diff --git a/.changeset/console-a136322f8723.md b/.changeset/console-a136322f8723.md
new file mode 100644
index 0000000000..fe6c70b016
--- /dev/null
+++ b/.changeset/console-a136322f8723.md
@@ -0,0 +1,26 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `a136322f8723`. Frontend changes in this range:
+
+- fix(app-shell)!: a modal action is client-side only — drop the server fallthrough (objectstack#3959) (#2973)
+- fix(app-shell)!: the server-action URL identifies an action by `name`, not `target` (ADR-0110 D1) (#2970)
+- fix(form): a server rejection that names fields now marks those fields (#2966)
+- fix(actions): one source for the /actions envelope rule, and redirectUrl finally works (#2967)
+- fix(actions): apply the ADR-0066 D4 capability gate on every action surface (framework#3923) (#2965)
+- fix(detail): multi-value lookup is selectable in inline edit (#2957)
+- fix(actions): a failed server action no longer reports as success (green toast) (#2963)
+- fix(fields): the criteria builder stops calling an empty criteria "All records" (#2962)
+- feat(report): carry a report's `order` into the dataset selection (framework#3916) (#2964)
+- feat(views): the list toolbar speaks one vocabulary — `userActions` (#2890) (#2948)
+
+objectui range: `4a4829d0ef39...a136322f8723`
+
+**Release-critical for v17.** The previous pin (`4a4829d0ef39`) predates the
+ADR-0110 D1 client fix, so the console it builds still posts `action.target`
+to `/api/v1/actions/:object/:action`. Against a v17 server — which resolves
+the declaration by `name` and refuses an unresolvable one (D3) — every
+target-bound script action would return 404 from the shipped console. The
+lockstep the ADR called for is enforced by THIS pin, not by merging the
+objectui PR, so v17 must not ship without this bump.
diff --git a/.objectui-sha b/.objectui-sha
index 91efad8815..9dbc85e7c3 100644
--- a/.objectui-sha
+++ b/.objectui-sha
@@ -1 +1 @@
-4a4829d0ef3926e9b55757bfb1e369d6dca61ac2
+a136322f872314a74462ac7e7142f424e1124400