diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1e079b..bba7a4e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,8 @@ the CBOM/report/eval schema versions, the database) can change in a minor releas
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-17
+
 ### Changed
 
 - **The remote TLS CBOM says how it knows each fact, and keeps every identifier it read**
@@ -749,7 +751,8 @@ the CBOM/report/eval schema versions, the database) can change in a minor releas
 - **Storage:** SQLite only. Up to 50 snapshots of up to 32 MiB are kept per machine; there is no overall storage
   budget yet.
 
-[Unreleased]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/offsetsecurity/cipherhorizon/releases/tag/v0.1.0
diff --git a/deploy/cipherhorizon.container b/deploy/cipherhorizon.container
index 6bfa62f..8736285 100644
--- a/deploy/cipherhorizon.container
+++ b/deploy/cipherhorizon.container
@@ -23,7 +23,7 @@ After=network-online.target
 
 [Container]
 ContainerName=cipherhorizon
-Image=ghcr.io/offsetsecurity/cipherhorizon:0.2.0
+Image=ghcr.io/offsetsecurity/cipherhorizon:0.3.0
 PublishPort=127.0.0.1:8080:8080
 Volume=cipherhorizon-data:/data
 # Another port: set it here and in PublishPort (the health check follows it), e.g.
diff --git a/docs/engineering/DISTRIBUTION.md b/docs/engineering/DISTRIBUTION.md
index 8e72703..79aa806 100644
--- a/docs/engineering/DISTRIBUTION.md
+++ b/docs/engineering/DISTRIBUTION.md
@@ -92,7 +92,7 @@ tar -xzf cipherhorizon_0.1.0_linux_amd64.tar.gz
 docker run -d --name cipherhorizon -p 8080:8080 \
   -e CIPHERHORIZON_TOKEN="$(openssl rand -hex 24)" \
   -v cipherhorizon-data:/data \
-  ghcr.io/offsetsecurity/cipherhorizon:0.2.0
+  ghcr.io/offsetsecurity/cipherhorizon:0.3.0
 
 # container, built locally (docker-compose.yml at the repository root)
 echo "CIPHERHORIZON_TOKEN=$(openssl rand -hex 24)" > .env
@@ -136,10 +136,10 @@ gh attestation verify cipherhorizon_0.1.0_linux_amd64.tar.gz --repo offsetsecuri
 
 **Container image:**
 ```sh
-cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.2.0 \
+cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.3.0 \
   --certificate-identity-regexp '^https://github.com/offsetsecurity/cipherhorizon/\.github/workflows/release\.yml@refs/tags/v' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
-gh attestation verify oci://ghcr.io/offsetsecurity/cipherhorizon:0.2.0 --repo offsetsecurity/cipherhorizon
+gh attestation verify oci://ghcr.io/offsetsecurity/cipherhorizon:0.3.0 --repo offsetsecurity/cipherhorizon
 ```
 
 Air-gapped users: the archives are self-contained, so download on a connected machine, verify there, and move
diff --git a/docs/engineering/INSTALL.md b/docs/engineering/INSTALL.md
index ae47777..258cb40 100644
--- a/docs/engineering/INSTALL.md
+++ b/docs/engineering/INSTALL.md
@@ -120,7 +120,7 @@ header lists the commands). The log goes to `~/Library/Logs/CipherHorizon/cipher
 ```sh
 docker run -d --name cipherhorizon --restart unless-stopped \
   -p 127.0.0.1:8080:8080 -v cipherhorizon-data:/data \
-  ghcr.io/offsetsecurity/cipherhorizon:0.2.0
+  ghcr.io/offsetsecurity/cipherhorizon:0.3.0
 ```
 
 Or, from a checkout, `docker compose up -d` ([docker-compose.yml](../../docker-compose.yml): read-only