diff --git a/.env.example b/.env.example
index 3643204..f5b04dc 100644
--- a/.env.example
+++ b/.env.example
@@ -1,4 +1,6 @@
 ALLOWED_ORIGINS=http://localhost:8082,http://127.0.0.1:8082,http://localhost:5173,http://127.0.0.1:5173
+AUTH_SESSION_TTL_DAYS=30
+AUTH_ALLOW_INSECURE_COOKIES=false
 HOST_PORT_WEB=8082
 HOST_BIND_SERVER=127.0.0.1
 HOST_PORT_SERVER=8080
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 91b4003..cd0e4e1 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,16 +1,97 @@
-# TypeType 1.3.1
+# TypeType 1.4.0
 
-## Summary
+TypeType 1.4.0 adds richer search filters, consistent content blocking,
+server-delivered YouTube subtitles, configurable account sessions, and several
+playback, import and self-hosting fixes.
 
-- fix videos and Shorts stopping after about one minute when YouTube rejects the active SABR context [#184](https://github.com/TypeType-Video/TypeType/issues/184)
-- refresh rejected YouTube token material before creating a replacement playback session
-- release replaced SABR sessions and prevent stale background work from accumulating
-- bound SABR metadata and media caches during long playback sessions
+## Search And Content Controls
 
-Playback now recovers in place with fresh authorization instead of repeatedly creating sessions that cannot produce media.
+- Add grouped YouTube search filters for upload date, content type, duration
+  and sorting. [#187](https://github.com/TypeType-Video/TypeType/issues/187)
+- Hide blocked channels and videos consistently across search, autoplay, watch
+  pages, embeds, playlists, history, subscriptions and recommendations.
+  [#193](https://github.com/TypeType-Video/TypeType/issues/193)
+- Normalize channel and video identities so alternate YouTube URL formats
+  cannot bypass blocked-content rules.
 
-No configuration or database migration is required.
+## Subtitles And Playback
 
-Thx to @LuckeeSoft for the precise report, and to everyone who tested playback on beta.
+- Load YouTube subtitles through TypeType-Server instead of requiring the web
+  client to contact YouTube directly.
+- Cache subtitle content and preserve manual, automatic and translated subtitle
+  tracks.
+- Return typed rate-limit errors when YouTube rejects subtitle retrieval.
+- Preload adaptive SABR initialization ranges to prevent startup failures when
+  an initialization segment is not returned immediately.
+  [#204](https://github.com/TypeType-Video/TypeType/issues/204)
+- Restore saved playback positions only after the SABR session has completed
+  its initial bootstrap.
+- Route chapter selection through SABR so selecting a chapter seeks correctly
+  again. [#202](https://github.com/TypeType-Video/TypeType/issues/202)
+- Center captions correctly in the web player.
+  [#201](https://github.com/TypeType-Video/TypeType/issues/201)
+- Update PipePipeExtractor and align TypeType with the current YouTube client
+  profiles.
 
