diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e1d7c9..044395c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to Patternflow will be documented in this file.
 
 ## [Unreleased]
 
+## [3.4.1] - 2026-08-12
+
+### Changed
+- **A broker ships with the firmware, so MQTT works without standing up a server first.** The host and login move out of the gitignored secrets header and into `net_config.h` as published defaults — they are in the repo and readable in every release image, which is the honest place for a credential that goes to everybody. The account is scoped to match: it can read and write the `patternflow` topic and nothing else on that server, so publishing it costs its owner a topic rather than a broker. Run by **[@SimonePDA](https://github.com/SimonePDA)**, who contributed the MQTT work and confirmed the terms. Nothing dials on its own — the role still lives in NVS and starts at Off, so this arms the option rather than the radio. Point a board somewhere else by overriding `PF_MQTT_HOST` (and friends) in `patternflow_secrets.h`, which is included first and wins.
+
 ## [3.4.0] - 2026-08-12
 
 Patterns leave the firmware and live on the filesystem, so a board ships nearly empty — and a pack ships with it. **Hardware unchanged**; v3.0 board and case carry over as-is.
diff --git a/firmware/patternflow/net_config.h b/firmware/patternflow/net_config.h
index 664648a..e3c53ff 100644
--- a/firmware/patternflow/net_config.h
+++ b/firmware/patternflow/net_config.h
@@ -72,7 +72,7 @@
 // Firmware version string reported to the flasher (Improv device-info RPC).
 // Keep in sync with web/public/flash/manifest.json.
 #ifndef PF_IMPROV_FW_VERSION
-#define PF_IMPROV_FW_VERSION "3.4.0"
+#define PF_IMPROV_FW_VERSION "3.4.1"
 #endif
 
