diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49da341ec1c4a2..ad084c8a562e95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file.
 
+## [4.4.5] - 2025-09-23
+
+### Security
+
+- Update dependencies
+
+### Added
+
+- Add support for `has:quote` in search (#36217 by @ClearlyClaire)
+
+### Changed
+
+- Change quoted posts from silenced accounts to use a click-through rather than being hidden (#36166 and #36167 by @ClearlyClaire)
+
+### Fixed
+
+- Fix processing of out-of-order `Update` as implicit updates (#36190 by @ClearlyClaire)
+- Fix getting `Create` and `Update` out of order (#36176 by @ClearlyClaire)
+- Fix quotes with Content Warnings but no text being shown without Content Warnings (#36150 by @ClearlyClaire)
+
 ## [4.4.4] - 2025-09-16
 
 ### Security
@@ -18,7 +38,7 @@ All notable changes to this project will be documented in this file.
 - Fix WebUI handling of deleted quoted posts (#35909 and #35918 by @ClearlyClaire and @diondiondion)
 - Fix “Edit” and “Delete & Redraft” on a poll not inserting empty option (#35892 by @ClearlyClaire)
 - Fix loading of some compatibility CSS on some configurations (#35876 by @shleeable)
-- Fix HttpLog not being enabled with `RAILS_LOGÈ_LEVEL=debug` (#35833 by @mjankowski)
+- Fix HttpLog not being enabled with `RAILS_LOG_LEVEL=debug` (#35833 by @mjankowski)
 - Fix self-destruct scheduler behavior on some Redis setups (#35823 by @ClearlyClaire)
 - Fix `tootctl admin create` not bypassing reserved username checks (#35779 by @ClearlyClaire)
 - Fix interaction policy changes in implicit updates not being saved (#35751 by @ClearlyClaire)
diff --git a/Gemfile.lock b/Gemfile.lock
index 0718b102a8d7e3..2d144104b2f602 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -725,7 +725,7 @@ GEM
     responders (3.1.1)
       actionpack (>= 5.2)
       railties (>= 5.2)
-    rexml (3.4.1)
+    rexml (3.4.4)
     rotp (6.3.0)
     rouge (4.5.2)
     rpam2 (4.0.2)
diff --git a/app/javascript/mastodon/actions/importer/normalizer.js b/app/javascript/mastodon/actions/importer/normalizer.js
index 5bb221df305406..cdb91dc8a8e6a6 100644
--- a/app/javascript/mastodon/actions/importer/normalizer.js
+++ b/app/javascript/mastodon/actions/importer/normalizer.js
@@ -93,7 +93,7 @@ export function normalizeStatus(status, normalOldStatus, options = undefined) {
   } else {
     // If the status has a CW but no contents, treat the CW as if it were the
     // status' contents, to avoid having a CW toggle with seemingly no effect.
-    if (normalStatus.spoiler_text && !normalStatus.content) {
+    if (normalStatus.spoiler_text && !normalStatus.content && !normalStatus.quote) {
       normalStatus.content = normalStatus.spoiler_text;
       normalStatus.spoiler_text = '';
     }
diff --git a/app/javascript/mastodon/components/hover_card_account.tsx b/app/javascript/mastodon/components/hover_card_account.tsx
index 87fbec0e25a85c..a0d2ad7cfb4745 100644
--- a/app/javascript/mastodon/components/hover_card_account.tsx
+++ b/app/javascript/mastodon/components/hover_card_account.tsx
@@ -19,7 +19,7 @@ import { FollowButton } from 'mastodon/components/follow_button';
 import { LoadingIndicator } from 'mastodon/components/loading_indicator';
 import { ShortNumber } from 'mastodon/components/short_number';
 import { useFetchFamiliarFollowers } from 'mastodon/features/account_timeline/hooks/familiar_followers';
-import { domain } from 'mastodon/initial_state';
+import { domain, isHideItem } from 'mastodon/initial_state';
 import { getAccountHidden } from 'mastodon/selectors/accounts';
 import { useAppSelector, useAppDispatch } from 'mastodon/store';
 