-If u want to support TypeType, please share it with others. If u want to support it financially, u can do so through [GitHub Sponsors](https://github.com/sponsors/Priveetee).
+## Accounts And Administration
+
+- Add `AUTH_SESSION_TTL_DAYS` to configure account session lifetime from 1 to
+  365 days, with a default of 30 days.
+  [#203](https://github.com/TypeType-Video/TypeType/issues/203)
+- Preserve active browser sessions during temporary refresh failures instead
+  of immediately redirecting to login.
+- Keep generated password reset tokens visible and copyable when browser
+  clipboard access is unavailable.
+  [#198](https://github.com/TypeType-Video/TypeType/issues/198)
+- Keep admin user avatars stable when an account identity is edited.
+  [#199](https://github.com/TypeType-Video/TypeType/issues/199)
+
+## Imports And Performance
+
+- Skip deleted and unavailable videos when importing YouTube Takeout playlists.
+  [#135](https://github.com/TypeType-Video/TypeType/issues/135)
+- Bound concurrent SABR download parts to reduce memory and connection pressure
+  during large downloads.
+- Keep Server and Token YouTube traffic on the configured proxy instead of
+  silently switching to a different egress.
+
+## Self-Hosting
+
+- Fix the installation script attempting to download the removed
+  `youtube-egress-relay.mjs` file.
+  [#197](https://github.com/TypeType-Video/TypeType/issues/197)
+- Add account session lifetime configuration to the Compose stack and
+  environment template.
+- Validate the new session configuration during stack checks.
+
+No database migration is required. `AUTH_SESSION_TTL_DAYS` is optional and
+defaults to `30`.
+
+When a YouTube proxy is configured, it must remain reachable because Server and
+Token will no longer silently bypass it.
+
+## Thx
+
+- A big thx to @LuckeeSoft for proposing the new search filters.
+- Thx to @Toni-Vide for the detailed reports about blocked content, password
+  reset tokens and admin avatars.
+- Thx to @Slashic for reporting the session, chapter selection and caption
+  alignment problems.
+- Thx to @Role92 for the precise SABR initialization logs.
+- Thx to @Willie169 for catching the broken self-hosted installation path.
+- Thx to @lelam183 for repeatedly testing YouTube Takeout imports and helping
+  identify the remaining unavailable-video case.
+- Thx as well to everyone testing subtitles and playback on beta, sharing logs,
+  and helping improve the self-hosting setup.
+
+## Updating
+
+Follow the
+[update guide](https://typetype-video.github.io/Docs-TypeType/self-hosting/maintenance).
+
+If necessary, follow the
+[rollback guide](https://typetype-video.github.io/Docs-TypeType/self-hosting/rollback).
+
+If u want to support TypeType, please share it with others. If u want to
+support it financially, u can do so through
+[GitHub Sponsors](https://github.com/sponsors/Priveetee).
diff --git a/TypeType-Downloader b/TypeType-Downloader
index 29da698..3a4346b 160000
--- a/TypeType-Downloader
+++ b/TypeType-Downloader
@@ -1 +1 @@
-Subproject commit 29da6984c60274eec510aa422dfd748455e4e012
+Subproject commit 3a4346b394ed773c222b29b3b101dfff7842d33d
diff --git a/TypeType-Frontend b/TypeType-Frontend
index 60c14c3..ab250df 160000
--- a/TypeType-Frontend
+++ b/TypeType-Frontend
@@ -1 +1 @@
-Subproject commit 60c14c3c6bbb6914c44cce2649b70544087c523c
+Subproject commit ab250dff91b809ac5b8472ccfb7dea907c081530
diff --git a/TypeType-Server b/TypeType-Server
index a8eeae7..4bff946 160000
--- a/TypeType-Server
+++ b/TypeType-Server
@@ -1 +1 @@
-Subproject commit a8eeae789194b5bf4f6a5e8653024680871a5576
+Subproject commit 4bff946afef068cfc870c26aa51c178b1287bd94
diff --git a/TypeType-Token b/TypeType-Token
index 0f0f217..8cb517a 160000
--- a/TypeType-Token
+++ b/TypeType-Token
@@ -1 +1 @@
-Subproject commit 0f0f217da9d78ec5bb7e4458a3699b914dd8abd8
+Subproject commit 8cb517ac915570facf1e638a1ac0e8602908f11c
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index f9c26c6..25f78e5 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -19,6 +19,8 @@ services:
       - "${HOST_BIND_SERVER_BETA:-127.0.0.1}:${HOST_PORT_SERVER_BETA:-18080}:8080"
     env_file: .env
     environment:
+      AUTH_SESSION_TTL_DAYS: ${AUTH_SESSION_TTL_DAYS:-30}
+      AUTH_ALLOW_INSECURE_COOKIES: ${AUTH_ALLOW_INSECURE_COOKIES:-false}
       DATABASE_URL: ${DATABASE_URL:-jdbc:postgresql://postgres:5432/${POSTGRES_DB:-typetype}}
       DATABASE_USER: ${DATABASE_USER:-${POSTGRES_USER:-typetype}}
       DATABASE_PASSWORD: ${DATABASE_PASSWORD:-${POSTGRES_PASSWORD:-typetype}}
diff --git a/docker-compose.yml b/docker-compose.yml
index 07e1e70..1fe6da2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,8 @@ services:
       - "${HOST_BIND_SERVER:-127.0.0.1}:${HOST_PORT_SERVER:-8080}:8080"
     environment:
       ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost:8082,http://127.0.0.1:8082,http://localhost:5173,http://127.0.0.1:5173}
+      AUTH_SESSION_TTL_DAYS: ${AUTH_SESSION_TTL_DAYS:-30}
+      AUTH_ALLOW_INSECURE_COOKIES: ${AUTH_ALLOW_INSECURE_COOKIES:-false}
       DATABASE_URL: ${DATABASE_URL:-jdbc:postgresql://postgres:5432/${POSTGRES_DB:-typetype}}
       DATABASE_USER: ${DATABASE_USER:-${POSTGRES_USER:-typetype}}
       DATABASE_PASSWORD: ${DATABASE_PASSWORD:-${POSTGRES_PASSWORD:-typetype}}
diff --git a/scripts/install-stack.sh b/scripts/install-stack.sh
index 9e452bf..3fa24e7 100755
--- a/scripts/install-stack.sh
+++ b/scripts/install-stack.sh
@@ -513,7 +513,6 @@ fetch_file "scripts/bootstrap-env.sh" "${INSTALL_DIR}/scripts/bootstrap-env.sh"
 fetch_file "scripts/bootstrap-garage.sh" "${INSTALL_DIR}/scripts/bootstrap-garage.sh"
 fetch_file "scripts/setup-stack.sh" "${INSTALL_DIR}/scripts/setup-stack.sh"
 fetch_file "scripts/validate-stack.sh" "${INSTALL_DIR}/scripts/validate-stack.sh"
-fetch_file "scripts/youtube-egress-relay.mjs" "${INSTALL_DIR}/scripts/youtube-egress-relay.mjs"
 
