diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 52ffe5a..7b0cc97 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.74.0"
+  ".": "0.75.0"
 }
diff --git a/.stats.yml b/.stats.yml
index 0297d26..f8ffb2d 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ebbe079bb2542625826422afd876a3e8b499c579cf45efc5fd50e7982d34df7d.yml
-openapi_spec_hash: db850b61a0d71fe9f4b642df8782d7ae
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f0486d0b8e34ddf8ba34e36ff97856cf973e0797e021ff621e04e4840970966e.yml
+openapi_spec_hash: 12a71ce5ac80fc65f6a8779f0ca29223
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 689aff5..4976d34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.75.0 (2026-07-08)
+
+Full Changelog: [v0.74.0...v0.75.0](https://github.com/kernel/kernel-node-sdk/compare/v0.74.0...v0.75.0)
+
+### Features
+
+* Accept comma-separated search_user_id in audit-logs endpoints ([3de38df](https://github.com/kernel/kernel-node-sdk/commit/3de38dfc16bdca8ebcdab22eec87b253e3fb49ce))
+* Auto-flush pools when a managed auth profile re-authenticates ([bb7b59e](https://github.com/kernel/kernel-node-sdk/commit/bb7b59ef8b3690bac2c34c50e5865e68a021c890))
+* Document env var redaction on deployment and app reads ([aff324f](https://github.com/kernel/kernel-node-sdk/commit/aff324f5a779b188da8a3ab1f7d18726b35a2853))
+* Expose resolved profile_id and extension_ids on browser pool reads ([9ad5716](https://github.com/kernel/kernel-node-sdk/commit/9ad571674fe95c1acb44f47ffbfdeaa7c81cdb5e))
+* Reject API key self-deletion ([9cac0f1](https://github.com/kernel/kernel-node-sdk/commit/9cac0f1dc231364362b3b1f7f9a0f48259205864))
+* Revert "Store and return a sha256 checksum for uploaded extensions (#… ([4b702a9](https://github.com/kernel/kernel-node-sdk/commit/4b702a92fd902bdf6b259e194a81e3ef0857149f))
+* Store and return a sha256 checksum for uploaded extensions ([44b2c99](https://github.com/kernel/kernel-node-sdk/commit/44b2c99671cef89a61e2f84e734eb8800351bb20))
+* Store and return a sha256 checksum for uploaded extensions (reland) ([5782907](https://github.com/kernel/kernel-node-sdk/commit/5782907899949dd9aafadefd8d3887cb3b7d4d16))
+
+
+### Documentation
+
+* **api:** clarify reuse/discard_all_idle pool config staleness ([83fd84c](https://github.com/kernel/kernel-node-sdk/commit/83fd84c9c88bb7764fe8f7fdfba0523485906a2c))
+
 ## 0.74.0 (2026-07-06)
 
 Full Changelog: [v0.73.0...v0.74.0](https://github.com/kernel/kernel-node-sdk/compare/v0.73.0...v0.74.0)
diff --git a/package.json b/package.json
index 6ee8ffa..d020614 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",
diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts
index 60b41f5..a82e2c3 100644
--- a/src/resources/api-keys.ts
+++ b/src/resources/api-keys.ts
@@ -75,7 +75,8 @@ export class APIKeys extends APIResource {
   }
 
   /**
-   * Delete an API key.
+   * Delete an API key. A key cannot delete itself; use a different key to delete
+   * this one.
    *
    * @example
    * ```ts
diff --git a/src/resources/apps.ts b/src/resources/apps.ts
index 915193d..c6710c9 100644
--- a/src/resources/apps.ts
+++ b/src/resources/apps.ts
@@ -47,7 +47,9 @@ export interface AppListResponse {
   deployment: string;
 
   /**
-   * Environment variables configured for this app version
+   * Environment variables configured for this app version. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars: { [key: string]: string };
 
diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts
index 2cc6a0e..a810bc8 100644
--- a/src/resources/browser-pools.ts
+++ b/src/resources/browser-pools.ts
@@ -48,7 +48,9 @@ export class BrowserPools extends APIResource {
   /**
    * Updates the configuration used to create browsers in the pool. As with creation,
    * save_changes on the pool profile is ignored (not rejected); pooled browsers
-   * never persist changes back to the profile.
+   * never persist changes back to the profile. To clear the profile reference, send
+   * `profile: { "id": "" }`. Clearing the profile also disables
+   * `refresh_on_profile_update`.
    *
    * @example
    * ```ts
@@ -186,10 +188,26 @@ export interface BrowserPool {
    */
   created_at: string;
 
