diff --git a/changelog/best-practice/claude-settings/changelog.md b/changelog/best-practice/claude-settings/changelog.md
index 9ced18d..e6ed83a 100644
--- a/changelog/best-practice/claude-settings/changelog.md
+++ b/changelog/best-practice/claude-settings/changelog.md
@@ -442,4 +442,24 @@
 | 10 | LOW | New Env Var (Changelog) | Consider adding `OTEL_LOG_RAW_API_BODIES` to env vars table — emit full API request/response bodies as OpenTelemetry log events. v2.1.111 changelog only, not yet on official /en/env-vars page | ✅ COMPLETE (added after `OTEL_LOG_TOOL_DETAILS` with changelog-only annotation) |
 | 11 | LOW | Suspect Key Recurrence | `OTEL_LOG_TOOL_DETAILS` still "in v2.1.85 changelog, not yet on official env-vars page" after 12+ consecutive runs. Per Rule 10B, deferred pending official docs update | ✋ ON HOLD (kept — recurring from 2026-04-14 v2.1.107) |
 | 12 | LOW | Suspect Key Recurrence | `OTEL_LOG_USER_PROMPTS`, `OTEL_LOG_TOOL_CONTENT` still changelog-only. Defer per Rule 8A | ✋ ON HOLD (kept — recurring from 2026-04-16 v2.1.110) |
-| 13 | INVALID | Spurious Drift Claim | `workflow-claude-settings-agent` reported `sandbox.allowUnsandboxedCommands` default was wrong (claimed docs say `false`). Verified against official settings page — documented default is **`true`**. Report is correct as-is | ❌ INVALID (agent report contradicted by official docs on re-verification) |
\ No newline at end of file
+| 13 | INVALID | Spurious Drift Claim | `workflow-claude-settings-agent` reported `sandbox.allowUnsandboxedCommands` default was wrong (claimed docs say `false`). Verified against official settings page — documented default is **`true`**. Report is correct as-is | ❌ INVALID (agent report contradicted by official docs on re-verification) |
+---
+
+## [2026-04-26 01:10 PM PKT] Claude Code v2.1.119
+
+| # | Priority | Type | Action | Status |
+|---|----------|------|--------|--------|
+| 1 | HIGH | Version Bump | Update report version badge from v2.1.118 to v2.1.119 and header "As of v2.1.118" → "As of v2.1.119" | ✅ COMPLETE (badge, header version, and header text updated in Phase 2.6) |
+| 2 | HIGH | New Setting | Add `prUrlTemplate` to Attribution Settings table — string, URL template that controls how the PR badge in commit attribution links to the pull request UI. Useful for self-hosted GitLab/Bitbucket/GitHub Enterprise instances. Confirmed in v2.1.119 changelog | ✅ COMPLETE (added between `attribution.pr` and `includeCoAuthoredBy` in Attribution Settings table with v2.1.119 attribution and self-hosted use case) |
+| 3 | HIGH | Missing Env Var | Add `CLAUDE_CODE_HIDE_CWD` to Common Environment Variables table — set to `1` to hide the current working directory in the startup logo banner. Useful in screen recordings or shared sessions where the CWD path is sensitive. Confirmed in v2.1.119 changelog | ✅ COMPLETE (added after `CLAUDE_CODE_DISABLE_MOUSE` in env vars table grouped with other UI/display vars) |
+| 4 | HIGH | Changed Behavior | Update `auto` permission mode description (line 247) — remove outdated `--enable-auto-mode` flag reference (flag was REMOVED in v2.1.111). Per official permissions docs, current description is: "Auto-approves tool calls with background safety checks that verify actions align with your request. Currently a research preview." Auto mode is now in the default `Shift+Tab` cycle | ✅ COMPLETE (description rewritten using official wording; `--enable-auto-mode` flag reference removed; noted Shift+Tab cycle inclusion since v2.1.111 and `--permission-mode auto` as the current entry point) |
+| 5 | MED | Changed Behavior | Update `blockedMarketplaces` description in Plugin Settings — note v2.1.119 enforcement of `hostPattern` and `pathPattern` matching. Blocked sources now correctly reject before downloading touches the filesystem | ✅ COMPLETE (description expanded with hostPattern/pathPattern matchers and v2.1.119 pre-download enforcement detail) |
+| 6 | MED | Voice Setting Expansion | Expand `voiceEnabled` (boolean, line 81) into the full `voice` object documented per v2.1.118 — supports `enabled` (boolean), `mode` (`"hold"` or `"tap"`), and `autoSubmit` (boolean). Keep `voiceEnabled` as legacy alias with DEPRECATED marker | ✅ COMPLETE (added new `voice` object row with all 3 fields; `voiceEnabled` row updated to DEPRECATED legacy alias pointing to `voice` object) |
+| 7 | MED | New Subcommand | Add `claude plugin tag` to Useful Commands table — added in v2.1.118 for tagging plugin versions in marketplaces | ✅ COMPLETE (added after `/plugin` in Useful Commands table with v2.1.118 attribution and run-from-marketplace-repo usage note) |
+| 8 | LOW | Sources URL Drift | `https://json.schemastore.org/claude-code-settings.json` now 301-redirects to `https://www.schemastore.org/claude-code-settings.json`. v2.1.74 #4 explicitly fixed it the other direction. Source still resolves via redirect — decide whether to flip or leave with redirect | ❌ INVALID (URL still resolves correctly via 301 redirect; flipping would oscillate against v2.1.74 #4 fix without functional benefit. Re-evaluate only if schemastore deprecates the redirect) |
+| 9 | LOW | MCP OAuth Note | Add brief MCP OAuth RFC 9728 mention to MCP Servers section — added in v2.1.111. Informational, not a settings key | ✅ COMPLETE (added blockquote callout above MCP Settings table with RFC 9728 link, `/.well-known/oauth-protected-resource` discovery endpoint, and note that compliant servers no longer need `apiKeyHelper`/`headersHelper`) |
+| 10 | LOW | Quick Reference Update | Add `prUrlTemplate` to Quick Reference example after attribution block, once the new key is added | ✅ COMPLETE (added `"prUrlTemplate": "https://gitlab.example.com/{owner}/{repo}/-/merge_requests/{number}"` after the `attribution` block in the example) |
+| 11 | LOW | Suspect Key Recurrence | `OTEL_LOG_TOOL_DETAILS` still "in v2.1.85 changelog, not yet on official env-vars page" after 13+ consecutive runs. Per Rule 10B, deferred pending official docs update | ✋ ON HOLD (kept — recurring from 2026-04-14 v2.1.107) |
+| 12 | LOW | Suspect Key Recurrence | `OTEL_LOG_USER_PROMPTS`, `OTEL_LOG_TOOL_CONTENT` still changelog-only. Defer per Rule 8A | ✋ ON HOLD (kept — recurring from 2026-04-16 v2.1.110) |
+| 13 | INVALID | Spurious Drift Claim | `claude-code-guide` agent reported `attribution.pr` as a NEW v2.1.119 setting. Verified against current report (line 149) — already documented in Attribution Settings table | ❌ INVALID (already in report) |
+| 14 | INVALID | Spurious Drift Claim | `claude-code-guide` agent claimed `sandbox.network.deniedDomains` was added v2.1.116. Workflow agent and report (line 386) both confirm v2.1.113 introduction (matches recent v2.1.114 changelog entry that resolved its prior unverified status). Report value retained | ❌ INVALID (agent contradicted by report-specific agent + prior changelog) |