diff --git a/build.ps1 b/build.ps1
index d0b2edb..b560d8c 100644
--- a/build.ps1
+++ b/build.ps1
@@ -178,6 +178,15 @@ function Write-Manifest {
 }
 
 function Update-Changelog {
+    <#
+        Promotes whatever sits under "## Unreleased" into a section for this version, leaving a fresh empty
+        "## Unreleased" above it.
+
+        The release workflow builds its release body by extracting the section whose heading matches the version
+        it just produced. Inserting the version heading above the notes - as this previously did - left that
+        section containing only the build line while the actual notes stayed under "Unreleased", so every
+        release published an empty changelog.
+    #>
     param([string]$Version, [string]$CommitHash)
 
     if (-not $ChangelogFile.Exists) { return }
@@ -185,11 +194,31 @@ function Update-Changelog {
     $existing = Get-Content -LiteralPath $ChangelogFile.FullName -Raw
     if ($existing -match [Regex]::Escape($marker)) { return }
 
-    $insertion = "## $Version`r`n`r`n- Build produced from commit $CommitHash.`r`n`r`n"
-    $unreleasedRegex = [regex]::new('(?m)^## Unreleased\r?$')
-    if (-not $unreleasedRegex.IsMatch($existing)) { return }
-    $updated = $unreleasedRegex.Replace($existing, "## Unreleased`r`n`r`n$insertion## Unreleased (carried forward)", 1)
-    [System.IO.File]::WriteAllText($ChangelogFile.FullName, $updated, [System.Text.UTF8Encoding]::new($false))
+    $unreleasedRegex = [regex]::new('(?m)^## Unreleased[^\r\n]*\r?$')
+    $unreleasedMatch = $unreleasedRegex.Match($existing)
+    if (-not $unreleasedMatch.Success) { return }
+
+    # Everything from just after the Unreleased heading to the next "## " heading is this version's notes.
+    $bodyStart = $unreleasedMatch.Index + $unreleasedMatch.Length
+    $nextHeading = [regex]::new('(?m)^## ').Match($existing, $bodyStart)
+    $bodyEnd = if ($nextHeading.Success) { $nextHeading.Index } else { $existing.Length }
+
+    $notes = $existing.Substring($bodyStart, $bodyEnd - $bodyStart).Trim()
+
+    # Italicised and last so it reads as provenance rather than as another entry in whichever section the
+    # notes happened to end on.
+    $buildLine = "_Build produced from commit $CommitHash._"
+    $versionBody = if ([string]::IsNullOrWhiteSpace($notes)) { $buildLine } else { "$notes`r`n`r`n$buildLine" }
+
+    $rebuilt = New-Object System.Text.StringBuilder
+    [void]$rebuilt.Append($existing.Substring(0, $unreleasedMatch.Index))
+    [void]$rebuilt.Append("## Unreleased`r`n`r`n")
+    [void]$rebuilt.Append("## $Version`r`n`r`n")
+    [void]$rebuilt.Append($versionBody)
+    [void]$rebuilt.Append("`r`n`r`n")
+    [void]$rebuilt.Append($existing.Substring($bodyEnd))
+
+    [System.IO.File]::WriteAllText($ChangelogFile.FullName, $rebuilt.ToString(), [System.Text.UTF8Encoding]::new($false))
 }
 
 
diff --git a/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs b/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs
index fb35c90..714c16b 100644
--- a/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs
+++ b/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs
@@ -668,6 +668,11 @@ namespace PSInfisicalAPI.Endpoints
                 RequiresAuthorization = true
             });
 
+            // RetrieveCertificate and GetCertificateBundle deliberately lead with the older /api/v1/pki route:
+            // it resolves a certificate by SERIAL NUMBER, which is what callers supply. The newer
+            // /api/v1/cert-manager route takes a certificate ID and passes it straight through as
+            // getCert({ id }), so it cannot answer a serial. Both are registered so either identifier resolves;
+            // reordering these two would send every serial lookup to the route that cannot serve it.
             Add(map, new InfisicalEndpointDefinition
             {
                 Name = InfisicalEndpointNames.RetrieveCertificate,
@@ -747,7 +752,7 @@ namespace PSInfisicalAPI.Endpoints
                 Resource = "Pki",
                 Version = "v1",
                 Method = "POST",
-                Template = "/api/v1/pki/ca/{caId}/sign-certificate",
+                Template = "/api/v1/cert-manager/ca/{caId}/sign-certificate",
                 RequiresAuthorization = true,
                 ContainsSecretMaterialInResponse = true
             });
@@ -758,7 +763,7 @@ namespace PSInfisicalAPI.Endpoints
                 Resource = "Pki",
                 Version = "v1",
                 Method = "POST",
-                Template = "/api/v1/cert-manager/ca/{caId}/sign-certificate",
+                Template = "/api/v1/pki/ca/{caId}/sign-certificate",
                 RequiresAuthorization = true,
                 ContainsSecretMaterialInResponse = true
             });