diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd37874..2020915 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v2.7.5
+
+### Fixed
+
+- Fixed composed Vix SDK generation for multi-profile installs such as `web + data`.
+  - SDK profiles now only create aliases for modules actually exported by that profile.
+  - `vix::validation` is now resolved from the official `web` provider instead of being shadowed by `data`.
+  - Composed targets now preserve the exact exported properties of their provider SDK target.
+  - Fixed target-property extraction so properties from unrelated targets, such as `vix::db`, cannot leak into `vix::websocket`.
+
+- Fixed `vix install` for old lockfiles using obsolete integrity metadata.
+  - `vix install` can now safely migrate old package hashes to canonical `vix-package-sha256` v2 metadata.
+  - The migration updates only `hash`, `hash_algorithm`, and `hash_version`.
+  - Registry synchronization is now performed internally when required, without asking users to run `vix registry sync`.
+  - Users no longer need to run `vix registry sync`, `vix update`, then `vix install` for this migration case.
+
+### Safety
+
+- Automatic integrity migration is only allowed when the locked package id, version, tag, commit, registry metadata, and local checkout all match.
+- `vix install` still fails without rewriting the lockfile when the checkout is dirty, the registry commit differs, the checkout is incomplete, or a modern v2 hash is
+  incorrect.
+
+### Validation
+
+- Added regression tests for composed SDK aliases, target property isolation, registry-backed hash migration, automatic registry sync, lockfile idempotence, dirty checkout
+  failures, registry commit mismatch failures, and bad v2 hash failures.
+- Validated Softadastra Cloud with only `vix install`, followed by `vix build --preset release`, producing `bin/cloud`.
+
 # Vix.cpp v2.7.4
 
 Vix.cpp v2.7.4 is an SDK composition and reliability release. It makes specialized SDK profiles composable, fixes projects that use modules from both the `web` and `data` profiles, and improves the build-time diagnostic when a known Vix module is requested but its SDK profile is not installed.
@@ -130,7 +158,6 @@ Added SDK composition coverage for:
 
 Updated CLI documentation for SDK profile composition, multiple installed SDK profiles, automatic module/profile selection, version compatibility, missing-module diagnostics, and when to use the heavier `all` profile.
 
-
 # Vix.cpp v2.7.3
 
 Vix.cpp v2.7.3 is a CLI workflow, WebSocket, backend-template, package-management, and Softadastra Cloud integration release. It fixes the generated WebSocket module workflow, makes WebSocket module names customizable, adds an API-only backend scaffold for separately hosted frontends, introduces the first Vix CLI workflow for connecting local Vix projects to Softadastra Cloud, and significantly improves global package installs, Git dependencies, single-file runs, and public registry publishing.
diff --git a/cmake/VixConfig.cmake.in b/cmake/VixConfig.cmake.in
index 009a004..03a5e0e 100644
--- a/cmake/VixConfig.cmake.in
+++ b/cmake/VixConfig.cmake.in
@@ -217,19 +217,19 @@ if (TARGET vix_thirdparty_asio AND NOT TARGET vix::thirdparty_asio)
   add_library(vix::thirdparty_asio ALIAS vix_thirdparty_asio)
 endif()
 
-if (TARGET vix::vix_time AND NOT TARGET vix::time)
+if (@VIX_HAS_TIME@ AND TARGET vix::vix_time AND NOT TARGET vix::time)
   add_library(vix::time ALIAS vix::vix_time)
 endif()
 
-if (TARGET vix::vix_conversion AND NOT TARGET vix::conversion)
+if (@VIX_HAS_CONVERSION@ AND TARGET vix::vix_conversion AND NOT TARGET vix::conversion)
   add_library(vix::conversion ALIAS vix::vix_conversion)
 endif()
 
-if (TARGET vix::vix_validation AND NOT TARGET vix::validation)
+if (@VIX_HAS_VALIDATION@ AND TARGET vix::vix_validation AND NOT TARGET vix::validation)
   add_library(vix::validation ALIAS vix::vix_validation)
 endif()
 
-if (TARGET vix::vix_webrpc AND NOT TARGET vix::webrpc)
+if (@VIX_HAS_WEBRPC@ AND TARGET vix::vix_webrpc AND NOT TARGET vix::webrpc)
   add_library(vix::webrpc ALIAS vix::vix_webrpc)
 endif()
 
diff --git a/modules/cli b/modules/cli
index c614c8c..60fecab 160000
--- a/modules/cli
+++ b/modules/cli
@@ -1 +1 @@
-Subproject commit c614c8cf977421c51586eba4204d32ea124b7977
+Subproject commit 60fecabf5780a580b987350c0b4ec71b164450fe