diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de232d1..b1d216c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # the changelog needs history back to the previous tag
       - uses: actions/setup-go@v5
         with:
           go-version: "1.25"
diff --git a/.github/workflows/sign-release.yml b/.github/workflows/sign-release.yml
new file mode 100644
index 0000000..29d938c
--- /dev/null
+++ b/.github/workflows/sign-release.yml
@@ -0,0 +1,36 @@
+name: Sign release
+
+# Re-sign an existing release's checksums.txt (keyless, GitHub OIDC) and
+# upload the signature and its certificate — for releases published
+# without the certificate (v0.3.0) or whose signature needs replacing.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "release tag, e.g. v0.3.0"
+        required: true
+
+permissions:
+  contents: write
+  id-token: write   # cosign keyless
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: sigstore/cosign-installer@v3
+      - name: sign checksums.txt
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          gh release download "$TAG" -R "$GITHUB_REPOSITORY" -p checksums.txt
+          cosign sign-blob --yes \
+            --output-signature checksums.txt.sig \
+            --output-certificate checksums.txt.pem \
+            checksums.txt
+          cosign verify-blob --signature checksums.txt.sig --certificate checksums.txt.pem \
+            --certificate-identity-regexp "github.com/${GITHUB_REPOSITORY}" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            checksums.txt
+          gh release upload "$TAG" -R "$GITHUB_REPOSITORY" checksums.txt.sig checksums.txt.pem --clobber
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 48d4720..aaf83ae 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -56,6 +56,9 @@ signs:
       - ${artifact}.pem
       - ${artifact}
     artifacts: checksum
+    # upload both: a keyless signature can't be verified without its certificate
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
     output: true
 
 release:
@@ -63,13 +66,15 @@ release:
   header: |
     ## cometcli v{{ .Version }}
 
-    An agentic SRE terminal for Cosmos-EVM validators — deterministic CLI,
-    live TUI, optional AI agent, fleet ops, runbooks, and alerting.
+    An agentic SRE terminal for Cosmos SDK and Cosmos-EVM validators — talk to
+    your machine and nodes the way you use Claude Code; incidents worked through
+    to the fix, every change and transaction approved by you.
 
-    Install:
-      curl -fsSL https://raw.githubusercontent.com/abhijitkrm/cometcli/main/scripts/install.sh | bash
+    ```bash
+    curl -fsSL https://raw.githubusercontent.com/abhijitkrm/cometcli/main/scripts/install.sh | bash
+    ```
 
-    Verify: docs/INSTALL.md (checksums + cosign keyless signature).
+    Verify: [docs/INSTALL.md](https://github.com/abhijitkrm/cometcli/blob/main/docs/INSTALL.md#verifying-release-signatures) (checksums + cosign keyless signature).
 
 changelog:
   use: git
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 7ff6316..c104853 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -14,7 +14,7 @@ Defaults and knobs:
 
 ```bash
 # pick a version (default: latest release)
-COMETCLI_VERSION=v0.1.0 bash install.sh
+COMETCLI_VERSION=v0.3.0 bash install.sh
 
 # custom binary directory (created if missing)
 COMETCLI_BIN_DIR=$HOME/bin bash install.sh
@@ -47,10 +47,10 @@ Grab the tarball for your platform from
 [Releases](https://github.com/abhijitkrm/cometcli/releases), verify, install:
 
 ```bash
-curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.1.0/cometcli_0.1.0_darwin_arm64.tar.gz
-curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.1.0/checksums.txt
+curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.3.0/cometcli_0.3.0_darwin_arm64.tar.gz
+curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.3.0/checksums.txt
 shasum -a 256 -c checksums.txt --ignore-missing   # or: sha256sum -c on Linux
-tar xzf cometcli_0.1.0_darwin_arm64.tar.gz cometcli
+tar xzf cometcli_0.3.0_darwin_arm64.tar.gz cometcli
 install cometcli /usr/local/bin/
 ```
 
@@ -61,13 +61,21 @@ Releases are signed with cosign (keyless, GitHub OIDC). With
 installed:
 
 ```bash
-curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.1.0/checksums.txt.sig
-cosign verify-blob --signature checksums.txt.sig \
+V=v0.3.0
+curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/$V/checksums.txt
+curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/$V/checksums.txt.sig
+curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/$V/checksums.txt.pem
+cosign verify-blob --signature checksums.txt.sig --certificate checksums.txt.pem \
   --certificate-identity-regexp 'github.com/abhijitkrm/cometcli' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   checksums.txt
 ```
 
+`Verified OK` means `checksums.txt` was signed by this repository's GitHub
+Actions; then `shasum -a 256 -c checksums.txt --ignore-missing` ties your
+archive to it. The certificate (`.pem`) ships from v0.3.0 on — releases before
+that have only the signature.
+
 Every release also ships a per-architecture SBOM (`*.sbom.json`, generated
 with syft).
 
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 49d5179..a5464cf 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -28,7 +28,9 @@ SBOMs, `checksums.txt`, and cosign keyless-signs the checksum.
 - [ ] Release notes read well — the grouped auto-changelog covers commits;
       hand-edit the body for highlights on notable releases
 - [ ] Release page shows 4 archives + `checksums.txt` + `checksums.txt.sig`
-      + 4 `*.sbom.json`
+      + `checksums.txt.pem` + 4 `*.sbom.json`
+- [ ] The changelog lists the commits since the previous tag (the release
+      workflow checks out full history for this)
 - [ ] `cosign verify-blob` passes (see docs/INSTALL.md)
 - [ ] `curl | bash` install of the new tag works on linux + macOS
 - [ ] `cometcli version` reports the tag
@@ -45,6 +47,13 @@ remove that block if you skip this step, or releases will fail.
 **Branch protection**: `main` requires `build-test` + `lint` green and
 rejects force-pushes/deletions (configured via GitHub API).
 
+## Re-signing a release
+
+If a release is missing `checksums.txt.pem` or its signature must be
+replaced, run the **Sign release** workflow (Actions → Sign release → tag).
+It signs the published `checksums.txt` keylessly, verifies the result and
+uploads `checksums.txt.sig` + `checksums.txt.pem`.
+
 ## If a release goes bad
 
 Do not delete the tag silently — publish a patch (`v0.X.1`) or mark the