@@ -54,8 +54,10 @@ export const HoverCardAccount = forwardRef<
   const relationship = useAppSelector((state) =>
     accountId ? state.relationships.get(accountId) : undefined,
   );
-  const isMutual = relationship?.followed_by && relationship.following;
-  const isFollower = relationship?.followed_by;
+  const isHideRelationships = isHideItem('relationships');
+  const isMutual =
+    !isHideRelationships && relationship?.followed_by && relationship.following;
+  const isFollower = !isHideRelationships && relationship?.followed_by;
   const hasRelationshipLoaded = !!relationship;
 
   const shouldDisplayFamiliarFollowers =
diff --git a/app/javascript/mastodon/components/status_quoted.tsx b/app/javascript/mastodon/components/status_quoted.tsx
index 3f7f51cf0643a3..d58760ac6e37c4 100644
--- a/app/javascript/mastodon/components/status_quoted.tsx
+++ b/app/javascript/mastodon/components/status_quoted.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useMemo } from 'react';
+import { useCallback, useEffect, useMemo } from 'react';
 
 import { FormattedMessage } from 'react-intl';
 
@@ -11,13 +11,16 @@ import ArticleIcon from '@/material-icons/400-24px/article.svg?react';
 import ChevronRightIcon from '@/material-icons/400-24px/chevron_right.svg?react';
 import { Icon } from 'mastodon/components/icon';
 import StatusContainer from 'mastodon/containers/status_container';
+import { domain } from 'mastodon/initial_state';
 import type { Status } from 'mastodon/models/status';
 import type { RootState } from 'mastodon/store';
 import { useAppDispatch, useAppSelector } from 'mastodon/store';
 
 import QuoteIcon from '../../images/quote.svg?react';
+import { revealAccount } from '../actions/accounts_typed';
 import { fetchStatus } from '../actions/statuses';
 import { makeGetStatus } from '../selectors';
+import { getAccountHidden } from '../selectors/accounts';
 
 const MAX_QUOTE_POSTS_NESTING_LEVEL = 1;
 
@@ -73,6 +76,29 @@ type GetStatusSelector = (
   props: { id?: string | null; contextType?: string },
 ) => Status | null;
 
+const LimitedAccountHint: React.FC<{ accountId: string }> = ({ accountId }) => {
+  const dispatch = useAppDispatch();
+  const reveal = useCallback(() => {
+    dispatch(revealAccount({ id: accountId }));
+  }, [dispatch, accountId]);
+
+  return (
+    <>
+      <FormattedMessage
+        id='status.quote_error.limited_account_hint.title'
+        defaultMessage='This account has been hidden by the moderators of {domain}.'
+        values={{ domain }}
+      />
+      <button onClick={reveal} className='link-button'>
+        <FormattedMessage
+          id='status.quote_error.limited_account_hint.action'
+          defaultMessage='Show anyway'
+        />
+      </button>
+    </>
+  );
+};
+
 export const QuotedStatus: React.FC<{
   quote: QuoteMap;
   contextType?: string;
@@ -100,6 +126,14 @@ export const QuotedStatus: React.FC<{
 
   const shouldLoadQuote = !status?.get('isLoading') && quoteState !== 'deleted';
 
+  const accountId: string | null = status?.get('account', null) as
+    | string
+    | null;
+
+  const hiddenAccount = useAppSelector(
+    (state) => accountId && getAccountHidden(state, accountId),
+  );
+
   useEffect(() => {
     if (shouldLoadQuote && quotedStatusId) {
       dispatch(
@@ -164,6 +198,8 @@ export const QuotedStatus: React.FC<{
         defaultMessage='This post cannot be displayed.'
       />
     );
+  } else if (hiddenAccount && accountId) {
+    quoteError = <LimitedAccountHint accountId={accountId} />;
   }
 
