and `puppetserver gem list` works on
+  Java 21 and newer.
+- The uberjar no longer contains JRuby's Windows binaries and rdoc, which makes it smaller.
+
+### Security issues resolved in 9.0.1
+
+Compared with OpenVox Server 8.16.0. The Bouncy Castle scores are CVSS 4.0 base scores
+from NVD; the project's release page lists them as not yet scored.
+
+| Identifier                                                        | CVSS Score | Resolved By                                                             |
+| :---------------------------------------------------------------- | :--------: | :---------------------------------------------------------------------- |
+| [CVE-2026-71885](https://nvd.nist.gov/vuln/detail/CVE-2026-71885) |    9.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-17507](https://nvd.nist.gov/vuln/detail/CVE-2026-17507) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71888](https://nvd.nist.gov/vuln/detail/CVE-2026-71888) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71889](https://nvd.nist.gov/vuln/detail/CVE-2026-71889) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71890](https://nvd.nist.gov/vuln/detail/CVE-2026-71890) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-18036](https://nvd.nist.gov/vuln/detail/CVE-2026-18036) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71886](https://nvd.nist.gov/vuln/detail/CVE-2026-71886) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71887](https://nvd.nist.gov/vuln/detail/CVE-2026-71887) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-85515](https://nvd.nist.gov/vuln/detail/CVE-2026-85515) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.7`              |
+| [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.7`              |
+| [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.7`          |
+| [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.7`          |
+| [CVE-2026-71891](https://nvd.nist.gov/vuln/detail/CVE-2026-71891) |    7.1     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71892](https://nvd.nist.gov/vuln/detail/CVE-2026-71892) |    6.9     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-18040](https://nvd.nist.gov/vuln/detail/CVE-2026-18040) |    5.9     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-17508](https://nvd.nist.gov/vuln/detail/CVE-2026-17508) |    5.3     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+
+## OpenVox Server 9.0.0-rc2
+
+Released September 29, 2026.
+
+This was the last release candidate before 9.0.1. See the
+[project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-rc2)
+for the full list of changes.
+
+Notable changes in this build:
+
+- Packages are built with EZbake 4.2.0. The systemd unit starts the JVM through the
+  `bin/java` launcher described in the 9.0.1 entry, which runs the first installed Java
+  from the supported list and honors `JAVA_BIN` from the defaults file when it points at
+  a supported version. This replaces the 9.0.0-rc1 behavior of running the Java binary
+  chosen at package build time.
+- The default `auth.conf` lets the server's own certificate clear the environment cache
+  through `DELETE /puppet-admin-api/v1/environment-cache`.
+- JRuby 10.1.2.0, Bouncy Castle 1.86, Jackson 2.21.7, and logback 1.6.4.
+
 ## OpenVox Server 9.0.0-rc1
 
 Released September 9, 2026.
 
-This is the first **release candidate** of OpenVox Server 9 and is not yet the stable
-release. See the
+This was the first **release candidate** of OpenVox Server 9. See the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-rc1)
 for the full list of changes.
 
@@ -45,7 +155,7 @@ Other notable changes:
 
 Released August 12, 2026.
 
-This is a **prerelease** of OpenVox Server 9 and is not yet the stable release. See the
+This was a **prerelease** of OpenVox Server 9. See the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta5)
 for the full list of changes.
 
@@ -70,7 +180,7 @@ was published to Clojars by mistake. See the
 
 Released August 6, 2026. Packages for this build were not published; use 9.0.0-beta4.
 
-This is a **prerelease** of OpenVox Server 9 and is not yet the stable release. It includes
+This was a **prerelease** of OpenVox Server 9. It includes
 breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta3)
 for the full list of changes.
@@ -88,7 +198,7 @@ Notable breaking changes in this build:
 
 Released July 27, 2026.
 
-This is a **prerelease** of OpenVox Server 9 and is not yet the stable release. It includes
+This was a **prerelease** of OpenVox Server 9. It includes
 breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta2)
 for the full list of changes.
@@ -105,7 +215,7 @@ Notable changes in this build:
 
 Released July 15, 2026.
 
-This is the first **prerelease** of OpenVox Server 9 and is not yet the stable release. It
+This was the first **prerelease** of OpenVox Server 9. It
 includes breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta1)
 for the full list of changes.
diff --git a/docs/_openvox_9x/index.md b/docs/_openvox_9x/index.md
index fe17163ff..92d07e69f 100644
--- a/docs/_openvox_9x/index.md
+++ b/docs/_openvox_9x/index.md
@@ -3,9 +3,6 @@ layout: default
 title: "OpenVox 9"
 ---
 
-> **OpenVox 9 is in prerelease.** See the [release notes](release_notes.html) for the
-> current build and expect breaking changes before the stable 9.0.0 release.
-
 OpenVox is a community-maintained implementation of Puppet — a configuration management system for Linux, Unix, and Windows. It manages system state through a declarative language, compiling node-specific catalogs and enforcing them on each managed host.
 
 When Perforce discontinued public distribution of Puppet Open Source in late 2024, Overlook InfraTech stepped in with community packaging, and the project was subsequently adopted under [Vox Pupuli](https://voxpupuli.org/) stewardship as OpenVox. A Puppet Standards Steering Committee guides language and feature evolution going forward.
diff --git a/docs/_openvox_9x/known_issues.md b/docs/_openvox_9x/known_issues.md
index ab756c2ae..01c39ee4f 100644
--- a/docs/_openvox_9x/known_issues.md
+++ b/docs/_openvox_9x/known_issues.md
@@ -6,4 +6,22 @@ title: "OpenVox 9 known issues"
 
 As known issues are discovered in OpenVox 9 and its patch releases, they'll be added to the [project's issue tracker](https://github.com/OpenVoxProject/openvox/issues). Once a known issue is resolved, it is listed as a resolved issue in the release notes for that release, and removed from this list.
 
-No known issues have been reported for OpenVox 9 yet.
+## OpenVox 9.0.0
+
+### The agent daemon can hang while applying a catalog
+
+A small number of users have seen the `puppet agent` daemon stop checking in, leaving a forked `puppet agent: applying configuration` process that never exits ([openvox#485](https://github.com/OpenVoxProject/openvox/issues/485)). The reports so far come from small single-vCPU Linux VMs, where it happened every few days.
+
+The cause is a rare race between Ruby's background DNS lookup threads, which changed in Ruby 3.3 and 3.4, and the `fork` that starts each agent run. If the fork lands at the wrong moment, the child inherits a locked glibc resolver lock and every name lookup in that child blocks. OpenVox 8, which bundles Ruby 3.2, is not affected.
+
+OpenVox 9.0.0 includes changes that make the hang much less likely and let the daemon recover on its own: the daemon no longer does name lookups right before forking a run, a run that outlives [`runtimeout`](configuration.html#runtimeout) is killed so the daemon carries on with the next run, and OpenFact bounds the FQDN lookup in its hostname resolvers.
+
+If you still see it, setting `RUBY_TCP_NO_FAST_FALLBACK=1` in a systemd override for the `puppet` service may reduce how often it happens:
+
+```ini
+# systemctl edit puppet
+[Service]
+Environment=RUBY_TCP_NO_FAST_FALLBACK=1
+```
+
+Restarting the `puppet` service does not clean up a child process that is already stuck; kill it with `SIGKILL`. If you hit this on 9.0.0, add details to [openvox#485](https://github.com/OpenVoxProject/openvox/issues/485).
diff --git a/docs/_openvox_9x/release_notes.markdown b/docs/_openvox_9x/release_notes.markdown
index a653ac5b7..38afd0431 100644
--- a/docs/_openvox_9x/release_notes.markdown
+++ b/docs/_openvox_9x/release_notes.markdown
@@ -4,11 +4,7 @@ toc_levels: 1234
 title: "OpenVox 9 Release Notes"
 ---
 
-> **OpenVox 9 is in prerelease.** This page tracks the alpha, beta, and release candidate builds ahead of
-> the stable 9.0.0 release. Expect breaking changes between prereleases; see
-> [known issues](known_issues.html) for anything discovered so far.
-
-This page lists the links to the changes in OpenVox 9 and its prereleases. You can also view [known issues](known_issues.html) in this release.
+This page lists the links to the changes in OpenVox 9, its patch releases, and the 9.0.0 prereleases. You can also view [known issues](known_issues.html) in this release.
 
