diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1c33189e..791343b5b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3105,7 +3105,7 @@ generation works again. Update gstack and the wave is yours.
   never enters the transcript.
 - The extension denies token/port reads to content scripts and foreign
   extensions, reimplemented for the v1.63 pinned-origin token model.
-  Contributed by @punksterlabs.
+  Contributed by @Mike-E-Log (#1822).
 - diff 9.0.0 (GHSA-73rr-hh4g-fpgx, @genisis0x); OpenAI key file written
   0600-at-create (@bunlongheng); injection-denylist and phone-pattern
   false positives calibrated (@Masashi-Ono0611, @JonasFocus, @abkrim).
@@ -3153,7 +3153,7 @@ generation works again. Update gstack and the wave is yours.
 - All three plan-tune hooks spawn their bins through a shared
   Windows-aware helper (@rafassousa); setup registers the SessionStart
   hook with a bash prefix (@NikhileshNanduri); BROWSE_BIN gets its .exe
-  (@rroojrooj); the polyfill exposes an exited promise (@punksterlabs)
+  (@rroojrooj); the polyfill exposes an exited promise (@habassa5)
   and the CJK terminal issues are gone (double-send fixed by
   @mindsurf0176, full-width font cells by @tomfluff).
 - New Windows regression tests run on windows-latest CI, not just as
diff --git a/browse/test/extension-sender-auth.test.ts b/browse/test/extension-sender-auth.test.ts
index ba5d4781c..c963770cc 100644
--- a/browse/test/extension-sender-auth.test.ts
+++ b/browse/test/extension-sender-auth.test.ts
@@ -4,7 +4,7 @@
  * A content script runs in web-page context and can be influenced by page
  * content; a foreign extension is not us. Neither may read or spend the
  * browse server's auth token or port through background.js's message
- * surface. PR #1822 (@punksterlabs) found getPort handing the token to any
+ * surface. PR #1822 (@Mike-E-Log) found getPort handing the token to any
  * caller that passed the type allowlist; this suite pins the reimplemented
  * gate BEHAVIORALLY — it drives the real background.js onMessage listener
  * under a chrome stub with four sender shapes (own extension page, own