diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9054e30..ba14885 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/KarpelesLab/httpsd/compare/v0.1.1...v0.2.0) - 2026-07-12
+
+### Fixed
+
+- *(h3)* enforce max field-section size and harden frame-length cast
+- *(quic)* anchor loss-recovery timers to connection construction
+
+### Other
+
+- use ? instead of match in find_subslice (newer clippy)
+- drop needless borrow in reload test helper
+- SIGHUP reloads static certs + works in config mode
+- thread ReloadableAcceptor through the static-TLS path
+- add ReloadableAcceptor for hot cert reload
+- reset accepted sockets to blocking for Windows portability
+- signal-driven graceful shutdown + SIGHUP cert reload
+- add AcmeManager::reload() to clear cached certs
+- Shutdown primitive + graceful drain across runtimes
+- expose max_conns_per_ip (F6)
+- thread the per-IP limiter through the TCP runtimes (F6)
+- add per-IP concurrent-connection limiter (F6)
+- close TOCTOU/symlink-escape with race-free confined open
+- silence dead_code for still_root_after_drop on non-unix
+- harden connection engine against five HTTP/2 DoS findings
+- add MIN_PROGRESS slow-trickle floor to serve loop
+- fix accept-backoff loop freeze and EINTR shutdown
+- verify gid drop and fail when still root [MED]
+- route on percent-decoded path, reject encoded separators [HIGH]
+- require https:// for the ACME directory URL
+- authoritative host validation at ACME entry points
+- create key temp file with O_EXCL + target mode (no world-readable race)
+- fix percent-decode trailing triplet, canonicalize root once, 404 on symlink escape
+- fix three request-parsing security findings
+- Stop tracking .claude/ (accidentally committed Claude memory)
+- add a default host for SNI-less connections
+- parse the leaf cert for expiry, not the whole chain
+
 ## [0.1.1](https://github.com/KarpelesLab/httpsd/compare/v0.1.0...v0.1.1) - 2026-06-30
 
 ### Fixed
diff --git a/Cargo.lock b/Cargo.lock
index b20bcf1..1198612 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -68,7 +68,7 @@ dependencies = [
 
 [[package]]
 name = "httpsd"
-version = "0.1.1"
+version = "0.2.0"
 dependencies = [
  "compcol 0.6.5",
  "http",
diff --git a/Cargo.toml b/Cargo.toml
index 1395c93..e7bf1e7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "httpsd"
-version = "0.1.1"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.88"
 description = "A pure-Rust HTTP/HTTPS server — usable as a sans-I/O library with pluggable runtimes (thread pool, tokio, mio) or as a CLI that serves a directory or a TOML config."