 OpenVox's version numbers follows the [Semantic Versioning](https://semver.org/) schema, which splits a version into three segments: Major.Minor.Patch
 
@@ -22,11 +18,94 @@ Puppet Open Source is no longer actively developed.
 
 You can either upgrade to Puppet 7 and then switch to OpenVox 7 and then upgrade through OpenVox 8 to OpenVox 9, or you can upgrade to Puppet 8 and then migrate to OpenVox 8 and then to OpenVox 9.
 
+## OpenVox 9.0.0
+
+Released October 2, 2026.
+
+This is the first stable release of OpenVox 9. It moves the agent to current versions of its core dependencies and removes code that was deprecated during OpenVox 8; new features are planned for OpenVox 10.
+The [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0) has the full list of changes, a component-by-component comparison with 8.29.0, and an "Upgrading from OpenVox 8" checklist to work through before you upgrade.
+The [release announcement](https://voxpupuli.org/blog/2026/10/02/openvox-9-release/) summarizes the changes most likely to affect you.
+
+OpenVox 8 stays available in the `openvox8` repositories and continues to receive high-priority and security fixes for at least six months. OpenVox 8 agents can keep running against OpenVox 9 servers while you upgrade the rest of your fleet.
+
+### Bundled components
+
+- Ruby 4.0.7 (OpenVox 8 bundles Ruby 3.2). Gems you installed into the agent's Ruby with `/opt/puppetlabs/puppet/bin/gem` must be installed again after the upgrade, because the gem directory moves from `lib/ruby/gems/3.2.0` to `lib/ruby/gems/4.0.0`.
+- OpenSSL 3.5.9, the OpenSSL long-term-support line (OpenVox 8 bundles OpenSSL 3.0).
+- [OpenFact 6.2.1](/openfact/6.x/release_notes.html) (OpenVox 8 bundles OpenFact 5).
+- puppet-resource_api 2.0.1, and new major versions of the vendored `*_core` modules. The `zone_core` module is no longer vendored; Solaris zone management needs the module installed separately.
+- No longer shipped: the `curl` binary, the Java keystore at `/opt/puppetlabs/puppet/ssl/puppet-cacerts` (the PEM bundle at `/opt/puppetlabs/puppet/ssl/cert.pem` remains), and the `base64` and `multi_json` gems.
+
+### Breaking changes
+
+- **No default server.** The [`server` setting](configuration.html#server) no longer defaults to `puppet`. An agent run that would fall back on an unset `server` fails with an error that tells you to set it. Agents that use `server_list`, DNS SRV records, or an explicit server on the command line are not affected, and `ca_server` and `report_server` satisfy the check for the CA and report services.
+- **Reports are off by default.** The default of the [`reports` setting](configuration.html#reports) changed from `store` to `none`. A server that should keep writing YAML reports to `reportdir` needs `reports = store` in `puppet.conf`. Servers that set `reports` explicitly (for example `puppetdb`) are not affected.
+- **Deferred values are evaluated before the catalog is applied again.** [`preprocess_deferred`](configuration.html#preprocess_deferred) defaults to `true`. Set it to `false` to keep the lazy evaluation that OpenVox 8 used by default.
+- **File content that looks like a checksum is literal content.** A `content` value such as `{md5}...` no longer triggers a filebucket lookup and no longer warns.
+- **Removed settings, options, and APIs.** `--configprint` and the `configprint` setting (use `puppet config print`), the `pluginsync` setting, the `hiera` indirector terminus and the `data_binding_terminus` setting, the encoding argument of `regsubst`, the legacy PAL script evaluation APIs, and the `pe_serverversion` fact.
+- **The systemd service provider no longer falls back to SysVInit on Debian.** `invoke-rc.d` and init script inspection are no longer consulted to decide whether a service is enabled.
+- **OpenFact 6 is required.** The `openvox` gem depends on `openfact ~> 6.0` and needs Ruby 3.2 or newer.
+- **The `openvox` gem ships platform builds.** Besides the generic gem there are `universal-darwin` and `x64-mingw-ucrt` builds. The `x64-mingw32` and `x86-mingw32` platforms are dropped.
+
+### Platforms
+
