diff --git a/docs/release-notes.md b/docs/release-notes.md
index 394bf5be..39e4b91d 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -6,6 +6,7 @@
   * SMAPI now uses [automated and attested builds](https://www.patreon.com/posts/automated-builds-148417912) (thanks to DecidedlyHuman)!  
     _This improves the security and transparency of SMAPI builds. Every step to build SMAPI from the public source code is now public and verifiable, with file signatures to let players and tools confirm the build hasn't been tampered with._
   * SMAPI can now detect known malicious loose files in the `Mods` folder.
+  * Updated internal mod blacklist.
 
 ## 4.4.0
 Released 10 January 2026 for Stardew Valley 1.6.14 or later. See [release highlights](https://www.patreon.com/posts/147916705).
diff --git a/src/SMAPI.Web/wwwroot/SMAPI.blacklist.json b/src/SMAPI.Web/wwwroot/SMAPI.blacklist.json
index 38109bb9..59892d63 100644
--- a/src/SMAPI.Web/wwwroot/SMAPI.blacklist.json
+++ b/src/SMAPI.Web/wwwroot/SMAPI.blacklist.json
@@ -21,5 +21,11 @@
      * If any file in a folder matches an entry, the entire folder is considered malicious.
     */
     "LooseFileBlacklist": [
+        // 2026-01: 'Alchemistry' (ModDrop:1731397, malicious reupload of legit mod)
+        {
+            "Name": "Auto_Alchemistry.bat",
+            "Hash": "8b749727775689a05cc92ab4d624ab8b",
+            "Message": "It downloads malicious code from a remote server and runs it on your computer. SMAPI refused to load the mod, but you should delete the mod containing this file and run a complete anti-malware scan of your computer now to be safe."
+        }
     ]
 }