diff --git a/.github/docker/Dockerfile.ci b/.github/docker/Dockerfile.ci
index 038b25762..891833bb6 100644
--- a/.github/docker/Dockerfile.ci
+++ b/.github/docker/Dockerfile.ci
@@ -60,4 +60,4 @@ RUN useradd -m -s /bin/bash runner \
     && mkdir -p /home/runner/.gstack && chown -R runner:runner /home/runner/.gstack \
     && chmod 1777 /tmp \
     && mkdir -p /home/runner/.bun && chown -R runner:runner /home/runner/.bun \
-    && chmod -R 1777 /tmp
+    && find /tmp -type d -exec chmod 1777 {} +
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2ac49802..0c36bffa1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.15.4.1] - 2026-04-04 — Community Fixes: Docker, Binary Tracking, Cross-Platform Temp Paths
+
+Three fixes from the open issue tracker. Every clone is now ~58MB smaller, the Docker CI image sets permissions correctly, and cookie import works on any platform.
+
+### Fixed
+
+- **58MB tracked binary removed.** `bin/gstack-global-discover` was committed despite `.gitignore`. `git rm --cached` stops tracking it. The TypeScript source remains, and `./setup` compiles it locally. (#779)
+- **Docker sticky bit on files.** `chmod -R 1777 /tmp` in the CI Dockerfile applied the sticky bit to files (meaningless). Now uses `find -type d` to only chmod directories. (#709)
+- **Hardcoded `/tmp` in cookie import.** `cookie-import-browser.ts` used `/tmp` directly instead of `os.tmpdir()`. Now portable. On macOS this resolves to a per-user temp directory, which is actually more secure. (#708)
+
 ## [0.15.4.0] - 2026-04-03 — Autoplan DX Integration + Docs
 
 `/autoplan` now auto-detects developer-facing plans and runs `/plan-devex-review` as Phase 3.5, with full dual-voice adversarial review (Claude subagent + Codex). If your plan mentions APIs, CLIs, SDKs, agent actions, or anything developers integrate with, the DX review kicks in automatically. No extra commands needed.
diff --git a/VERSION b/VERSION
index 01f4ab54b..ed46cce77 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.15.4.0
+0.15.4.1
diff --git a/bin/gstack-global-discover b/bin/gstack-global-discover
deleted file mode 100755
index ebffeeb9e..000000000
Binary files a/bin/gstack-global-discover and /dev/null differ
diff --git a/browse/src/cookie-import-browser.ts b/browse/src/cookie-import-browser.ts
index 1e7f1ce45..dde30b9c2 100644
--- a/browse/src/cookie-import-browser.ts
+++ b/browse/src/cookie-import-browser.ts
@@ -386,7 +386,7 @@ function openDb(dbPath: string, browserName: string): Database {
 }
 
 function openDbFromCopy(dbPath: string, browserName: string): Database {
-  const tmpPath = `/tmp/browse-cookies-${browserName.toLowerCase()}-${crypto.randomUUID()}.db`;
+  const tmpPath = path.join(os.tmpdir(), `browse-cookies-${browserName.toLowerCase()}-${crypto.randomUUID()}.db`);
   try {
     fs.copyFileSync(dbPath, tmpPath);
     // Also copy WAL and SHM if they exist (for consistent reads)