+Packages are no longer built for Enterprise Linux 7, Amazon Linux 2, Fedora 42, Debian 11, or Ubuntu 25.04; see [Supported platforms](supported_platforms.html).
+The Windows agent is now built with MSYS2 and the UCRT toolchain (the `x64-mingw-ucrt` Ruby platform), so precompiled gems such as nokogiri install on Windows nodes without build tools. Installers for 9.x are in the `openvox9` directories at [downloads.voxpupuli.org](https://downloads.voxpupuli.org/).
+
+### Other changes
+
+- The agent logs an error when the catalog it received was compiled for a different certname, which happens with cloned images that keep a cached catalog or with a misrouting load balancer.
+- A forked agent run is killed when it outlives `runtimeout`, a `RunTimeoutError` during fact collection is no longer swallowed, and the daemon waits for its certificate in the forked child instead of blocking the daemon.
+- `Puppet.features.posix?` no longer depends on the `syslog` library, which fixes `Cannot determine basic system flavour` on Ruby installations without it.
+- Debian packages install `/etc/default/puppet`, which sets `PUPPET_EXTRA_OPTS` for the systemd unit.
+- Help output, default configuration files, and the generated reference pages use the OpenVox name and link to this site.
+
+### Security Issues Resolved in 9.0.0
+
+Compared with openvox-agent 8.29.0. The prerelease entries below list the issues fixed earlier in the 9.0.0 cycle. libxml2 2.15.4 also contains security fixes that have no CVE identifiers.
+
+| Identifier                                                        | CVSS 3.1 Score | Resolved By                        |
+| :---------------------------------------------------------------- | :------------: | :--------------------------------- |
+| [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) |       8.2      | `pkg:github/openssl/openssl@3.5.9` |
+| [CVE-2026-80212](https://nvd.nist.gov/vuln/detail/CVE-2026-80212) |       7.5      | `pkg:gem/resolv@0.7.2` (Ruby 4.0.7) |
+| [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) |       5.3      | `pkg:github/openssl/openssl@3.5.9` |
+| [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) |       5.3      | `pkg:github/openssl/openssl@3.5.9` |
+| [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) |       5.3      | `pkg:github/openssl/openssl@3.5.9` |
+| [CVE-2026-80213](https://nvd.nist.gov/vuln/detail/CVE-2026-80213) |       4.0      | `pkg:gem/resolv@0.7.2` (Ruby 4.0.7) |
+| [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) |       3.7      | `pkg:github/openssl/openssl@3.5.9` |
+| [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) |       3.7      | `pkg:github/openssl/openssl@3.5.9` |
+
+## OpenVox 9.0.0-rc4
+
+Released September 29, 2026.
+
+This was the last release candidate before 9.0.0. It updates OpenFact to 6.2.1 and puppet-runtime to 2026.09.29.1, which moves OpenSSL to 3.5.9 (the fixes are listed in the 9.0.0 security table above). See the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-rc4).
+
+## OpenVox 9.0.0-rc3
+
+Released September 25, 2026.
+
+This release candidate fixes the packaging so that every systemd-based distribution gets the `puppet` service unit. See the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-rc3).
+
+## OpenVox 9.0.0-rc2
+
+Released September 25, 2026.
+
+This was a release candidate for OpenVox 9. See the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-rc2) for the full list of changes.
+
+Notable changes in this build:
+
+- The `server` check introduced in 9.0.0-rc1 accepts `server_list`, DNS SRV records, and an explicit server on the command line, and `ca_server` and `report_server` satisfy it for the CA and report services. 9.0.0-rc1 accepted only the `server` setting.
+- A forked agent run is killed when it outlives `runtimeout`, a `RunTimeoutError` during fact collection is no longer swallowed, and the daemon waits for its certificate in the forked child instead of blocking the daemon.
+- Debian packages install `/etc/default/puppet`, and the systemd unit no longer warns about an unset variable.
+- `Loading facts` is logged once per run.
+- OpenFact 6.2.0 and puppet-runtime 2026.09.24.1 (Ruby 4.0.7).
+
 ## OpenVox 9.0.0-rc1
 
