diff --git a/CHANGELOG.md b/CHANGELOG.md
index f87996a..a9525a6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,31 @@ All notable changes to GraQle are documented in this file.
 
 ---
 
+## 0.81.0 (2026-07-26) — [Enterprise: secrets providers + gateway backend]
+
+> First two P0 requirements of the Enterprise Enhancement Program (CR-010). Both are additive and
+> backward-compatible — existing configs and credential handling are unchanged.
+
+### Enterprise (CR-010 Enterprise Enhancement Program)
+
+- **Secrets provider abstraction (R5)** — new `secrets:` config resolution supporting
+  `env | file | keychain | command` providers via `graqle.config.secrets.resolve_secret`. The `file`
+  provider natively reads `$SECRETS_PATH/<name>`-style mounted secret stores, so moving from a developer
+  laptop (keychain) to a hosted environment (mounted file) is a one-line config change. Resolved values
+  are wrapped in `SecretStr` (never logged, printed, or embedded in errors); resolution is fail-closed
+  (a present-but-empty mounted secret file raises rather than silently returning empty). Behind
+  `GRAQLE_USE_SECRETS_RESOLVER` (default off) — no change to existing environment-variable behaviour.
+- **Enterprise-gateway LLM backend (R4)** — new `GatewayBackend` for any corporate OpenAI-compatible
+  gateway: an `organization` header, custom RPC `extra_headers` (the `Authorization` header is reserved
+  and cannot be overridden by config), a localhost sidecar `base_url`, a client-side `model_allowlist`
+  (disallowed models are refused before any network call), and an `on_auth_error` hook that on a 401
+  refreshes the token once via the R5 `command` provider and retries exactly once. `CustomBackend` gains
+  extracted `_build_headers()` / `_build_payload()` (behaviour unchanged for existing callers). New
+  `graqle.backends.providers.create_gateway_backend()` factory for the
+  `backend: {type: openai-compatible, ...}` config stanza.
+
+---
+
 ## 0.80.0 (2026-07-18) — [Plugin bundles + node-limit visibility (warn-only)]
 
 > Distribution: repo-scoped plugin bundles for Claude Code
diff --git a/graqle/__version__.py b/graqle/__version__.py
index 5663a42..17c1d6a 100644
--- a/graqle/__version__.py
+++ b/graqle/__version__.py
@@ -5,4 +5,4 @@
 # constraints: none
 # ── /graqle:intelligence ──
 
-__version__ = "0.80.0"
+__version__ = "0.81.0"
diff --git a/pyproject.toml b/pyproject.toml
index 44e8fad..3419b1f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -12,7 +12,7 @@ name = "graqle"
 # (first-to-finish/best-of-N) + CostAwareRouter (auto cost/latency selection) —
 # dual-provider autonomy. 0.77.0 = ADR-239 Stage 2
 # (CheckpointProtocol + run_tests). 0.76.0 = ADR-225 G1 multi-tenant memory.
-version = "0.80.0"
+version = "0.81.0"
 description = "Give your AI tools architecture-aware reasoning. Build a knowledge graph from any codebase — dependency analysis, impact analysis, governed AI answers with confidence scores. Works with Claude Code, Cursor, VS Code Copilot. 14 LLM backends, fully offline capable."
 readme = "README.md"
 license = {text = "Apache-2.0"}