diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7df9c4d..4135669 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,25 @@ No unreleased changes yet.
 
 ---
 
+## [1.5.1] - 2026-07-22 - Security Gate Hardening Release
+
+### Added
+
+- Pinned Semgrep and Gitleaks security checks with reproducible toolchain metadata.
+- CycloneDX SBOM generation and golden regression fixtures for the security gate.
+
+### Security
+
+- Run dependency installation without lifecycle scripts in the security gate.
+- Verify scanner provenance and block high or critical npm audit findings.
+
+### Changed
+
+- Document the security gate, its update procedure, and local verification commands.
+- Synchronize the runtime, package, distribution status, and release metadata at `1.5.1`.
+
+---
+
 ## [1.5.0] - 2026-07-12 - Security and SQL Database Analysis Release
 
 ### Added
diff --git a/README.md b/README.md
index 3090dc4..6a2ef33 100644
--- a/README.md
+++ b/README.md
@@ -12,8 +12,8 @@ automatic release decisions. `critical` and `high` are gate severity labels used
 to prioritize human review; the final release decision remains with the human
 or downstream approval gate.
 
-[![Package](https://img.shields.io/badge/package-1.5.0-blue)](CHANGELOG.md)
-[![GitHub release](https://img.shields.io/badge/GitHub%20release-v1.5.0-yellow)](https://github.com/RNA4219/code-to-gate/releases)
+[![Package](https://img.shields.io/badge/package-1.5.1-blue)](CHANGELOG.md)
+[![GitHub release](https://img.shields.io/badge/GitHub%20release-v1.5.1-yellow)](https://github.com/RNA4219/code-to-gate/releases)
 [![npm](https://img.shields.io/badge/npm-not%20published-lightgrey)](https://www.npmjs.com/package/@quality-harness/code-to-gate)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/Node-20%2B-green)](https://nodejs.org/)
@@ -24,12 +24,12 @@ Language: English | [日本語](README_JA.md)
 
 | Channel | Status |
 |---------|--------|
-| `package.json` | `1.5.0` |
-| GitHub Release | `v1.5.0` latest published release |
+| `package.json` | `1.5.1` |
+| GitHub Release | `v1.5.1` latest published release |
 | npm registry | Not published yet |
 
 See [Distribution Status](docs/distribution-status.md) for the release/publication matrix.
-`1.5.0` is available as a GitHub Release. The npm package remains unpublished,
+`1.5.1` is available as a GitHub Release. The npm package remains unpublished,
 so install from GitHub/source until npm publication is completed.
 
 ## Install
diff --git a/README_JA.md b/README_JA.md
index d932759..37d666f 100644
--- a/README_JA.md
+++ b/README_JA.md
@@ -15,12 +15,12 @@ finding は **review-required candidate** であり、確定済み脆弱性や
 
 | チャネル | 状態 |
 |----------|------|
-| `package.json` | `1.5.0` |
-| GitHub Release | 公開済み最新は `v1.5.0` |
+| `package.json` | `1.5.1` |
+| GitHub Release | 公開済み最新は `v1.5.1` |
 | npm registry | 未公開 |
 
 詳細は [Distribution Status](docs/distribution-status.md) を正本にします。
-`1.5.0` は GitHub Release として公開済みです。npm publish は未完了のため、npm 公開までは GitHub/source install を利用してください。
+`1.5.1` は GitHub Release として公開済みです。npm publish は未完了のため、npm 公開までは GitHub/source install を利用してください。
 
 ## インストール
 
diff --git a/docs/distribution-status.md b/docs/distribution-status.md
index 447cf12..9533ee6 100644
--- a/docs/distribution-status.md
+++ b/docs/distribution-status.md
@@ -2,8 +2,8 @@
 intent_id: DOC-DISTRIBUTION-STATUS-001
 owner: code-to-gate-team
 status: active
-last_reviewed_at: 2026-07-12
-next_review_due: 2026-08-12
+last_reviewed_at: 2026-07-22
+next_review_due: 2026-08-22
 ---
 
 # Distribution Status
@@ -15,8 +15,8 @@ npm publication status.
 
 | Channel | Current State | Notes |
 |---------|---------------|-------|
-| `package.json` | `1.5.0` | Release package version |
-| GitHub Release | `v1.5.0` | Published 2026-07-12 |
+| `package.json` | `1.5.1` | Release package version |
+| GitHub Release | `v1.5.1` | Published 2026-07-22 |
 | npm registry | Not published | `npm view @quality-harness/code-to-gate` returned `E404` on 2026-07-12 |
 | Recommended install | GitHub install | Use `npm install -g github:RNA4219/code-to-gate` until npm publish is complete |
 | Local npm auth | Not authenticated | `npm whoami` returns `ENEEDAUTH`; maintainer login is required before publish |
@@ -35,9 +35,9 @@ npm install -g @quality-harness/code-to-gate
 
 ## Release Alignment
 
-| Item | v1.5.0 Status |
+| Item | v1.5.1 Status |
 |------|---------------------------------------|
-| Git tag | `v1.5.0` created and pushed |
+| Git tag | `v1.5.1` created and pushed |
 | GitHub release | Published with notes based on `CHANGELOG.md` |
 | npm package | Pending `npm login` and `npm publish --access public` |
 | Package integrity | Passed before release; CI records the integrity artifact |
@@ -45,13 +45,13 @@ npm install -g @quality-harness/code-to-gate
 
 ## Release Notes Alignment
 
-`CHANGELOG.md` is the source for the published `v1.5.0` release notes. GitHub
-and source installation now provide `v1.5.0`; npm remains unavailable until a
+`CHANGELOG.md` is the source for the published `v1.5.1` release notes. GitHub
+and source installation now provide `v1.5.1`; npm remains unavailable until a
 maintainer publishes the package after authenticating to npm.
 
 ## Publication Evidence Policy
 
-No npm publication has been performed for `1.5.0`. If npm publication is
+No npm publication has been performed for `1.5.1`. If npm publication is
 performed, the release evidence bundle must include:
 
 - `npm whoami`
diff --git a/package-lock.json b/package-lock.json
index c56574a..ccafa70 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@quality-harness/code-to-gate",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@quality-harness/code-to-gate",
-      "version": "1.5.0",
+      "version": "1.5.1",
       "license": "MIT",
       "dependencies": {
         "acorn": "^8.14.1",
diff --git a/package.json b/package.json
index 39ec1e1..1beb08e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@quality-harness/code-to-gate",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "A local-first quality harness that turns repository signals into evidence-backed quality risks, test seeds, and release-readiness gate inputs",
   "type": "module",
   "packageManager": "npm@10.9.8",
diff --git a/src/core/database-analyzer.ts b/src/core/database-analyzer.ts
index 4e5fae0..585301c 100644
--- a/src/core/database-analyzer.ts
+++ b/src/core/database-analyzer.ts
@@ -635,7 +635,7 @@ export function analyzeDatabaseAssetsAtRef(options: DatabaseAnalysisAtRefOptions
       },
       tool: {
         name: "code-to-gate",
-        version: "1.5.0",
+        version: "1.5.1",
         plugin_versions: [],
       },
       completeness: "partial",