diff --git a/CHANGELOG.md b/CHANGELOG.md
index af430ed..61dd7c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ All notable changes to this project will be documented in this file.
 
 - No unreleased changes recorded yet.
 
+## 1.5.2 - 2026-07-25
+
+### Fixed
+
+- Fixed player media upload sync so signed upload requests are verified after the request body has been parsed.
+
 ## 1.5.1 - 2026-07-25
 
 ### Fixed
diff --git a/README.md b/README.md
index e1653ff..0a5f3ae 100644
--- a/README.md
+++ b/README.md
@@ -87,5 +87,6 @@ Outside Docker, the web app and player do not have to use the same upload locati
 
 - The web app must be able to reach the player through `PLAYER_INTERNAL_BASE_URL`.
 - When running in Docker, that value should point to the Docker service name, not `localhost`.
+- If `PULSE_SIGNAGE_SHARED_SECRET` is set, the web and player containers must use the same value, and any reverse proxy in front of the player must forward `/api/media/...` without rewriting the path.
 - Uploaded media is stored separately from the application source, so make sure it is backed up if you are not using Docker volumes.
 - The player page uses the browser Screen Wake Lock API when available, but kiosk mode and OS sleep settings still matter because the browser can deny or release the wake lock.
\ No newline at end of file
diff --git a/package.json b/package.json
index 97a839e..bd6d099 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
   "repository": {
diff --git a/src/player/routes.js b/src/player/routes.js
index 5ab9705..bdaadb0 100644
--- a/src/player/routes.js
+++ b/src/player/routes.js
@@ -97,7 +97,7 @@ function registerPlayerRoutes(app, options) {
     });
   });
 
-  app.put('/api/media/:filename', requireRequestAuth, express.raw({ type: '*/*', limit: '100mb' }), async function (req, res, next) {
+  app.put('/api/media/:filename', express.raw({ type: '*/*', limit: '100mb' }), requireRequestAuth, async function (req, res, next) {
     try {
       const filename = require('path').basename(String(req.params.filename || '').trim());
       if (!filename) {