 Released September 4, 2026.
 
-This is the first release candidate for OpenVox 9. It is still a **prerelease** and not yet the stable release. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-rc1) for the full list of changes.
+This was the first release candidate for OpenVox 9. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-rc1) for the full list of changes.
 
 Notable breaking changes in this build:
 
@@ -53,7 +132,7 @@ Notable breaking changes in this build:
 
 Released August 6, 2026.
 
-This is a **prerelease** of OpenVox 9 and is not yet the stable release. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-beta2) for the full list of changes.
+This was a **prerelease** of OpenVox 9. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-beta2) for the full list of changes.
 
 Notable breaking changes in this build:
 
@@ -67,7 +146,7 @@ Notable breaking changes in this build:
 
 Released July 15, 2026.
 
-This is a **prerelease** of OpenVox 9 and is not yet the stable release. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-beta1) for the full list of changes.
+This was a **prerelease** of OpenVox 9. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-beta1) for the full list of changes.
 
 ### Security Issues Resolved in 9.0.0-beta1
 
@@ -81,7 +160,7 @@ This is a **prerelease** of OpenVox 9 and is not yet the stable release. It incl
 
 Released June 10, 2026.
 
-This is a **prerelease** of OpenVox 9 and is not yet the stable release. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-alpha2) for the full list of changes.
+This was a **prerelease** of OpenVox 9. It includes breaking changes; see the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-alpha2) for the full list of changes.
 
 ### Security Issues Resolved in 9.0.0-alpha2
 
@@ -107,4 +186,4 @@ This is a **prerelease** of OpenVox 9 and is not yet the stable release. It incl
 
 Released May 21, 2026.
 
-This is a **prerelease** of OpenVox 9 and is not yet the stable release. See the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-alpha1) for the full list of changes.
+This was a **prerelease** of OpenVox 9. See the [project's github release page](https://github.com/OpenVoxProject/openvox/releases/tag/9.0.0-alpha1) for the full list of changes.
diff --git a/docs/_openvox_9x/supported_platforms.md b/docs/_openvox_9x/supported_platforms.md
index 3dbb98f9c..ca3cc58d1 100644
--- a/docs/_openvox_9x/supported_platforms.md
+++ b/docs/_openvox_9x/supported_platforms.md
@@ -30,9 +30,11 @@ x86-64 only.
 
 ## OpenVox 9.x
 
-> **In development.** OpenVox 9 is in prerelease, and `shared-actions` has not yet
-> frozen a dedicated `9.x` platform list — this table reflects the current
-> development target and can change before the stable 9.0.0 release.
+OpenVox 9 is built from the `main` platform list in `shared-actions`. Compared with
+OpenVox 8, packages are no longer built for Enterprise Linux 7, Amazon Linux 2,
+Fedora 42, Debian 11, or Ubuntu 25.04, and Debian 12 gets `openvox-agent` only
+(OpenVox Server and OpenVoxDB 9 need Java 21 or 25, which Debian 12 does not
+provide).
 
