diff --git a/.changeset/ecosystem-bump-api-v0-13-1.md b/.changeset/ecosystem-bump-api-v0-13-1.md
new file mode 100644
index 0000000..97575e4
--- /dev/null
+++ b/.changeset/ecosystem-bump-api-v0-13-1.md
@@ -0,0 +1,31 @@
+---
+'seamless-cli': minor
+---
+
+Move the scaffold onto auth API `v0.13.1`, admin dashboard `v0.7.0`, and seamless-templates `v0.14.0`.
+
+`v0.13.0` instruments the auth path. Every `auth_events` row now carries a deployment id, a device
+class folded from the user agent, the subject's mail provider (a provider name, never the domain),
+an owner flag, and the attempt the row belongs to (the ephemeral token's new `jti`). `GET
+/internal/metrics/funnel` reports time to registration, time to login and passkey adoption, and
+`GET /internal/metrics/sign-ins` reports sign-in outcomes per method, device class, mail provider
+and owner flag, with where attempts stop. The same release ships dashboard `v0.7.0` inside the API
+image, which is what that dashboard release needs: its Overview gains a Passwordless Funnel section
+and a Sign-in Outcomes section that read those two routes. `v0.13.1` is the same server on a
+release image that applies Debian security updates at build time, since `v0.13.0` never published an
+image (its scan failed on a base-image `pcre2` finding).
+
+The admin dashboard pin moves with it, so the standalone console (`--admin=image` and
+`--admin=source`) serves the same release the API image serves at `/console`. Against an older API
+the two new Overview sections report themselves unavailable in place and the rest of the screen is
+unaffected.
+
+Templates `v0.14.0` carries `@seamless-auth/express` `0.15.0` and `@seamless-auth/fastify` `0.6.0`
+in the API starters, and the conformance harness's adapters take the same `^0.15.0` and `^0.6.0`.
+Those adapters forward the browser's user agent to the API as `x-seamless-client-user-agent`
+beside the client address they already forward, and pass the sign-ins route through. The adapter is
+the only client the API sees, so a project on the older adapters has every audit row recorded as the
+adapter's own user agent and its breakdown by device reads `unknown`; the other dimensions do not
+depend on it. Nothing else in the starters moves: the manifest contract and the registry are
+byte-identical to `v0.13.0`, and the React starters stay on `@seamless-auth/react` `0.12.0`, since
+the token claim the API added is one the client never reads.
diff --git a/src/core/images.ts b/src/core/images.ts
index 43e0e5e..8c1a58b 100644
--- a/src/core/images.ts
+++ b/src/core/images.ts
@@ -3,11 +3,11 @@
 // scaffolded with, and never has its data directory pulled out from under it.
 export const POSTGRES_IMAGE = "postgres:18";
 
-export const SEAMLESS_AUTH_API_VERSION = "v0.12.0";
+export const SEAMLESS_AUTH_API_VERSION = "v0.13.1";
 
 export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`;
 
-export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.6.0";
+export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.7.0";
 
 export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`;
 
@@ -25,4 +25,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_V
 // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR.
 export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates";
 
-export const SEAMLESS_TEMPLATES_REF = "v0.13.0";
+export const SEAMLESS_TEMPLATES_REF = "v0.14.0";
diff --git a/verify/adapter-app/package.json b/verify/adapter-app/package.json
index 2a543cf..6f6652e 100644
--- a/verify/adapter-app/package.json
+++ b/verify/adapter-app/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.",
   "dependencies": {
-    "@seamless-auth/express": "^0.14.0",
+    "@seamless-auth/express": "^0.15.0",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "express": "^5.1.0"
diff --git a/verify/adapter-fastify-app/package.json b/verify/adapter-fastify-app/package.json
index 10aae80..66a72b7 100644
--- a/verify/adapter-fastify-app/package.json
+++ b/verify/adapter-fastify-app/package.json
@@ -6,7 +6,7 @@
   "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/fastify with a capture transport.",
   "dependencies": {
     "@fastify/cors": "^11.0.1",
-    "@seamless-auth/fastify": "^0.5.0",
+    "@seamless-auth/fastify": "^0.6.0",
     "fastify": "^5.2.0"
   }
 }