 chmod +x "${INSTALL_DIR}/scripts/install-stack.sh"
 chmod +x "${INSTALL_DIR}/scripts/bootstrap-env.sh"
diff --git a/scripts/install-stack.test.sh b/scripts/install-stack.test.sh
new file mode 100755
index 0000000..9ce23fe
--- /dev/null
+++ b/scripts/install-stack.test.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repository="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+temporary="$(mktemp -d)"
+trap 'rm -rf "$temporary"' EXIT
+
+fake_bin="${temporary}/bin"
+install_dir="${temporary}/stack"
+docker_log="${temporary}/docker.log"
+mkdir -p "$fake_bin"
+
+cat > "${fake_bin}/docker" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%q ' "$@" >> "$FAKE_DOCKER_LOG"
+printf '\n' >> "$FAKE_DOCKER_LOG"
+EOF
+chmod +x "${fake_bin}/docker"
+
+PATH="${fake_bin}:${PATH}" \
+FAKE_DOCKER_LOG="$docker_log" \
+  bash "${repository}/scripts/install-stack.sh" \
+    --source-dir "$repository" \
+    --dir "$install_dir" \
+    --download-only \
+    --yes > "${temporary}/install.log"
+
+for file in \
+  docker-compose.yml \
+  docker-compose.arm64.yml \
+  .env.example \
+  .env \
+  scripts/install-stack.sh \
+  scripts/bootstrap-env.sh \
+  scripts/bootstrap-garage.sh \
+  scripts/setup-stack.sh \
+  scripts/validate-stack.sh; do
+  test -s "${install_dir}/${file}"
+done
+
+grep -q '^compose version ' "$docker_log"
+grep -q 'compose .*config -q ' "$docker_log"
+grep -q '\[install\] Download-only complete\.' "${temporary}/install.log"
diff --git a/scripts/validate-stack.sh b/scripts/validate-stack.sh
index 427b1a2..58ca3db 100755
--- a/scripts/validate-stack.sh
+++ b/scripts/validate-stack.sh
@@ -19,6 +19,7 @@ trap cleanup EXIT
 for script in scripts/*.sh; do
   bash -n "$script"
 done
+./scripts/install-stack.test.sh
 ./scripts/deploy-beta.test.sh
 
 docker compose --env-file .env.example -f docker-compose.yml config -q
@@ -53,3 +54,13 @@ if [[ $(grep -c 'YOUTUBE_OUTBOUND_PROXY_URL: http://127.0.0.1:29083' <<<"$dev_co
   echo "beta Server and Token must share the configured outbound proxy" >&2
   exit 1
 fi
+for config in "$stable_config" "$dev_config"; do
+  if ! grep -q 'AUTH_SESSION_TTL_DAYS: "30"' <<<"$config"; then
+    echo "Server must receive the default account session lifetime" >&2
+    exit 1
+  fi
+  if ! grep -q 'AUTH_ALLOW_INSECURE_COOKIES: "false"' <<<"$config"; then
+    echo "Server must keep insecure refresh cookies disabled by default" >&2
+    exit 1
+  fi
+done