diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4e49eb4..516ad3b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 3.2.1 — 2026-10-18
+
+- **Heinzel Pro follows a server to its new address.**
+  `rules/rollback-timer.md` no longer asks to enter a
+  new address in the server's form before the disarm:
+  Pro's `follow_address` tool moves the server once the
+  new address shows the pinned host key.
+
 ## 3.2.0 — 2026-10-18
 
 - **Every change has a way back, decided first.**
diff --git a/VERSION b/VERSION
index 944880f..e4604e3 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.2.0
+3.2.1
diff --git a/rules/rollback-timer.md b/rules/rollback-timer.md
index 9b7ec32..8fe11b1 100644
--- a/rules/rollback-timer.md
+++ b/rules/rollback-timer.md
@@ -159,8 +159,10 @@ guard hook denies a redirect onto a computed target.
    `pkill -F /var/run/heinzel-rollback-<ts>.pid`.
    Heinzel Pro sends every command naming
    `heinzel-rollback-` over a new login of its own,
-   so there the disarm is its own confirmation; enter
-   a new address in the server's form first.
+   so there the disarm is its own confirmation. After
+   an address change call its `follow_address` tool
+   first; it moves the server once the new address
+   shows the pinned host key.
    Check the timer is gone, then persist the runtime
    change (firewalld: repeat the command with
    `--permanent`) and update server memory with the