   if (quoteError) {
diff --git a/app/javascript/mastodon/features/account_timeline/components/account_header.tsx b/app/javascript/mastodon/features/account_timeline/components/account_header.tsx
index d7f228129af6b7..5887ce114f90b2 100644
--- a/app/javascript/mastodon/features/account_timeline/components/account_header.tsx
+++ b/app/javascript/mastodon/features/account_timeline/components/account_header.tsx
@@ -50,7 +50,12 @@ import { DomainPill } from 'mastodon/features/account/components/domain_pill';
 import FollowRequestNoteContainer from 'mastodon/features/account/containers/follow_request_note_container';
 import { useLinks } from 'mastodon/hooks/useLinks';
 import { useIdentity } from 'mastodon/identity_context';
-import { autoPlayGif, me, domain as localDomain } from 'mastodon/initial_state';
+import {
+  autoPlayGif,
+  me,
+  domain as localDomain,
+  isHideItem,
+} from 'mastodon/initial_state';
 import type { Account } from 'mastodon/models/account';
 import type { MenuItem } from 'mastodon/models/dropdown_menu';
 import {
@@ -220,6 +225,8 @@ export const AccountHeader: React.FC<{
   const hidden = useAppSelector((state) => getAccountHidden(state, accountId));
   const handleLinkClick = useLinks();
 
+  const isHideRelationships = isHideItem('relationships');
+
   const handleBlock = useCallback(() => {
     if (!account) {
       return;
@@ -548,7 +555,7 @@ export const AccountHeader: React.FC<{
         text: intl.formatMessage(messages.add_or_remove_from_exclude_antenna),
         action: handleAddToExcludeAntenna,
       });
-      if (relationship?.followed_by) {
+      if (!isHideRelationships && relationship?.followed_by) {
         arr.push({
           text: intl.formatMessage(messages.add_or_remove_from_circle),
           action: handleAddToCircle,
@@ -556,7 +563,7 @@ export const AccountHeader: React.FC<{
       }
       arr.push(null);
 
-      if (relationship?.followed_by) {
+      if (!isHideRelationships && relationship?.followed_by) {
         const handleRemoveFromFollowers = () => {
           dispatch(
             openModal({
@@ -709,6 +716,7 @@ export const AccountHeader: React.FC<{
     handleReblogToggle,
     handleReport,
     handleUnblockDomain,
+    isHideRelationships,
   ]);
 
   if (!account) {
@@ -724,6 +732,7 @@ export const AccountHeader: React.FC<{
 
   if (me !== account.id && relationship) {
     if (
+      !isHideRelationships &&
       relationship.followed_by &&
       (relationship.following || relationship.requested)
     ) {
@@ -735,7 +744,7 @@ export const AccountHeader: React.FC<{
           />
         </span>,
       );
-    } else if (relationship.followed_by) {
+    } else if (!isHideRelationships && relationship.followed_by) {
       info.push(
         <span key='followed_by' className='relationship-tag'>
           <FormattedMessage
@@ -744,7 +753,7 @@ export const AccountHeader: React.FC<{
           />
         </span>,
       );
-    } else if (relationship.requested_by) {
+    } else if (!relationship.followed_by && relationship.requested_by) {
       info.push(
         <span key='requested_by' className='relationship-tag'>
           <FormattedMessage
diff --git a/app/javascript/mastodon/locales/en.json b/app/javascript/mastodon/locales/en.json
index 0eaffe3732c172..ac5963cd12bf16 100644
--- a/app/javascript/mastodon/locales/en.json
+++ b/app/javascript/mastodon/locales/en.json
@@ -1082,6 +1082,8 @@
   "status.open": "Expand this post",
   "status.pin": "Pin on profile",
   "status.quote_error.filtered": "Hidden due to one of your filters",
+  "status.quote_error.limited_account_hint.action": "Show anyway",
+  "status.quote_error.limited_account_hint.title": "This account has been hidden by the moderators of {domain}.",
   "status.quote_error.not_found": "This post cannot be displayed.",
   "status.quote_error.pending_approval": "This post is pending approval from the original author.",
   "status.quote_error.rejected": "This post cannot be displayed as the original author does not allow it to be quoted.",
diff --git a/app/javascript/mastodon/locales/ja.json b/app/javascript/mastodon/locales/ja.json
index 626db6c106c1d0..35fecfeee9915b 100644
--- a/app/javascript/mastodon/locales/ja.json
+++ b/app/javascript/mastodon/locales/ja.json
@@ -54,6 +54,7 @@
   "account.followers": "フォロワー",
   "account.followers.empty": "まだ誰もフォローしていません。",
   "account.followers_counter": "{count, plural, other {{counter} フォロワー}}",
+  "account.followers.hidden_from_me": "この情報はあなた自身の設定によって隠されています。",
   "account.followers_you_know_counter": "あなたと知り合いの{counter}人",
   "account.following": "フォロー中",
   "account.following_counter": "{count, plural, other {{counter} フォロー}}",
diff --git a/app/lib/activitypub/activity/update.rb b/app/lib/activitypub/activity/update.rb
index 8658684b037b2c..b8365819ccd340 100644
--- a/app/lib/activitypub/activity/update.rb
+++ b/app/lib/activitypub/activity/update.rb
@@ -28,6 +28,9 @@ def update_status
 