 // ── OTA (wireless flashing from Arduino IDE / espota.py) ─────
@@ -181,8 +181,7 @@
 // anything. Nothing connects until a role is picked AND a broker host is
 // set, so the default build is inert.
 //
-// Broker credentials belong in patternflow_secrets.h (gitignored), never
-// here: this file ships in the repo and lands in every published .bin.
+// A shared broker ships with the firmware — see the block further down.
 //
 // This costs internal DRAM: ~600 B of statics, plus ~1.8 KB for the socket
 // while a role is connected. That is worth knowing because the web console
@@ -206,20 +205,48 @@
 #ifndef PF_MQTT_HTTP_ENABLED
 #define PF_MQTT_HTTP_ENABLED PF_MQTT_ENABLED
 #endif
-// Empty (the default) = no broker configured; the role picker says so and
-// nothing is dialled. Set it in patternflow_secrets.h.
+// ── The shared Patternflow broker ────────────────────────────
+// A broker anyone with a Patternflow may use, run and paid for by
+// @SimonePDA (Simone Majocchi), who contributed the MQTT work and opened it
+// for exactly this. It ships so that two panels can mirror each other, or a
+// panel can join a home setup, without first standing up a server.
+//
+// These are PUBLISHED DEFAULTS, not secrets, and the login below is scoped
+// to match: it can read and write the `patternflow` topic and nothing else
+// on that server. That is what makes shipping it sound rather than reckless
+// — the account cannot be used to reach anything private, so publishing it
+// costs its owner a topic, not a broker.
+//
+// Stated plainly because it is in the repo and readable in every .bin we
+// release. A credential that ships to everyone is public from the first
+// download; writing it here rather than hiding it in the gitignored secrets
+// file only means the people reading the source can see what their board is
+// configured to talk to. The release credential scan treats anything in this
+// file as public for the same reason.
+//
+// Terms confirmed by @SimonePDA, 2026-08-12: "the MQTT broker data can be
+// currently shared with other users as the broker is secured and allows just
+// the patternflow topic to be read/written".
+//
+// It still dials nothing on its own. The role (Off / Publisher /
+// Subscriber) lives in NVS and starts at Off, so shipping a broker arms the
+// option rather than the radio — a board that is never told to publish
+// never connects.
+//
+// Running your own broker, or want off this one entirely? Override any of
+// these in patternflow_secrets.h; that file is included first and wins.
 #ifndef PF_MQTT_HOST
-#define PF_MQTT_HOST ""
+#define PF_MQTT_HOST "Simonehome.xyz"
 #endif
 #ifndef PF_MQTT_PORT
 #define PF_MQTT_PORT 1883
 #endif
 // Empty user = connect anonymously (brokers on a trusted LAN often allow it).
 #ifndef PF_MQTT_USER
-#define PF_MQTT_USER ""
+#define PF_MQTT_USER "patternflow"
 #endif
 #ifndef PF_MQTT_PASS
-#define PF_MQTT_PASS ""
+#define PF_MQTT_PASS "pattern_pw_01"
 #endif
 // Topic root: <prefix>/knob/1..4 and <prefix>/pattern. Give each panel its
 // own prefix when several share a broker and should NOT mirror each other.
diff --git a/web/public/flash/bin/v3.4.1/boot_app0.bin b/web/public/flash/bin/v3.4.1/boot_app0.bin
new file mode 100644
index 0000000..13562ca
Binary files /dev/null and b/web/public/flash/bin/v3.4.1/boot_app0.bin differ
diff --git a/web/public/flash/bin/v3.4.1/patternflow.ino.bin b/web/public/flash/bin/v3.4.1/patternflow.ino.bin
new file mode 100644
index 0000000..80142fc
Binary files /dev/null and b/web/public/flash/bin/v3.4.1/patternflow.ino.bin differ
diff --git a/web/public/flash/bin/v3.4.1/patternflow.ino.bootloader.bin b/web/public/flash/bin/v3.4.1/patternflow.ino.bootloader.bin
new file mode 100644
index 0000000..1b0e84c
Binary files /dev/null and b/web/public/flash/bin/v3.4.1/patternflow.ino.bootloader.bin differ
diff --git a/web/public/flash/bin/v3.4.1/patternflow.ino.partitions.bin b/web/public/flash/bin/v3.4.1/patternflow.ino.partitions.bin
new file mode 100644
index 0000000..223d9eb
Binary files /dev/null and b/web/public/flash/bin/v3.4.1/patternflow.ino.partitions.bin differ
diff --git a/web/public/flash/manifest.json b/web/public/flash/manifest.json
index eb55369..7b10531 100644
--- a/web/public/flash/manifest.json
+++ b/web/public/flash/manifest.json
@@ -1,15 +1,15 @@
 {
   "name": "Patternflow",
-  "version": "v3.4.0",
+  "version": "v3.4.1",
   "new_install_prompt_erase": true,
   "builds": [
     {
       "chipFamily": "ESP32-S3",
       "parts": [
-        { "path": "bin/v3.4.0/patternflow.ino.bootloader.bin", "offset": 0 },
-        { "path": "bin/v3.4.0/patternflow.ino.partitions.bin", "offset": 32768 },
-        { "path": "bin/v3.4.0/boot_app0.bin", "offset": 57344 },
-        { "path": "bin/v3.4.0/patternflow.ino.bin", "offset": 65536 }
+        { "path": "bin/v3.4.1/patternflow.ino.bootloader.bin", "offset": 0 },
+        { "path": "bin/v3.4.1/patternflow.ino.partitions.bin", "offset": 32768 },
+        { "path": "bin/v3.4.1/boot_app0.bin", "offset": 57344 },
+        { "path": "bin/v3.4.1/patternflow.ino.bin", "offset": 65536 }
       ]
     }
   ]
diff --git a/web/src/components/community/FirmwareNotice.tsx b/web/src/components/community/FirmwareNotice.tsx
index 26c809d..8f38aaf 100644
--- a/web/src/components/community/FirmwareNotice.tsx
+++ b/web/src/components/community/FirmwareNotice.tsx
@@ -61,9 +61,11 @@ export default function FirmwareNotice() {
   return (
     <div className={styles.fwNotice}>
       <span className={styles.fwNoticeTag}>Firmware</span>
+      {/* Describes the current firmware rather than one release's diff, so a
+          patch bump does not advertise the previous version's changes as new. */}
       <span className={styles.fwNoticeText}>
-        <strong>{LATEST}</strong> is out — patterns install from a link, and a set now ships with
-        the board.
+        <strong>{LATEST}</strong> is out — pattern packs install from a link, a set ships with the
+        board, and MQTT has a broker ready to use.
       </span>
       <Link href="/update" className={styles.fwNoticeLink}>
         Update over Wi-Fi →