diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 7df0c59..56fc883 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,10 +1,10 @@
 ## What's new in v1.2.1
 
 ### Bug fixes
-- Fixed the root cause of "Not signed in" errors: URLSession was silently discarding the manually-set Cookie header because `httpShouldHandleCookies` defaults to `true`, which makes URLSession replace it with its own (empty) HTTPCookieStorage — claude.ai session cookies live in WKWebsiteDataStore, not HTTPCookieStorage. Setting `httpShouldHandleCookies = false` ensures the cookies are actually sent.
-- Added browser-like request headers (User-Agent, Origin, Referer) matching what Claude's API expects, consistent with the working Windows implementation
-- Removed background WKWebView complexity added in beta.12–13 — reverted to simple URLSession approach with correct cookie handling
-- Fixed login window auto-closing before the user could sign in — login window loads `/login` so auth is only detected after the actual sign-in redirect
-- Fixed login detection for Next.js SPA navigation using KVO on WebView URL (history.pushState doesn't trigger didFinish)
+- Fixed premature login detection when signing in with Google/OAuth: the login window was closing the moment the browser navigated to the OAuth provider (e.g. accounts.google.com), before the sign-in actually completed and before any session cookie was set. Auth is now only detected when the browser returns to claude.ai/anthropic.com at a non-login page.
+- Fixed the root cause of "Not signed in" errors: URLSession was silently discarding the manually-set Cookie header because `httpShouldHandleCookies` defaults to `true`, which makes URLSession replace it with its own (empty) HTTPCookieStorage. Setting `httpShouldHandleCookies = false` ensures cookies from WKWebsiteDataStore are actually sent.
+- Added browser-like request headers (User-Agent, Origin, Referer) matching what Claude's API expects
+- Fixed login window auto-closing before the user could sign in — login window loads `/login` so detection only fires after the actual sign-in redirect
+- Fixed login detection for Next.js SPA navigation using KVO on WebView URL
 - Added `/api/organizations` as a final fallback for org ID resolution
 - Fixed Settings incorrectly showing "Signed in" after a failed refresh