     @status = Status.find_by(uri: object_uri, account_id: @account.id)
 
+    # We may be getting `Create` and `Update` out of order
+    @status ||= ActivityPub::Activity::Create.new(@json, @account, **@options).perform
+
     return if @status.nil?
 
     ActivityPub::ProcessStatusUpdateService.new.call(@status, @json, @object, request_id: @options[:request_id])
diff --git a/app/lib/status_cache_hydrator.rb b/app/lib/status_cache_hydrator.rb
index 61ffde0d9d9ba8..45897712296f59 100644
--- a/app/lib/status_cache_hydrator.rb
+++ b/app/lib/status_cache_hydrator.rb
@@ -88,7 +88,7 @@ def hydrate_quote_payload(empty_payload, quote, account_id, nested: false)
         if quote.quoted_status.nil?
           payload[nested ? :quoted_status_id : :quoted_status] = nil
           payload[:state] = 'deleted'
-        elsif StatusFilter.new(quote.quoted_status, Account.find_by(id: account_id)).filtered?
+        elsif StatusFilter.new(quote.quoted_status, Account.find_by(id: account_id)).filtered_for_quote?
           payload[nested ? :quoted_status_id : :quoted_status] = nil
           payload[:state] = 'unauthorized'
         else
diff --git a/app/lib/status_filter.rb b/app/lib/status_filter.rb
index 8df80b7d63c4aa..3400b202b7fa5b 100644
--- a/app/lib/status_filter.rb
+++ b/app/lib/status_filter.rb
@@ -16,6 +16,12 @@ def filtered?
     blocked_by_policy? || (account_present? && filtered_status?) || silenced_account?
   end
 
+  def filtered_for_quote?
+    return false if !account.nil? && account.id == status.account_id
+
+    blocked_by_policy? || (account_present? && filtered_status?)
+  end
+
   private
 
   def account_present?
diff --git a/app/models/concerns/status/search_concern.rb b/app/models/concerns/status/search_concern.rb
index 65422d55abb946..705cbcc27a144e 100644
--- a/app/models/concerns/status/search_concern.rb
+++ b/app/models/concerns/status/search_concern.rb
@@ -81,6 +81,7 @@ def searchable_properties
       properties << 'sensitive' if sensitive?
       properties << 'reply' if reply?
       properties << 'reference' if with_status_reference?
+      properties << 'quote' if with_quote?
     end
   end
 end
diff --git a/app/serializers/rest/base_quote_serializer.rb b/app/serializers/rest/base_quote_serializer.rb
index 20a53d1a20e100..be9d5cbe6f238e 100644
--- a/app/serializers/rest/base_quote_serializer.rb
+++ b/app/serializers/rest/base_quote_serializer.rb
@@ -8,13 +8,13 @@ def state
 
