diff --git a/.github/README.md b/.github/README.md
index b29def2d2932..5d38f19da904 100644
--- a/.github/README.md
+++ b/.github/README.md
@@ -64,7 +64,7 @@ programs.linuxfiles = {
 };
 ```
 
-This installs a patched helper, a matching polkit action and trusted deployment manifest, and enables the pkexec wrapper. A session authentication agent is required. The flake currently pins alpha6, which supports this opt-in; it will be updated to alpha7 after the release assets and hashes are published. A runtime-capability assertion rejects incompatible or unmarked package overrides. See [Nix packaging details](../docs/linux-port/packaging.md#nix-flake).
+This installs a patched helper, a matching polkit action and trusted deployment manifest, and enables the pkexec wrapper. A session authentication agent is required. The flake pins alpha7, which supports this opt-in. A runtime-capability assertion rejects incompatible or unmarked package overrides. See [Nix packaging details](../docs/linux-port/packaging.md#nix-flake).
 
 ### AppImage
 
diff --git a/docs/linux-port/packaging.md b/docs/linux-port/packaging.md
index ee5ca4e44ef9..b6015ca85660 100644
--- a/docs/linux-port/packaging.md
+++ b/docs/linux-port/packaging.md
@@ -174,7 +174,7 @@ The module selects the package's `enableRootActions` variant, removes its disabl
 
 `pkexec` uses `/run/wrappers/bin` before the system profile and `/usr/bin`/`/bin`. The module enables `security.polkit.enablePkexecWrapper` when present; older nixpkgs uses `security.wrappers.pkexec`. Only pkexec is setuid, never the LinuxFiles helper. A session authentication agent and an administrator identity are still required. The narrow store exception accepts a root-owned sticky `/nix/store` with group write (1775), but rejects other write there, non-root ownership, and any writable entries beneath it. Native `/usr` helper/policy checks retain their existing restrictions.
 
-**Release integration:** the current pin is `0.1.0-alpha6`; like alpha4 and alpha5, it includes deployment-manifest and Nix elevation-wrapper discovery. Its `passthru.supportsNixRootActions` marker is true, so the module accepts `rootActions = true`. Overrides with a false or missing marker are still rejected by the runtime-capability assertion. For future releases, verify that both runtime changes are present before retaining the compatible-runtime marker.
+**Release integration:** the current pin is `0.1.0-alpha7`; like alpha4 to alpha6, it includes deployment-manifest and Nix elevation-wrapper discovery. Its `passthru.supportsNixRootActions` marker is true, so the module accepts `rootActions = true`. Overrides with a false or missing marker are still rejected by the runtime-capability assertion. For future releases, verify that both runtime changes are present before retaining the compatible-runtime marker.
 
 Per release (after CI has attached `SHA256SUMS`; the flake's tag is `linux-v<version>`):
 
diff --git a/flake.nix b/flake.nix
index 0e53ae848dee..b327517d1d99 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,15 +18,15 @@
            , icu, openssl, zlib, krb5, glib, enableRootActions ? false }:
             let
               # version and both hashes are rewritten by scripts/linux/update-nix-flake.sh
-              version = "0.1.0-alpha6";
+              version = "0.1.0-alpha7";
               base = "https://github.com/MemerGamer/LinuxFiles/releases/download/linux-v${version}";
               app = fetchurl {
                 url = "${base}/files-linux-x64.tar.gz";
-                hash = "sha256-Rk1zlwijWc9FVuKNeRLrD0g4acJ2BvhlIXhiB0cxzZU=";
+                hash = "sha256-FNGHD+KmM98mw/ikmIeO44bel4Ts3fsFhZgFmreBXSk=";
               };
               packaging = fetchurl {
                 url = "${base}/files-packaging.tar.gz";
-                hash = "sha256-+pGzr+fdoZANN0u1Xa6ln9divsqII9VEG/fbDM6EQpY=";
+                hash = "sha256-GVfnUOPC2S0hEwAiaiRSpc3npSZSdrqhLpF5I9+GVTs=";
               };
               # Opened with dlopen at runtime, so autoPatchelf cannot discover them; added to every ELF file's runpath.
               runtimeLibs = [