diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 8c80bb2..381aa1e 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -32,6 +32,14 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest
+          # metadata-action can't detect an SPDX license from the GitHub API
+          # and defaults org.opencontainers.image.licenses to NOASSERTION,
+          # which silently overrides the correct value the Dockerfile's own
+          # LABEL sets (matching keys passed to build-push-action win over
+          # the Dockerfile). Override it explicitly so the published image
+          # actually carries "MPL-2.0" (see issue #62 item 1).
+          labels: |
+            org.opencontainers.image.licenses=MPL-2.0
 
       - name: Read spec version from version.h
         id: version
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ae1234d..810ab22 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,23 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## v0.5.44 — 2026-07-27
+
+### Fixed
+- **The v0.5.43 Docker license-label fix didn't actually reach the published
+  image.** `docker/metadata-action` auto-generates a set of OCI labels
+  (including `org.opencontainers.image.licenses`, defaulted to
+  `NOASSERTION` because it can't detect an SPDX license from the GitHub
+  API) and `docker-publish.yml` passed that full label set to
+  `build-push-action`, which overrides same-key `LABEL`s declared in the
+  Dockerfile. So the real `ghcr.io/soundmatt/c-fusa:0.5.43` image still
+  shipped `licenses=NOASSERTION`, silently undoing the Dockerfile fix from
+  v0.5.43 (#62 item 1). Fixed by passing `org.opencontainers.image.licenses:
+  MPL-2.0` as a custom label to `docker/metadata-action` itself, which
+  overrides its own auto-generated value before it ever reaches
+  `build-push-action`. Caught by manually inspecting the published v0.5.43
+  image's labels via the Docker Publish workflow logs after tagging.
+
 ## v0.5.43 — 2026-07-27
 
 Fixes from a 2026-07-27 cross-repo audit (issues #62, #63).
diff --git a/include/cfusa/version.h b/include/cfusa/version.h
index cc459f5..0285eef 100644
--- a/include/cfusa/version.h
+++ b/include/cfusa/version.h
@@ -3,8 +3,8 @@
 
 #define CFUSA_VERSION_MAJOR  0
 #define CFUSA_VERSION_MINOR  5
-#define CFUSA_VERSION_PATCH  43
-#define CFUSA_VERSION_STRING "0.5.43"
+#define CFUSA_VERSION_PATCH  44
+#define CFUSA_VERSION_STRING "0.5.44"
 #define CFUSA_SCHEMA_VERSION "1.11.0"
 /* Bumped from 1.10.12 to match the x-FuSa master spec's additive §1.4.1
  * "requirement annotation completeness" MINOR bump (issue #62 item 3). The