     # Extra states when a status is unavailable
     return 'deleted' if object.quoted_status.nil?
-    return 'unauthorized' if status_filter.filtered?
+    return 'unauthorized' if status_filter.filtered_for_quote?
 
     object.state
   end
 
   def quoted_status
-    object.quoted_status if object.accepted? && object.quoted_status.present? && !status_filter.filtered?
+    object.quoted_status if object.accepted? && object.quoted_status.present? && !status_filter.filtered_for_quote?
   end
 
   private
diff --git a/app/services/activitypub/process_status_update_service.rb b/app/services/activitypub/process_status_update_service.rb
index f59439b954badc..745ab76d13c856 100644
--- a/app/services/activitypub/process_status_update_service.rb
+++ b/app/services/activitypub/process_status_update_service.rb
@@ -31,6 +31,9 @@ def call(status, activity_json, object_json, request_id: nil)
       return @status unless valid_status?
 
       handle_explicit_update!
+    elsif @status.edited_at.present? && (@status_parser.edited_at.nil? || @status_parser.edited_at < @status.edited_at)
+      # This is an older update, reject it
+      return @status
     else
       handle_implicit_update!
     end
diff --git a/docker-compose.yml b/docker-compose.yml
index 43ebe4c5ab8299..55304d9e7c12e8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -59,7 +59,7 @@ services:
   web:
     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
     build: .
-    image: kmyblue:19.5-lts
+    image: kmyblue:19.6-lts
     restart: always
     env_file: .env.production
     command: bundle exec puma -C config/puma.rb
@@ -83,7 +83,7 @@ services:
     build:
       dockerfile: ./streaming/Dockerfile
       context: .
-    image: kmyblue-streaming:19.5-lts
+    image: kmyblue-streaming:19.6-lts
     restart: always
     env_file: .env.production
     command: node ./streaming/index.js
@@ -101,7 +101,7 @@ services:
 
   sidekiq:
     build: .
-    image: kmyblue:19.5-lts
+    image: kmyblue:19.6-lts
     restart: always
     env_file: .env.production
     command: bundle exec sidekiq
diff --git a/lib/mastodon/version.rb b/lib/mastodon/version.rb
index a9b1521af3359f..c2e1373dcb56cd 100644
--- a/lib/mastodon/version.rb
+++ b/lib/mastodon/version.rb
@@ -13,7 +13,7 @@ def kmyblue_major
     end
 
     def kmyblue_minor
-      5
+      6
     end
 
     def kmyblue_flag
@@ -31,7 +31,7 @@ def minor
     end
 
     def patch
-      4
+      5
     end
 
     def default_prerelease
diff --git a/spec/lib/activitypub/activity/update_spec.rb b/spec/lib/activitypub/activity/update_spec.rb
index f3b24e91d2cbf1..d0246bcebc4acc 100644
--- a/spec/lib/activitypub/activity/update_spec.rb
+++ b/spec/lib/activitypub/activity/update_spec.rb
@@ -138,9 +138,10 @@
         subject.perform
       end
 
-      it 'does not create a new status', :inline_jobs do
+      it 'creates a new status', :inline_jobs do
         status = Status.find_by(uri: 'https://example.com/note')
-        expect(status).to be_nil
+        expect(status).to_not be_nil
+        expect(status.text).to eq 'Ohagi is tsubuan'
       end
     end
 
