diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e18ee07..466df71 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.0.0"
+  ".": "0.1.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7fdc10f..246e156 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.0 (2026-11-13)
+
+
+### Features
+
+* **pve:** extract authorization foundation and align GitHub tooling ([e76d605](https://github.com/mikomiel/privilege-broker/commit/e76d6054b1b6980697fb5b6cf8c9418074c2c08b))
+* **pve:** extract authorization foundation and GitHub baseline ([db31577](https://github.com/mikomiel/privilege-broker/commit/db3157720f2148a78fce6d1c0f45a168037b44f1))
+* **pve:** extract WebAuthn approval service and notifications ([f6d85ca](https://github.com/mikomiel/privilege-broker/commit/f6d85ca00c35009dcd477518992f32d68a972288))
+* **pve:** extract WebAuthn approval service and notifications ([9c91ae7](https://github.com/mikomiel/privilege-broker/commit/9c91ae7e3202000ddd1f6c97bc61e180718f11b0))
+
+
+### Bug Fixes
+
+* **pve:** enforce fresh deadlines across locked state transitions ([41e59e0](https://github.com/mikomiel/privilege-broker/commit/41e59e0b52f0796d0986b7af92260947f7d64cd7))
+* **pve:** guard authority at the SQLite commit boundary ([9d28355](https://github.com/mikomiel/privilege-broker/commit/9d283558e3f26d7fce3f974c750c669c9198c767))
+* **pve:** keep approval data outside executable script context ([533ee21](https://github.com/mikomiel/privilege-broker/commit/533ee2148205b69e7d833fce02f9aae92546f057))
+* **pve:** revalidate certificate deadlines under the issuance lock ([672aeae](https://github.com/mikomiel/privilege-broker/commit/672aeaefc56d13d466db6619dad85119f25a4e99))
+
+## Changelog
+
 No product release has been published.
 
 Release-please will propose version and changelog changes in a release PR.
diff --git a/pyproject.toml b/pyproject.toml
index f51583e..10ba71d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "privilege-broker"
-version = "0.0.0"
+version = "0.1.0"
 description = "Human-approved typed operations for AI agents, with Proxmox VE as the first integration."
 requires-python = ">=3.11"
 license = "AGPL-3.0-only"