diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
index 96d8b79..706fcb1 100755
--- a/.clusterfuzzlite/build.sh
+++ b/.clusterfuzzlite/build.sh
@@ -10,6 +10,7 @@ set -euo pipefail
 cd /src/pkg-defender
 
 # Install the project and atheris
-pip install "uv==0.5.1" --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456 --require-hashes
+printf '%s\n' 'uv==0.5.1 --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456' > /tmp/uv-requirements.txt
+pip install -r /tmp/uv-requirements.txt --require-hashes
 uv pip install --system --no-deps .
 uv pip install --system "atheris==2.3.0"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 11f9385..e2ab929 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -542,7 +542,8 @@ jobs:
           VERSION="${{ needs.validate.outputs.version }}"
           echo "Smoke testing pkg-defender==${VERSION}"
           python -m venv /tmp/smoke-venv
-          /tmp/smoke-venv/bin/pip install "uv==0.5.1" --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456 --require-hashes
+          printf '%s\n' 'uv==0.5.1 --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456' > /tmp/uv-requirements.txt
+          /tmp/smoke-venv/bin/pip install -r /tmp/uv-requirements.txt --require-hashes
 
           echo "Waiting for pkg-defender==${VERSION} to appear on PyPI..."
           timeout 120 bash -c '
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20d2dfe..4b9ab38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,18 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.0.7] - 2026-07-23
+
+### Fixed
+
+- `pip install` with `--hash=<sha>` CLI flag rejected by pip ≥26.1.2 — root
+  cause: `--hash` is a per-requirement option valid only inside pip requirements
+  files, not as a CLI flag. Moved `--hash` into a temp requirements file
+  (`printf '%s\n' 'uv==0.5.1 --hash=...' > /tmp/uv-requirements.txt && pip
+  install -r /tmp/uv-requirements.txt --require-hashes`) in
+  `.clusterfuzzlite/build.sh` and `.github/workflows/release.yml`, preserving
+  SHA256 pinning and OpenSSF Scorecard Pinned-Dependencies compliance.
+
 ## [1.0.6] - 2026-07-21
 
 ### Added
diff --git a/docs/man/pkgd.1 b/docs/man/pkgd.1
index 83f8db8..baed9e1 100644
--- a/docs/man/pkgd.1
+++ b/docs/man/pkgd.1
@@ -1,6 +1,6 @@
 .\" Automatically generated by Pandoc 3.10
 .\"
-.TH "PKGD" "1" "July 20, 2026" "pkg\-defender 1.0.6" "User Commands"
+.TH "PKGD" "1" "July 23, 2026" "pkg\-defender 1.0.7" "User Commands"
 .SH NAME
 pkgd \(em supply chain attack defense CLI
 .SH SYNOPSIS
diff --git a/docs/man/pkgd.1.md b/docs/man/pkgd.1.md
index ed7f0e6..82e5721 100644
--- a/docs/man/pkgd.1.md
+++ b/docs/man/pkgd.1.md
@@ -1,7 +1,7 @@
 ---
 title: PKGD(1)
-date: "July 20, 2026"
-footer: "pkg-defender 1.0.6"
+date: "July 23, 2026"
+footer: "pkg-defender 1.0.7"
 header: "User Commands"
 ---
 
diff --git a/pyproject.toml b/pyproject.toml
index 15102b4..d7f512e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pkg-defender"
-version = "1.0.6"
+version = "1.0.7"
 description = "Stop supply chain attacks before they reach your machine or CI pipeline"
 requires-python = ">=3.11"
 license = "Apache-2.0"
diff --git a/src/pkg_defender/__init__.py b/src/pkg_defender/__init__.py
index 339297f..beaea78 100644
--- a/src/pkg_defender/__init__.py
+++ b/src/pkg_defender/__init__.py
@@ -25,4 +25,4 @@
 
             __version__ = _v
         except ImportError:
-            __version__ = "1.0.6"  # Tier 4: hardcoded fallback
+            __version__ = "1.0.7"  # Tier 4: hardcoded fallback
diff --git a/uv.lock b/uv.lock
index 86b1e8d..20c0502 100644
--- a/uv.lock
+++ b/uv.lock
@@ -873,7 +873,7 @@ wheels = [
 
 [[package]]
 name = "pkg-defender"
-version = "1.0.6"
+version = "1.0.7"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },