diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5307811..da10241 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to Nextless are documented here. The format follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html), and this project keeps one line per
 user-visible change rather than one per commit.
 
-## [Unreleased]
+## [0.3.1] - 2026-10-09
 
 ### Added
 - `nextless-get-models` now **verifies every archive before extracting it**
diff --git a/SECURITY.md b/SECURITY.md
index c165182..733d215 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -44,7 +44,7 @@ Use [GitHub Security Advisories](https://github.com/RevolutionLA/nextless/securi
 — private, and the right channel. Please do not open a public issue.
 
 I aim to reply within 7 days and ship a fix or a mitigation within 30. Reportedly affected
-versions: `0.3.0` and everything before it, including upstream `vinput`.
+versions: `0.3.1` and everything before it, including upstream `vinput`.
 
 Not valid on its own: an open port, a missing HTTP header, a dependency advisory without an
 exploitable path through this add-on, or "the cloud backend sends my audio to a cloud backend".
diff --git a/debian/changelog b/debian/changelog
index cc1e72e..ef9a4e9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,17 @@
+fcitx5-nextless (0.3.1-1) unstable; urgency=medium
+
+  * Bug-fix release, no new configuration surface:
+      - the capture sweep no longer deletes another session's in-flight WAV in
+        the shared $XDG_RUNTIME_DIR/nextless directory (ownership by pid).
+      - the local punctuator gives up after three consecutive failures instead
+        of costing every utterance the full timeout.
+      - nextless-get-models verifies every archive against a pinned sha256
+        before extracting, and requires the punctuation binary when
+        --punctuation is asked.
+      - install-deb.sh refuses to install an unverifiable .deb.
+
+ -- RevolutionLA <revolutionla@users.noreply.github.com>  Fri, 09 Oct 2026 20:20:00 +0800
+
 fcitx5-nextless (0.3.0-1) unstable; urgency=medium
 
   * Feature release: full add-on config panel (every tunable, apply-on-save,
diff --git a/docs/nextless.1 b/docs/nextless.1
index 97a9846..2cb323d 100644
--- a/docs/nextless.1
+++ b/docs/nextless.1
@@ -1,5 +1,5 @@
 .\" Man page for fcitx5-nextless
-.TH nextless 1 "2026-10-05" "0.2.0" "fcitx5-nextless"
+.TH nextless 1 "2026-10-09" "0.3.1" "fcitx5-nextless"
 .SH NAME
 fcitx5\-nextless \- push-to-talk voice input addon for fcitx5
 .SH SYNOPSIS
diff --git a/meson.build b/meson.build
index 0cc80f9..600ff4a 100644
--- a/meson.build
+++ b/meson.build
@@ -1,5 +1,5 @@
 project('fcitx5-nextless', 'cpp',
-  version: '0.3.0',
+  version: '0.3.1',
   default_options: ['cpp_std=c++20', 'warning_level=2', 'werror=true'])
 
 # warning_level=2 is -Wall -Wextra (plus -Werror); 3 would add -Wpedantic, and that one is not