diff --git a/docs/releases/v0.18.1.md b/docs/releases/v0.18.1.md
new file mode 100644
index 0000000..c745329
--- /dev/null
+++ b/docs/releases/v0.18.1.md
@@ -0,0 +1,9 @@
+Updating to v0.18.0 made every host look unverified to the fleet controller; v0.18.1 restores the recorded configuration match.
+
+### Fixed
+- After `rootfiles fleet update --version v0.18.0`, the post-update check reported "remote config fingerprint is missing; inventory configuration is unverified" on hosts whose config does not set `exporter_firewall`, and the rollout stopped at the first host. Update to v0.18.1 and the check matches the last apply again. (#85)
+
+### Action needed
+- A host where `rootfiles apply` already ran under v0.18.0 recorded the v0.18.0 fingerprint. After updating it to v0.18.1, run `sudo rootfiles apply` (or `rootfiles fleet apply --host <name>`) once so the check matches again. (#85)
+
+**Full changelog**: https://github.com/STAIxBWLB/rootfiles/compare/v0.18.0...v0.18.1
diff --git a/internal/config/config.go b/internal/config/config.go
index 6b01146..3190f25 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -146,7 +146,7 @@ type MonitoringConfig struct {
 	PerimeterFirewall bool     `yaml:"perimeter_firewall"`
 	// ExporterFirewall installs the iptables guard that admits exporter
 	// traffic only from allow_from (IPv4, one /32, default ports).
-	ExporterFirewall  bool                `yaml:"exporter_firewall"`
+	ExporterFirewall  bool                `yaml:"exporter_firewall,omitempty"`
 	DCGMExporterImage string              `yaml:"dcgm_exporter_image,omitempty"`
 	Hub               MonitoringHubConfig `yaml:"hub"`
 }
diff --git a/internal/config/fingerprint_test.go b/internal/config/fingerprint_test.go
index 81ce935..3af7c14 100644
--- a/internal/config/fingerprint_test.go
+++ b/internal/config/fingerprint_test.go
@@ -52,3 +52,17 @@ func TestFingerprintIgnoresRuntimeAndSecretButDetectsIntent(t *testing.T) {
 		t.Fatal("intent change did not affect fingerprint")
 	}
 }
+
+// Every host records the fingerprint of its last apply, and fleet rollouts
+// stop on a host whose fingerprint no longer matches. A new config key must
+// therefore leave the encoding of configs that do not set it unchanged
+// (omitempty); this pins the value earlier releases computed.
+func TestFingerprintStableAcrossReleases(t *testing.T) {
+	fp, err := (&Config{Timezone: "UTC"}).Fingerprint()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := "c4ec434e963b8ec0ce76b900c608e439b90f27a533fd581b9401dfbdd5bc89ac"; fp != want {
+		t.Fatalf("fingerprint changed for a config that sets no new keys: %s, want %s", fp, want)
+	}
+}