diff --git a/.changeset/console-v0-10-1.md b/.changeset/console-v0-10-1.md
new file mode 100644
index 00000000..5c6c526c
--- /dev/null
+++ b/.changeset/console-v0-10-1.md
@@ -0,0 +1,5 @@
+---
+'seamless-auth-api': patch
+---
+
+The bundled admin console at `/console` moves to dashboard v0.10.1, which sends the OAuth state binding. Since 0.19.2 the API refuses an OAuth callback without it, so signing in to the console with an OAuth provider failed on 0.19.2 unless `OAUTH_ALLOW_UNBOUND_STATE=true` was set.
diff --git a/Dockerfile b/Dockerfile
index e41d43fd..7d6b170c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,7 +27,7 @@ WORKDIR /dashboard
 
 ARG SEAMLESS_ADMIN_DASHBOARD_REPO=https://github.com/fells-code/seamless-auth-admin-dashboard.git
 # Pinned dashboard release tag. The same-origin /console build has shipped since v0.2.0.
-ARG SEAMLESS_ADMIN_DASHBOARD_REF=v0.10.0
+ARG SEAMLESS_ADMIN_DASHBOARD_REF=v0.10.1
 
 RUN apt-get update && \
   apt-get install -y git python3 make g++ && \
diff --git a/docs/configuration.md b/docs/configuration.md
index c239fa39..559241ae 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -238,7 +238,7 @@ sets `VITE_BASE_PATH=/console/` and `VITE_SAME_ORIGIN=true` so the assets, the r
 and the origin-derived API base all agree) in a dedicated stage (see the `admin-dashboard` stage
 in [`Dockerfile`](../Dockerfile)). Bump the dashboard shipped to tenants by raising the
 `SEAMLESS_ADMIN_DASHBOARD_REF` build ARG; the new version then flows to tenants through the normal
-upstream auth-image release. The ref is pinned to the dashboard release tag `v0.10.0`;
+upstream auth-image release. The ref is pinned to the dashboard release tag `v0.10.1`;
 `v0.2.0` was the first release to ship the same-origin `/console` build.
 
 Because the same-origin build derives its API base from the page origin **and still speaks the