diff --git a/CHANGELOG_macOS_IntuneToolkit.md b/CHANGELOG_macOS_IntuneToolkit.md
index 5470498..9a3273a 100644
--- a/CHANGELOG_macOS_IntuneToolkit.md
+++ b/CHANGELOG_macOS_IntuneToolkit.md
@@ -1,5 +1,11 @@
 # macOS Intune Toolkit Changelog
 
+## 2026-08-07 — v4.4.1 — Reorder TUI menu into logical groups
+
+### Changed
+- **`Start-IntuneToolkit.ps1`**
+  - Menu had grown by prepending each new feature to the top, so items ended up in reverse-add order with no relation between neighbors. Reordered into groups — Export/Import, Bulk operations, Baselines & compliance, Reporting, Tenant & auth admin — with Exit last. Item numbers (used for dispatch) are unchanged, only display order moved, so no other script or doc references needed updating.
+
 ## 2026-08-07 — v4.4.0 — Folder browser for Export/Import path prompts
 
 ### Added
diff --git a/README.md b/README.md
index 169d470..ce04198 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Cross-platform, headless Intune policy export/import with PowerShell.
 
-**Current version:** `4.4.0` — see [`CHANGELOG_macOS_IntuneToolkit.md`](CHANGELOG_macOS_IntuneToolkit.md) for recent changes.
+**Current version:** `4.4.1` — see [`CHANGELOG_macOS_IntuneToolkit.md`](CHANGELOG_macOS_IntuneToolkit.md) for recent changes.
 
 This repository is now CLI-first. The old WPF application surface has been removed from the repo. The supported workflow is:
 
diff --git a/Start-IntuneToolkit.ps1 b/Start-IntuneToolkit.ps1
index 1ce5053..c9b71e1 100644
--- a/Start-IntuneToolkit.ps1
+++ b/Start-IntuneToolkit.ps1
@@ -308,27 +308,32 @@ $commonParams = @{
 }
 
 $menuItems = @(
-    "21. Bulk delete policies"
-    "20. Export Entra role membership"
-    "19. Document Conditional Access policies"
-    "18. Rotate app secret"
-    "17. Deploy CIS M365 baseline"
-    "16. Generate reports"
-    "15. Delete tenant auth and app registration"
-    "14. Delete local tenant auth only"
-    "13. Refresh tenant names"
-    "12. Initialize auth (one-time setup)"
-    "11. Deploy baseline (dry-run / WhatIf)"
-    "10. Deploy baseline"
-    "9.  Bulk device operations"
-    "8.  Bulk rename policies"
-    "7.  Export assignments to CSV/Markdown"
-    "6.  Restore assignments"
-    "5.  Backup assignments"
-    "4.  Bulk assignment manager (policies)"
-    "3.  Bulk app assignment"
-    "2.  Import policies"
+    # Export / Import
     "1.  Export policies"
+    "2.  Import policies"
+    "7.  Export assignments to CSV/Markdown"
+    "5.  Backup assignments"
+    "6.  Restore assignments"
+    # Bulk operations
+    "3.  Bulk app assignment"
+    "4.  Bulk assignment manager (policies)"
+    "8.  Bulk rename policies"
+    "21. Bulk delete policies"
+    "9.  Bulk device operations"
+    # Baselines & compliance
+    "10. Deploy baseline"
+    "11. Deploy baseline (dry-run / WhatIf)"
+    "17. Deploy CIS M365 baseline"
+    "19. Document Conditional Access policies"
+    # Reporting
+    "16. Generate reports"
+    "20. Export Entra role membership"
+    # Tenant & auth admin
+    "12. Initialize auth (one-time setup)"
+    "13. Refresh tenant names"
+    "18. Rotate app secret"
+    "14. Delete local tenant auth only"
+    "15. Delete tenant auth and app registration"
     "0.  Exit"
 )
 
diff --git a/VERSION b/VERSION
index fdc6698..cca25a9 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-4.4.0
+4.4.1