 {% assign rows = site.data.supported_platforms["main"] %}
 
diff --git a/docs/_openvoxdb_9x/configure.markdown b/docs/_openvoxdb_9x/configure.markdown
index d46190bf3..b29609259 100644
--- a/docs/_openvoxdb_9x/configure.markdown
+++ b/docs/_openvoxdb_9x/configure.markdown
@@ -41,7 +41,9 @@ Debian/Ubuntu                | `/etc/default/puppetdb`
 * **`INSTALL_DIR`**: the directory into which OpenVoxDB is installed.
 * **`CONFIG`**: the location of the OpenVoxDB config file, which may be a single file or a directory of .ini files.
 
-The file may also contain `JAVA_BIN` and `USER` from earlier releases. OpenVoxDB 9 packages ignore both: the systemd unit runs the Java binary chosen when the package was built and sets the service user itself.
+The file may also contain `JAVA_BIN` and `USER` from earlier releases. OpenVoxDB 9 packages set the service user in the systemd unit and ignore `USER`.
+`JAVA_BIN` is optional: the unit starts the JVM through `/opt/puppetlabs/server/apps/puppetdb/bin/java`, a launcher that runs the first installed Java from the versions the package supports (25, then 21; the FIPS packages support Java 21 only).
+A leftover `JAVA_BIN="/usr/bin/java"` line from an 8.x install is ignored. Any other value is used as is without validation, so it must point at Java 21 or 25, or at Java 21 for a FIPS package.
 
 ### Configuring the Java heap size
 
diff --git a/docs/_openvoxdb_9x/index.md b/docs/_openvoxdb_9x/index.md
index 768b9ec29..53c9924c4 100644
--- a/docs/_openvoxdb_9x/index.md
+++ b/docs/_openvoxdb_9x/index.md
@@ -5,9 +5,6 @@ layout: default
 
 # Overview and requirements
 
-> **OpenVoxDB 9 is in prerelease.** See the [release notes](./release_notes.html) for
-> the current build and expect breaking changes before the stable 9.0.0 release.
-
 [exported]: /openvox/latest/lang_exported.html
 [connect]: ./connect_puppet_server.html
 [apply]: ./connect_puppet_apply.html
@@ -114,7 +111,7 @@ Your site's OpenVox Server must be running OpenVox Server 8.0.0 or later.
 If you wish to use OpenVoxDB with
 [standalone nodes that are running puppet apply][apply], every node
 must be running 8.0.0 or later. The `openvoxdb-termini` 9.x package depends on
-`openvox-agent` 9.0.0-beta1 or later on the host where it is installed.
+`openvox-agent` on the host where it is installed, with no minimum version.
 
 ### PostgreSQL 14
 
diff --git a/docs/_openvoxdb_9x/known_issues.markdown b/docs/_openvoxdb_9x/known_issues.markdown
index 620f81d7e..3a01f8a0c 100644
--- a/docs/_openvoxdb_9x/known_issues.markdown
+++ b/docs/_openvoxdb_9x/known_issues.markdown
@@ -11,6 +11,14 @@ canonical: "/openvoxdb/latest/known_issues.html"
 
 OpenVoxDB's bugs and feature requests are managed in [OpenVoxDB's issue tracker][tracker]. Search this database if you're having problems and please report any new issues to us!
 
+## FIPS packages ship older Bouncy Castle jars
+
+The FIPS builds of `openvoxdb` 9.0.0 ship an older set of Bouncy Castle FIPS 1.x jars.
+The latest Bouncy Castle FIPS 1.x release has a small issue that could cause problems in
+a very constrained, non-default configuration, so the project is not updating to it.
+OpenVoxDB 9.1 will move to the Bouncy Castle FIPS 2.x line, which is the one fully
+certified for FIPS on Java 21.
+
 ## Hash projection has character limit of 63
 
 Support was added for using dot notation for projections.
diff --git a/docs/_openvoxdb_9x/release_notes.markdown b/docs/_openvoxdb_9x/release_notes.markdown
index fafa09a79..c210640e7 100644
--- a/docs/_openvoxdb_9x/release_notes.markdown
+++ b/docs/_openvoxdb_9x/release_notes.markdown
@@ -5,20 +5,107 @@ layout: default
 
