diff --git a/server/api/index.php b/server/api/index.php
index cd0b4a6..64c9ceb 100644
--- a/server/api/index.php
+++ b/server/api/index.php
@@ -41,12 +41,16 @@ $route  = trim((string)($_GET['route'] ?? ''), '/');
 $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
 
 if ($method === 'GET' && ($route === '' || $route === 'manifest')) {
+    // Crypto requis : depuis v0.27.0 le manifest est re-signé à la volée
+    // selon le channel demandé (filtrage server-side).
+    require __DIR__ . '/lib/Crypto.php';
     require __DIR__ . '/routes/Manifest.php';
     \PSLauncher\Routes\Manifest::handle($config);
     return;
 }
 
-if ($method === 'GET' && preg_match('#^releasenotes/([0-9]+\.[0-9]+\.[0-9]+)$#', $route, $m)) {
+// Release notes : accepte 'X.Y.Z' (legacy) ou id stable 'v' + 8 hex (v0.27.1+)
+if ($method === 'GET' && preg_match('#^releasenotes/(v[0-9a-f]{8}|[0-9]+\.[0-9]+\.[0-9]+)$#', $route, $m)) {
     require __DIR__ . '/routes/Releasenotes.php';
     \PSLauncher\Routes\Releasenotes::handle($m[1]);
     return;