diff --git a/arch/lmcp/PKGBUILD b/arch/lmcp/PKGBUILD
index a223f4a13..d17cced30 100644
--- a/arch/lmcp/PKGBUILD
+++ b/arch/lmcp/PKGBUILD
@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/lmcp
 
 pkgname=lmcp
-pkgver=1.2.1
+pkgver=1.2.2
 pkgrel=1
 pkgdesc="Lightweight MCP (Model Context Protocol) server in pure Lua"
 arch=('any')
@@ -14,7 +14,7 @@ depends=('lua' 'lua-socket')
 # pre-release pkgvers (e.g. 1.2.0_rc1 → v1.2.0-rc1).
 _tag="v${pkgver//_/-}"
 source=("${pkgname}-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/lmcp/archive/${_tag}.tar.gz")
-sha256sums=('bf9cce1a84c66b1b74c5aec923c5960d60ae33c221afc8d47ce0d74b8f7ee609')
+sha256sums=('e8f536eae92cf88bed5f479c59ba4fefeb29a4249ff3622a1d8d28ee99b8df3b')
 
 package() {
     cd "${pkgname}"
diff --git a/debian/lmcp/build-deb.sh b/debian/lmcp/build-deb.sh
index cad0d3b87..bf214023d 100755
--- a/debian/lmcp/build-deb.sh
+++ b/debian/lmcp/build-deb.sh
@@ -7,10 +7,10 @@
 # package (Architecture: all, depends on lua + lua-socket).
 set -euo pipefail
 
-PKGVER=1.2.1
-UPSTREAM_TAG=v1.2.1
+PKGVER=1.2.2
+UPSTREAM_TAG=v1.2.2
 PKGREL=1
-LMCP_TARBALL_SHA256=bf9cce1a84c66b1b74c5aec923c5960d60ae33c221afc8d47ce0d74b8f7ee609
+LMCP_TARBALL_SHA256=e8f536eae92cf88bed5f479c59ba4fefeb29a4249ff3622a1d8d28ee99b8df3b
 HERE=$(dirname "$(readlink -f "$0")")
 
 # Reproducible build: pin all file mtimes + ar member timestamps to a fixed
diff --git a/debian/lmcp/debian/changelog b/debian/lmcp/debian/changelog
index 7504766c6..a07f33c0d 100644
--- a/debian/lmcp/debian/changelog
+++ b/debian/lmcp/debian/changelog
@@ -1,3 +1,10 @@
+lmcp (1.2.2-1) bookworm trixie; urgency=medium
+
+  * case-insensitive Bearer auth header (lmcp#25): regex ^Bearer → ^[Bb]earer
+    so clients sending lowercase 'bearer' don't get spurious 401s.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Sat, 30 May 2026 14:52:16 +0000
+
 lmcp (1.2.1-1) bookworm trixie; urgency=medium
 
   * tools.d/ plugin scan (closes lmcp#22): server.lua now scans