 # OpenVoxDB 9 Release Notes
 
-> **OpenVoxDB 9 is in prerelease.** This page tracks the beta and release-candidate
-> builds ahead of the stable 9.0.0 release. Expect breaking changes between prereleases; see
-> [known issues](./known_issues.html) for anything discovered so far.
-
 OpenVoxDB 9 is released alongside OpenVox 9 and OpenVox Server 9. For the changes on
 those components, see the [OpenVox 9 release notes](/openvox/9.x/release_notes.html)
 and the [OpenVox Server 9 release notes](/openvox-server/9.x/release_notes.html).
 
+## OpenVoxDB 9.0.0
+
+Released October 2, 2026.
+
+This is the first stable release of OpenVoxDB 9. See the
+[project's GitHub release page](https://github.com/OpenVoxProject/openvoxdb/releases/tag/9.0.0)
+for the full list of changes, and the [OpenVox 9 release notes](/openvox/9.x/release_notes.html)
+for the agent-side changes, including the "Upgrading from OpenVox 8" checklist linked
+from there.
+
+Breaking changes compared with OpenVoxDB 8:
+
+- **Java 21 or 25 is required.** The package depends on a Java 25 or Java 21 runtime
+  package and prefers Java 25 wherever the platform provides it; Enterprise Linux 8
+  provides Java 21 only. The FIPS packages run on Java 21 only. Java 17 is no longer
+  supported.
+- **The systemd unit runs the JVM directly.** It starts
+  `/opt/puppetlabs/server/apps/puppetdb/bin/java`, a launcher that runs the first installed
+  Java from the supported list (25, then 21), and reports readiness to systemd
+  (`Type=notify`, or `Type=notify-reload` on systemd 253 or newer). The `puppetdb start`
+  and `puppetdb stop` subcommands are removed; use `systemctl`. `JAVA_BIN` in
+  `/etc/sysconfig/puppetdb` or `/etc/default/puppetdb` is only needed to override the
+  launcher, and a `JAVA_BIN="/usr/bin/java"` line left over from an 8.x install is
+  ignored. `JAVA_ARGS` still applies. See [Configuring OpenVoxDB](./configure.html).
+- **The embedded web server is Jetty 12.** If you upgraded from OpenVoxDB 8.14.0 or
+  earlier with a modified `/etc/puppetlabs/puppetdb/bootstrap.cfg`, the package manager
+  keeps your copy and the service fails to start because the old file loads
+  `jetty10-service`. Replace that line with
+  `puppetlabs.trapperkeeper.services.webserver.jetty-service/jetty-service` (see the
+  8.14.1 entry in the [OpenVoxDB 8 release notes](/openvoxdb/8.x/release_notes.html)).
+- **The `openvoxdb` package requires `openvox-agent` 9.0.0 or newer** on the same host.
+  The `openvoxdb-termini` package depends on `openvox-agent` without a version.
+- **Platforms.** Packages are no longer built for Debian 11, Debian 12, Ubuntu 25.04,
+  Amazon Linux 2, or Fedora 42; see
+  [Supported platforms](/openvox/9.x/supported_platforms.html).
+
+Other notable changes:
+
+- Two new `puppetdb.conf` settings, `fact_names_blocklist` and
+  `fact_names_blocklist_regex`, let the termini drop facts, including individual keys
+  inside structured facts, before they are sent to OpenVoxDB. Invalid expressions are
+  rejected when `puppetdb.conf` is loaded. See
+  [Configuring a Puppet/OpenVoxDB connection](./puppetdb_connection.html#fact_names_blocklist).
+- `puppetdb ssl-setup` no longer calls `puppet agent --configprint`, which the OpenVox 9
+  agent removed.
+- The published source tarball contains the complete uberjar again; the 8.16.0 and
+  9.0.0-rc1 tarballs were missing files.
+- The `openvoxdb-terminus` gem allows openvox 9.
+
+### Security issues resolved in 9.0.0
+
+Compared with OpenVoxDB 8.16.0. The Bouncy Castle scores are CVSS 4.0 base scores from
+NVD; the project's release page lists them as not yet scored.
+
+| Identifier                                                        | CVSS Score | Resolved By                                                             |
+| :---------------------------------------------------------------- | :--------: | :---------------------------------------------------------------------- |
+| [CVE-2026-71885](https://nvd.nist.gov/vuln/detail/CVE-2026-71885) |    9.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-17507](https://nvd.nist.gov/vuln/detail/CVE-2026-17507) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71888](https://nvd.nist.gov/vuln/detail/CVE-2026-71888) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71889](https://nvd.nist.gov/vuln/detail/CVE-2026-71889) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71890](https://nvd.nist.gov/vuln/detail/CVE-2026-71890) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-18036](https://nvd.nist.gov/vuln/detail/CVE-2026-18036) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71886](https://nvd.nist.gov/vuln/detail/CVE-2026-71886) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71887](https://nvd.nist.gov/vuln/detail/CVE-2026-71887) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-85515](https://nvd.nist.gov/vuln/detail/CVE-2026-85515) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.7`              |
+| [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.7`              |
+| [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.7`          |
+| [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.7`          |
+| [CVE-2026-71891](https://nvd.nist.gov/vuln/detail/CVE-2026-71891) |    7.1     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71892](https://nvd.nist.gov/vuln/detail/CVE-2026-71892) |    6.9     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-18040](https://nvd.nist.gov/vuln/detail/CVE-2026-18040) |    5.9     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-17508](https://nvd.nist.gov/vuln/detail/CVE-2026-17508) |    5.3     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+
+## OpenVoxDB 9.0.0-rc2
+
+Released September 29, 2026.
+
+This was the last release candidate before 9.0.0. See the
+[project's GitHub release page](https://github.com/OpenVoxProject/openvoxdb/releases/tag/9.0.0-rc2)
+for the full list of changes.
+
+Notable changes in this build:
+
+- Packages are built with EZbake 4.2.0. The systemd unit starts the JVM through the
+  `bin/java` launcher described in the 9.0.0 entry, which runs the first installed Java
+  from the supported list and honors `JAVA_BIN` from the defaults file when it points at
+  a supported version. This replaces the 9.0.0-rc1 behavior of running the Java binary
+  chosen at package build time.
+- The FIPS source tarballs are named correctly.
+- Bouncy Castle 1.86, Jackson 2.21.7, logback 1.6.4, and other dependency updates.
+
 ## OpenVoxDB 9.0.0-rc1
 