diff --git a/spec/lib/activitypub/activity_spec.rb b/spec/lib/activitypub/activity_spec.rb
new file mode 100644
index 00000000000000..218da04d9b5e7a
--- /dev/null
+++ b/spec/lib/activitypub/activity_spec.rb
@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ActivityPub::Activity do
+  describe 'processing a Create and an Update' do
+    let(:sender) { Fabricate(:account, followers_url: 'http://example.com/followers', domain: 'example.com', uri: 'https://example.com/actor') }
+    let(:quoted_account) { Fabricate(:account, domain: 'quoted.example.com') }
+    let(:quoted_status) { Fabricate(:status, account: quoted_account) }
+    let(:approval_uri) { 'https://quoted.example.com/approvals/1' }
+
+    let(:approval_payload) do
+      {
+        '@context': [
+          'https://www.w3.org/ns/activitystreams',
+          {
+            QuoteAuthorization: 'https://w3id.org/fep/044f#QuoteAuthorization',
+            gts: 'https://gotosocial.org/ns#',
+            interactingObject: {
+              '@id': 'gts:interactingObject',
+              '@type': '@id',
+            },
+            interactionTarget: {
+              '@id': 'gts:interactionTarget',
+              '@type': '@id',
+            },
+          },
+        ],
+        type: 'QuoteAuthorization',
+        id: approval_uri,
+        attributedTo: ActivityPub::TagManager.instance.uri_for(quoted_status.account),
+        interactingObject: [ActivityPub::TagManager.instance.uri_for(sender), 'post1'].join('/'),
+        interactionTarget: ActivityPub::TagManager.instance.uri_for(quoted_status),
+      }
+    end
+
+    let(:create_json) do
+      {
+        '@context': [
+          'https://www.w3.org/ns/activitystreams',
+          {
+            quote: 'https://w3id.org/fep/044f#quote',
+          },
+        ],
+        id: [ActivityPub::TagManager.instance.uri_for(sender), '#create'].join,
+        type: 'Create',
+        actor: ActivityPub::TagManager.instance.uri_for(sender),
+        object: {
+          id: [ActivityPub::TagManager.instance.uri_for(sender), 'post1'].join('/'),
+          type: 'Note',
+          to: [
+            'https://www.w3.org/ns/activitystreams#Public',
+          ],
+          content: 'foo',
+          published: '2025-05-24T11:03:10Z',
+          quote: ActivityPub::TagManager.instance.uri_for(quoted_status),
+        },
+      }.deep_stringify_keys
+    end
+
+    let(:update_json) do
+      {
+        '@context': [
+          'https://www.w3.org/ns/activitystreams',
+          {
+            quote: 'https://w3id.org/fep/044f#quote',
+            quoteAuthorization: { '@id': 'https://w3id.org/fep/044f#quoteAuthorization', '@type': '@id' },
+          },
+        ],
+        id: [ActivityPub::TagManager.instance.uri_for(sender), '#update'].join,
+        type: 'Update',
+        actor: ActivityPub::TagManager.instance.uri_for(sender),
+        object: {
+          id: [ActivityPub::TagManager.instance.uri_for(sender), 'post1'].join('/'),
+          type: 'Note',
+          to: [
+            'https://www.w3.org/ns/activitystreams#Public',
+          ],
+          content: 'foo',
+          published: '2025-05-24T11:03:10Z',
+          quote: ActivityPub::TagManager.instance.uri_for(quoted_status),
+          quoteAuthorization: approval_uri,
+        },
+      }.deep_stringify_keys
+    end
+
+    before do
+      sender.update(uri: ActivityPub::TagManager.instance.uri_for(sender))
+
+      stub_request(:get, approval_uri).to_return(headers: { 'Content-Type': 'application/activity+json' }, body: Oj.dump(approval_payload))
+    end
+
+    context 'when getting them in order' do
+      it 'creates a status and approves the quote' do
+        described_class.factory(create_json, sender).perform
+        status = described_class.factory(update_json, sender).perform
+
+        expect(status.quote.state).to eq 'accepted'
+      end
+    end
+
+    context 'when getting them out of order' do
+      it 'creates a status and approves the quote' do
+        described_class.factory(update_json, sender).perform
+        status = described_class.factory(create_json, sender).perform
+
+        expect(status.quote.state).to eq 'accepted'
+      end
+    end
+  end
+end