+  /**
+   * Resolved extension IDs attached to the pool, in configured load order. Empty
+   * when no extensions are attached. Authoritative for programmatic consumers; the
+   * extensions inside `browser_pool_config` reflect the configured selector (echoed
+   * as sent on create).
+   */
+  extension_ids: Array<string>;
+
   /**
    * Browser pool name, if set
    */
   name?: string;
+
+  /**
+   * Resolved profile ID the pool is attached to. Omitted when no profile is
+   * attached. Authoritative for programmatic consumers; the profile inside
+   * `browser_pool_config` reflects the configured selector (echoed as sent on
+   * create).
+   */
+  profile_id?: string;
 }
 
 export namespace BrowserPool {
@@ -241,12 +259,11 @@ export namespace BrowserPool {
     name?: string;
 
     /**
-     * Profile selection for browsers in a pool. Provide either id or name. The
-     * matching profile is loaded into every browser in the pool. Profiles must be
-     * created beforehand. Unlike single browser sessions, pools load the profile
-     * read-only and never persist changes back to it, so save_changes is omitted here.
-     * Any save_changes value sent on a pool profile is silently ignored rather than
-     * rejected, so callers reusing a single-session profile object will not error.
+     * Profile configuration for browsers in a pool. Provide either id or name.
+     * Profiles must be created beforehand. Unlike single browser sessions, pools load
+     * the profile read-only and never persist changes back to it, so save_changes is
+     * omitted here. Any save_changes value sent on a pool profile is silently ignored
+     * rather than rejected.
      */
     profile?: BrowserPoolConfig.Profile;
 
@@ -256,6 +273,13 @@ export namespace BrowserPool {
      */
     proxy_id?: string;
 
+    /**
+     * When true, flush idle browsers when the profile the pool uses is updated, so
+     * pool browsers pick up the latest profile data. Requires a profile to be set on
+     * the pool.
+     */
+    refresh_on_profile_update?: boolean;
+
     /**
      * Optional URL to navigate to when a new browser is warmed into the pool.
      * Best-effort: failures to navigate do not fail pool fill. Only applied to
@@ -296,12 +320,11 @@ export namespace BrowserPool {
 
   export namespace BrowserPoolConfig {
     /**
-     * Profile selection for browsers in a pool. Provide either id or name. The
-     * matching profile is loaded into every browser in the pool. Profiles must be
-     * created beforehand. Unlike single browser sessions, pools load the profile
-     * read-only and never persist changes back to it, so save_changes is omitted here.
-     * Any save_changes value sent on a pool profile is silently ignored rather than
-     * rejected, so callers reusing a single-session profile object will not error.
+     * Profile configuration for browsers in a pool. Provide either id or name.
+     * Profiles must be created beforehand. Unlike single browser sessions, pools load
+     * the profile read-only and never persist changes back to it, so save_changes is
+     * omitted here. Any save_changes value sent on a pool profile is silently ignored
+     * rather than rejected.
      */
     export interface Profile {
       /**
@@ -495,12 +518,11 @@ export interface BrowserPoolCreateParams {
   name?: string;
 
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   profile?: BrowserPoolCreateParams.Profile;
 
@@ -510,6 +532,13 @@ export interface BrowserPoolCreateParams {
    */
   proxy_id?: string;
 
+  /**
+   * When true, flush idle browsers when the profile the pool uses is updated, so
+   * pool browsers pick up the latest profile data. Requires a profile to be set on
+   * the pool.
+   */
+  refresh_on_profile_update?: boolean;
+
   /**
    * Optional URL to navigate to when a new browser is warmed into the pool.
    * Best-effort: failures to navigate do not fail pool fill. Only applied to
@@ -550,12 +579,11 @@ export interface BrowserPoolCreateParams {
 
 export namespace BrowserPoolCreateParams {
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   export interface Profile {
     /**
@@ -581,8 +609,12 @@ export interface BrowserPoolUpdateParams {
   chrome_policy?: { [key: string]: unknown };
 
   /**
-   * Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-   * to false.
+   * Whether to discard all idle browsers and rebuild them immediately with the new
+   * configuration. Defaults to false. Only browsers that are idle when the update
+   * runs are rebuilt. A browser that is in use during the update keeps its original
+   * configuration, and if it is later released with `reuse: true` it returns to the
+   * pool with that stale configuration until it is discarded (by this flag on a
+   * later update, or by flushing the pool).
    */
   discard_all_idle?: boolean;
 