 Released September 9, 2026.
 
-This is the first **release candidate** of OpenVoxDB 9 and is not yet the stable
-release. See the
+This was the first **release candidate** of OpenVoxDB 9. See the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvoxdb/releases/tag/9.0.0-rc1)
 for the full list of changes.
 
@@ -31,9 +118,10 @@ Notable breaking changes in this build:
   `Type=notify-reload` where systemd 253 or newer is available), so systemd reports
   the service as started only after OpenVoxDB is fully up. Packages depend on a
   Java 25 runtime where the platform provides one and on Java 21 otherwise.
-- The `openvoxdb` and `openvoxdb-termini` packages now require `openvox-agent`
-  9.0.0-beta1 or later. The beta1 packages had no upper bound and installed alongside
-  an 8.x agent; the release candidate does not.
+- The `openvoxdb` package now requires `openvox-agent` 9.0.0-beta1 or later. The
+  beta1 package had no upper bound and installed alongside an 8.x agent; the release
+  candidate does not. The `openvoxdb-termini` package still depends on
+  `openvox-agent` without a version.
 
 Other notable changes:
 
@@ -50,7 +138,7 @@ Other notable changes:
 
 Released July 15, 2026.
 
-This is a **prerelease** of OpenVoxDB 9 and is not yet the stable release. It includes
+This was a **prerelease** of OpenVoxDB 9. It includes
 breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvoxdb/releases/tag/9.0.0-beta1)
 for the full list of changes.