diff --git a/changelog.md b/changelog.md
index dc7dbb5..0daa844 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 2026-05-08 - 5.3.7 - fix(cloudly-client)
+correct Cloudly request handling for cluster config, cluster updates, and image pushes
+
+- Return the full cluster config response instead of only configData to match the typed request contract
+- Use the provided identity when requesting certificates and include clusterId in cluster update requests
+- Send the actual image version during pushes and fail early when Cloudly rejects the upload
+
 ## 2026-05-08 - 5.3.6 - fix(deps)
 bump @api.global/typedrequest and @api.global/typedsocket patch versions
 
diff --git a/ts/00_commitinfo_data.ts b/ts/00_commitinfo_data.ts
index 70740a3..d04b650 100644
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/api',
-  version: '5.3.6',
+  version: '5.3.7',
   description: 'Type-safe API client for Cloudly and the serve.zone control plane.'
 }
diff --git a/ts/classes.cloudlyapiclient.ts b/ts/classes.cloudlyapiclient.ts
index 6d87ec6..8017490 100644
--- a/ts/classes.cloudlyapiclient.ts
+++ b/ts/classes.cloudlyapiclient.ts
@@ -125,7 +125,7 @@ export class CloudlyApiClient {
    */
   public async getClusterConfigFromCloudlyByIdentity(
     identityArg: plugins.servezoneInterfaces.data.IIdentity = this.identity
-  ): Promise<plugins.servezoneInterfaces.data.ICluster> {
+  ): Promise<plugins.servezoneInterfaces.requests.config.IRequest_Any_Cloudly_GetClusterConfig['response']> {
     const clusterConfigRequest =
       this.typedsocketClient.createTypedRequest<plugins.servezoneInterfaces.requests.config.IRequest_Any_Cloudly_GetClusterConfig>(
         'getClusterConfig'
@@ -133,7 +133,7 @@ export class CloudlyApiClient {
     const response = await clusterConfigRequest.fire({
       identity: identityArg,
     });
-    return response.configData;
+    return response;
   }
 
   /**
@@ -170,7 +170,7 @@ export class CloudlyApiClient {
         'getCertificateForDomain'
       );
     const typedResponse = await typedCertificateRequest.fire({
-      identity: this.identity, // do proper auth here
+      identity: optionsArg.identity,
       domainName: optionsArg.domainName,
       type: optionsArg.type,
     });
diff --git a/ts/classes.cluster.ts b/ts/classes.cluster.ts
index d60e145..0fbf9cb 100644
--- a/ts/classes.cluster.ts
+++ b/ts/classes.cluster.ts
@@ -61,8 +61,9 @@ export class Cluster implements plugins.servezoneInterfaces.data.ICluster {
     );
     const response = await updateClusterTR.fire({
       identity: this.cloudlyClientRef.identity,
+      clusterId: this.id,
       clusterData: this.data,
-    });
+    } as any);
 
     const resultClusterData = response.resultCluster.data;
     plugins.smartexpect.expect(resultClusterData).toEqual(this.data);
diff --git a/ts/classes.image.ts b/ts/classes.image.ts
index c134531..d8a717e 100644
--- a/ts/classes.image.ts
+++ b/ts/classes.image.ts
@@ -86,9 +86,12 @@ export class Image implements plugins.servezoneInterfaces.data.IImage {
     const response = await pushImageTR.fire({
       identity: this.cloudlyClientRef.identity,
       imageId: this.id,
-      versionString: '',
+      versionString: imageVersion,
       imageStream: virtualStream,
     });
+    if (!response.allowed) {
+      throw new Error(`Cloudly rejected image push for ${this.id}:${imageVersion}`);
+    }
     await virtualStream.readFromWebstream(imageReadableArg);
     await this.update();
   };