diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2f36c418..866c07c3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -21,7 +21,7 @@
 
 cmake_minimum_required(VERSION 3.16)
 
-project(wolfTPM VERSION 4.1.0 LANGUAGES C)
+project(wolfTPM VERSION 4.2.0 LANGUAGES C)
 
 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)
 set(WOLFTPM_DEFINITIONS)
diff --git a/ChangeLog.md b/ChangeLog.md
index aff23da6..3d7e8012 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,92 @@
 # Release Notes
 
+## wolfTPM Release 4.2.0 (Sep 11, 2026)
+
+**Summary**
+
+Feature and maintenance release centered on TCG TPM 2.0 v1.85 specification
+compliance in the firmware TPM (fwTPM), expanded post-quantum support, and new
+platform backends. Highlights: a broad set of fwTPM v1.85 compliance fixes
+(command attributes, PolicyAuthorize, context-blob authentication, NV
+authorization, ticket HMAC ordering), plus SPDM responder corrections;
+ML-DSA authentication for post-quantum TLS 1.3 and SealSQ QVault post-quantum
+TPM support; wolfHAL I2C/SPI backends and NVIDIA Jetson Orin OP-TEE fwTPM
+support; ST33 firmware-update corrections; transport and NV/hash performance
+improvements; and extensive security hardening (Fenrir, Coverity, negative
+tests).
+
+**Detail**
+
+* Firmware TPM (fwTPM) TCG v1.85 specification compliance
+  - Command-code masking and vendor-bit return-code fix (PR #556)
+  - Corrected auth-entry handling (PR #566)
+  - PolicyAuthorize compliance fixes and corrected response codes for the
+    keySign name ticket and approvedPolicy (PRs #567, #572)
+  - Authenticate object context blobs on ContextSave/ContextLoad (PR #568)
+  - Reject unsupported LoadExternal private types, fix creation-ticket HMAC
+    ordering, and validate ML-DSA / ML-KEM templates in LoadExternal and
+    CreateLoaded (PRs #573, #578)
+  - Validate NV space authorization and report the v1.85 revision (PR #575)
+  - Fix hierarchy and policy-authorization gaps and SPDM responder version
+    negotiation (PR #577)
+  - Correct command-attribute reporting and the verified-ticket HMAC algorithm
+    (PR #579)
+  - Additional TCG v1.85 fwTPM and SPDM compliance fixes (PR #584)
+* Post-quantum and TLS
+  - TPM-backed ML-DSA authentication for post-quantum TLS 1.3, with an example
+    and tests (PR #559)
+  - SealSQ QVault post-quantum TPM support (PR #570)
+  - ML-KEM credential activation and ML-DSA quotes in the fwTPM (PR #592)
+* New platform and HAL support
+  - wolfHAL I2C and SPI backends, enabled with `--enable-wolfhal` and an
+    application-supplied `board.h` (PR #562)
+  - NVIDIA Jetson Orin (Tegra234) OP-TEE firmware TPM, reached through the
+    Linux TPM kernel driver as `/dev/tpmrm0` (PR #576)
+  - Finer per-command-group gating macros in the fwTPM (PR #574)
+  - Caller-supplied policy authorization for firmware upgrade (PR #560)
+* ST33 firmware update
+  - Fix Generation 1 manifest size and refuse oversized commands (PR #583)
+  - Select ST33 field-upgrade commands from the TPM command set (PR #586)
+* Performance
+  - Reuse transport connections and reduce NV-write and hash-cache overhead
+    (PR #563)
+* Security hardening (Fenrir, Coverity, input validation)
+  - Harden the crypto callback, ASN.1 parsing, parameter encryption, and
+    marshalling, with negative tests (PR #551)
+  - Bound the TPM2 response decrypt-parameter size, zeroize primary-key auth,
+    and expand marshalling/import test coverage (PR #555)
+  - Guard a tainted PCR-select copy in the fwTPM properties path (PR #558)
+  - Fix a fwTPM response buffer overflow and an SPDM clear-frame command bypass
+    (PR #561)
+  - Harden wolfTPM2 PCR/hash wrapper validation (PR #554)
+  - Strengthen TPM input validation and memory handling (PR #565)
+  - Fix a wolfCrypt refcount race in P521 primary derivation and a policy-session
+    authorization bypass (PR #571)
+  - Harden PCR policy bounds checks (PR #581)
+  - Harden wolfTPM validation and data handling (PR #582)
+  - Harden fwTPM protocol handling and SPDM authentication (PR #588)
+  - Make fwTPM state changes transactional and harden PolicyPCR and
+    private-blob wrapping (PR #593)
+  - Additional Coverity fixes across the TPM bounds and configuration paths,
+    including bounded fwTPM child-blob copies, a guarded public-name buffer
+    allocation, and restricted unsealed-output file permissions
+    (PRs #591, #595, #603, #605)
+  - Harden fwTPM key derivation and command validation (PR #596)
+  - Fix TPM2 core key-import parsing and response handling and improve core
+    zeroization and robustness (PRs #597, #600)
+  - Harden error handling and secret zeroization in the examples, SPI transfer,
+    and SPDM version parsing (PRs #598, #599, #604)
+* Build fixes
+  - Fix AES_BLOCK_SIZE undeclared under OPENSSL_COEXIST wolfSSL (PR #552)
+  - Fix an edge-case build with TIS lock and no wolfCrypt (PR #564)
+  - Fix the --enable-pqc build with --disable-wolfcrypt (PR #606)
+  - Refresh the expired wolfSSL example CA certificates and add a refresh
+    script (PR #601)
+* Documentation and licensing
+  - Add contribution guidance (CONTRIBUTING.md) (PR #569)
+  - GPLv2 exception to the base GPLv3 license: wolfTPM combined with U-Boot
+    from Cisco Systems, Inc. may be licensed under GPLv2 (PR #557)
+
 ## wolfTPM Release 4.1.0 (Jul 10, 2026)
 
 **Summary**
diff --git a/configure.ac b/configure.ac
index 3095eb12..33a523d9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3,7 +3,7 @@
 # All right reserved.
 
 AC_COPYRIGHT([Copyright (C) 2014-2026 wolfSSL Inc.])
-AC_INIT([wolftpm],[4.1.0],[https://github.com/wolfssl/wolfTPM/issues],[wolftpm],[https://www.wolfssl.com])
+AC_INIT([wolftpm],[4.2.0],[https://github.com/wolfssl/wolfTPM/issues],[wolftpm],[https://www.wolfssl.com])
 
 AC_PREREQ([2.63])
 AC_CONFIG_AUX_DIR([build-aux])
@@ -29,7 +29,7 @@ AC_ARG_PROGRAM
 
 AC_CONFIG_HEADERS([src/config.h])
 
-WOLFTPM_LIBRARY_VERSION=18:0:0
+WOLFTPM_LIBRARY_VERSION=19:0:0
 #                        | | |
 #                 +------+ | +---+
 #                 |        |     |
diff --git a/wolftpm/version.h b/wolftpm/version.h
index 1c98ad36..65b972ad 100644
--- a/wolftpm/version.h
+++ b/wolftpm/version.h
@@ -34,8 +34,8 @@
 extern "C" {
 #endif
 
-#define LIBWOLFTPM_VERSION_STRING "4.1.0"
-#define LIBWOLFTPM_VERSION_HEX 0x04010000
+#define LIBWOLFTPM_VERSION_STRING "4.2.0"
+#define LIBWOLFTPM_VERSION_HEX 0x04002000
 
 #ifdef __cplusplus
 }