diff --git a/Sources/GhosttyTerminalView.swift b/Sources/GhosttyTerminalView.swift
index c3828acf262..6648764ad7e 100644
--- a/Sources/GhosttyTerminalView.swift
+++ b/Sources/GhosttyTerminalView.swift
@@ -1798,6 +1798,12 @@ class GhosttyApp {
                 prefix: "cmux-shell-integration-override",
                 logLabel: "shell integration override (fallback)"
             )
+            loadInlineGhosttyConfig(
+                "copy-on-select = clipboard",
+                into: fallbackConfig,
+                prefix: "cmux-copy-on-select",
+                logLabel: "copy-on-select override (fallback)"
+            )
             usesHostLayerBackground = true
             ghostty_config_finalize(fallbackConfig)
             updateDefaultBackground(from: fallbackConfig, source: "initialize.fallbackConfig")
@@ -1887,6 +1893,17 @@ class GhosttyApp {
         ghostty_config_load_recursive_files(config)
         loadCmuxAppSupportGhosttyConfigIfNeeded(config)
         loadCJKFontFallbackIfNeeded(config)
+        // Ghostty's default copy-on-select = true writes to a private
+        // named pasteboard (com.mitchellh.ghostty.selection) that is not
+        // the system clipboard. Override to "clipboard" so that selecting
+        // text copies to NSPasteboard.general and Cmd+V works as macOS
+        // users expect.
+        loadInlineGhosttyConfig(
+            "copy-on-select = clipboard",
+            into: config,
+            prefix: "cmux-copy-on-select",
+            logLabel: "copy-on-select override"
+        )
         let useHostLayerBackground = !hasConfiguredBackgroundImage(config)
         usesHostLayerBackground = useHostLayerBackground
         if !useHostLayerBackground {
diff --git a/docs/ghostty-fork.md b/docs/ghostty-fork.md
index ed0d91d277a..39425f9f07e 100644
--- a/docs/ghostty-fork.md
+++ b/docs/ghostty-fork.md
@@ -15,6 +15,7 @@ When we change the fork, update this document and the parent submodule SHA.
 Fork main has advanced beyond the March 30, 2026 rebase onto upstream `main`
 at `3509ccf78` (`v1.3.1-457-g3509ccf78`).
 Current cmux pinned fork head: `3b684a085` (`tip-1717-g3b684a085`).
+Branch `fix-copy-on-select-uaf` (`8eaee4d95`) carries the section 9 fix below (manaflow-ai/ghostty#36).
 
 ### 1) macOS display link restart on display changes
 
@@ -123,6 +124,17 @@ tend to conflict together during rebases.
 Fork main now carries the section 8 APC handling fix plus later upstream merges;
 the current cmux pin is the head listed above.
 
+### 9) Fix use-after-free in copy-on-select
+
+- Commit: `8eaee4d95` (Fix use-after-free in copy-on-select)
+- Branch: `fix-copy-on-select-uaf` (manaflow-ai/ghostty#36, pending merge)
+- Files:
+  - `src/Surface.zig`
+- Summary:
+  - Fixes a use-after-free in `setSelection()`. The old code called `Screen.select()` which freed tracked pins via `old.deinit()`, then compared the new selection against the freed `prev` pointer via `eql()`. Since freed memory usually retains old values, `eql()` returned true and `copySelectionToClipboards` was silently skipped — producing the one-character-paste symptom (cmux #2664).
+  - The fix evaluates `eql()` BEFORE `Screen.select()` frees the old pins.
+  - Additionally, copies the final selection to the clipboard directly on mouse-up (left-button release) to guarantee the clipboard is always up-to-date at the end of a drag selection.
+
 ## Upstreamed fork changes
 
 ### cursor-click-to-move respects OSC 133 click-to-move
diff --git a/ghostty b/ghostty
index 3b684a085d4..8eaee4d950d 160000
--- a/ghostty
+++ b/ghostty
@@ -1 +1 @@
-Subproject commit 3b684a085d40ec79e8a0ae863a4f2b48ed4dba74
+Subproject commit 8eaee4d950d7dee24003e44b454060679e1b521a