diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2f211f6f..ca2cbc9cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 All notable changes to this project are documented in this file.
 
+## 1.9.2
+
+**Release date:** 2026-07-07
+
+This patch release disables Flux variable substitution on the source-controller
+CRDs by annotating them with `kustomize.toolkit.fluxcd.io/substitute: disabled`,
+so that Kustomizations with post-build substitution enabled no longer corrupt
+the CRD schemas when they contain `${...}` sequences. It also caches the
+registry authorization token during Notation verification, so the token is
+fetched once per verification instead of once per request, reducing
+token-endpoint traffic against the registry.
+
+Fixes:
+- Disable variable substitution in CRDs
+  [#2103](https://github.com/fluxcd/source-controller/pull/2103)
+
+Improvements:
+- Cache registry token during Notation verification
+  [#2105](https://github.com/fluxcd/source-controller/pull/2105)
+
 ## 1.9.1
 
 **Release date:** 2026-06-30
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
index 518613c1b..e84131b5c 100644
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -6,4 +6,4 @@ resources:
 images:
 - name: fluxcd/source-controller
   newName: fluxcd/source-controller
-  newTag: v1.9.1
+  newTag: v1.9.2
diff --git a/go.mod b/go.mod
index 05144bb72..e7b10983c 100644
--- a/go.mod
+++ b/go.mod
@@ -39,7 +39,7 @@ require (
 	github.com/fluxcd/pkg/tar v1.2.0
 	github.com/fluxcd/pkg/testserver v0.14.0
 	github.com/fluxcd/pkg/version v0.16.0
-	github.com/fluxcd/source-controller/api v1.9.1
+	github.com/fluxcd/source-controller/api v1.9.2
 	github.com/go-git/go-billy/v5 v5.9.0
 	github.com/go-git/go-git/v5 v5.19.1
 	github.com/go-logr/logr v1.4.3