diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09f8902..2c61247 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,17 @@ links to its full release notes on GitHub.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [1.98.9-Signed] - 2026-07-21 - Tailscale VPN 1.98.9 (Signed)
+
+- Packages are now signed with the Axis ACAP signing service and install
+  normally on AXIS OS 12.10 and later.
+- Vendor updated to `moshe@mohome.net` with the registered vendor ID.
+- `root` and `acap3` variants remain unsigned (manifest schema v1.x).
+- Upgrading from an earlier unsigned version can fail with "Couldn't
+  install: app" (device log: "Vendor ID in manifest does not match the
+  vendor ID of the previous version"). Back up your config, uninstall the
+  old version, then install this one.
+
 ## [1.98.8-2] - 2026-07-03 - Tailscale VPN 1.98.8-2
 
 ## [1.98.8-subnet-routing] - 2026-07-01 - Tailscale VPN 1.98.8 - Subnet Routing
diff --git a/README.md b/README.md
index d1850c4..16ed792 100644
--- a/README.md
+++ b/README.md
@@ -73,6 +73,15 @@ access for third-party applications). Learn more:
 
 ## Installation
 
+> **Signed packages:** Release `.eap` files are signed with the Axis ACAP
+> signing service and install normally on AXIS OS 12.10 and later.
+>
+> **Upgrading from an earlier version?** The signing vendor changed, so
+> installing over a previously installed unsigned build can fail with
+> **"Couldn't install: app"** (device log: *"Vendor ID in manifest does not
+> match the vendor ID of the previous version"*). To upgrade: back up your app
+> configuration, **uninstall** the old version, then install the signed one.
+
 Get the **prebuilt `.eap` file** from the
 [Releases page](https://github.com/Mo3he/Axis_Cam_Tailscale/releases).
 
@@ -215,8 +224,9 @@ announcement for details.
 - [x] **Verify web UI works over HTTPS** - Verified live; the UI only issues
   relative-path requests, so it inherits the page's protocol with no
   mixed-content risk.
-- [ ] **Sign the ACAP via the Axis ACAP Portal** - Deferred; the manifest's
-  `vendorId` is a placeholder value, not yet portal-registered.
+- [x] **Sign the ACAP via the Axis ACAP Portal** - Done; `aarch64`/`armv7hf`
+  packages are signed with the Axis ACAP signing service. The `root` and
+  `acap3` variants use manifest schema v1.x and are distributed unsigned.
 
 ### General Improvements
 
diff --git a/aarch64/app/manifest.json b/aarch64/app/manifest.json
index 38e4f48..f2bcbe6 100644
--- a/aarch64/app/manifest.json
+++ b/aarch64/app/manifest.json
@@ -4,8 +4,8 @@
         "setup": {
             "appName": "Tailscale_VPN",
             "friendlyName": "Tailscale VPN",
-            "vendor": "Mo3he",
-            "vendorId": "5741c1fb91",
+            "vendor": "moshe@mohome.net",
+            "vendorId": "70ee172dd9",
             "vendorUrl": "https://github.com/Mo3he/Axis_Cam_Tailscale",
             "version": "1.98.9",
             "architecture": "aarch64",
diff --git a/aarch64_ROOT/app/manifest.json b/aarch64_ROOT/app/manifest.json
index 0df1f28..2394c12 100644
--- a/aarch64_ROOT/app/manifest.json
+++ b/aarch64_ROOT/app/manifest.json
@@ -4,7 +4,7 @@
         "setup": {
             "appName": "Tailscale_VPN",
             "friendlyName": "Tailscale VPN",
-            "vendor": "Mo3he",
+            "vendor": "moshe@mohome.net",
             "embeddedSdkVersion": "3.0",
             "user": {
               "group": "root",
diff --git a/arm/app/manifest.json b/arm/app/manifest.json
index 77a455a..999133b 100644
--- a/arm/app/manifest.json
+++ b/arm/app/manifest.json
@@ -4,8 +4,8 @@
         "setup": {
             "appName": "Tailscale_VPN",
             "friendlyName": "Tailscale VPN",
-            "vendor": "Mo3he",
-            "vendorId": "5741c1fb91",
+            "vendor": "moshe@mohome.net",
+            "vendorId": "70ee172dd9",
             "vendorUrl": "https://github.com/Mo3he/Axis_Cam_Tailscale",
             "version": "1.98.9",
             "architecture": "armv7hf",
diff --git a/arm_ROOT/app/manifest.json b/arm_ROOT/app/manifest.json
index 183b717..a5d4e51 100644
--- a/arm_ROOT/app/manifest.json
+++ b/arm_ROOT/app/manifest.json
@@ -4,7 +4,7 @@
         "setup": {
             "appName": "Tailscale_VPN",
             "friendlyName": "Tailscale VPN",
-            "vendor": "Mo3he",
+            "vendor": "moshe@mohome.net",
             "embeddedSdkVersion": "3.0",
             "user": {
               "group": "root",