@@ -615,12 +647,11 @@ export interface BrowserPoolUpdateParams {
   name?: string;
 
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   profile?: BrowserPoolUpdateParams.Profile;
 
@@ -630,6 +661,13 @@ export interface BrowserPoolUpdateParams {
    */
   proxy_id?: string;
 
+  /**
+   * When true, flush idle browsers when the profile the pool uses is updated, so
+   * pool browsers pick up the latest profile data. Requires a profile to be set on
+   * the pool.
+   */
+  refresh_on_profile_update?: boolean;
+
   /**
    * Number of browsers to maintain in the pool. The maximum size is determined by
    * your organization's pooled sessions limit (the sum of all pool sizes cannot
@@ -677,12 +715,11 @@ export interface BrowserPoolUpdateParams {
 
 export namespace BrowserPoolUpdateParams {
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   export interface Profile {
     /**
@@ -752,7 +789,10 @@ export interface BrowserPoolReleaseParams {
 
   /**
    * Whether to reuse the browser instance or destroy it and create a new one.
-   * Defaults to true.
+   * Defaults to true. A reused browser keeps the configuration it was created with,
+   * so it does not pick up pool configuration changes made while it was in use.
+   * Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+   * current configuration.
    */
   reuse?: boolean;
 }
diff --git a/src/resources/deployments.ts b/src/resources/deployments.ts
index a389f8b..597dad2 100644
--- a/src/resources/deployments.ts
+++ b/src/resources/deployments.ts
@@ -159,7 +159,9 @@ export namespace DeploymentStateEvent {
     entrypoint_rel_path?: string;
 
     /**
-     * Environment variables configured for this deployment
+     * Environment variables configured for this deployment. Values are redacted for
+     * API key, OAuth, and managed-auth callers, which receive every key with an empty
+     * string value. Only dashboard sessions receive the actual values.
      */
     env_vars?: { [key: string]: string };
 
@@ -205,7 +207,9 @@ export interface DeploymentCreateResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -250,7 +254,9 @@ export interface DeploymentRetrieveResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -295,7 +301,9 @@ export interface DeploymentListResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -361,7 +369,8 @@ export namespace DeploymentFollowResponse {
     version: string;
 
     /**
-     * Environment variables configured for this app version
+     * Environment variables configured for this app version. Not currently populated
+     * on streamed app_version_summary events.
      */
     env_vars?: { [key: string]: string };
   }
diff --git a/src/resources/extensions.ts b/src/resources/extensions.ts
index 79e98e1..809c2a3 100644
--- a/src/resources/extensions.ts
+++ b/src/resources/extensions.ts
@@ -147,6 +147,15 @@ export interface ExtensionListResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
@@ -178,6 +187,15 @@ export interface ExtensionGetResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
@@ -209,6 +227,15 @@ export interface ExtensionUploadResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
diff --git a/src/version.ts b/src/version.ts
index c88d4bf..766f1ae 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '0.74.0'; // x-release-please-version
+export const VERSION = '0.75.0'; // x-release-please-version
diff --git a/tests/api-resources/browser-pools.test.ts b/tests/api-resources/browser-pools.test.ts
index 37fda3c..bb7370a 100644
--- a/tests/api-resources/browser-pools.test.ts
+++ b/tests/api-resources/browser-pools.test.ts
@@ -32,6 +32,7 @@ describe('resource browserPools', () => {
       name: 'my-pool',
       profile: { id: 'id', name: 'name' },
       proxy_id: 'proxy_id',
+      refresh_on_profile_update: true,
       start_url: 'https://example.com',
       stealth: true,
       timeout_seconds: 10,
diff --git a/yarn.lock b/yarn.lock
index c67c476..3540e21 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1222,9 +1222,9 @@ baseline-browser-mapping@^2.9.0:
   integrity sha512-B0xUquLkiGLgHhpPBqvl7GWegWBUNuujQ6kXd/r1U38ElPT6Ok8KZ8e+FpUGEc2ZoRQUzq/aUnaKFc/svWUGSg==
 
 brace-expansion@^2.0.2:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.1.tgz#c68b1c4111c76aae3a6fba55d496cee10c39dad8"
-  integrity sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.2.tgz#0bba2271feb7d458b0d31ad13625aaa4754431e2"
+  integrity sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==
   dependencies:
     balanced-match "^1.0.0"