diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6faacb8..aa2097f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.6] - 2026-10-26
+
 ### Security
 
 - **`zod` moves to 4.6.7**, closing CVE-2023-54404 (denial of service through validation of an unbounded array). Every request body the gateway accepts, including the MCP and OAuth endpoints, is validated with zod, so this was reachable.
diff --git a/apps/gateway/package.json b/apps/gateway/package.json
index b592884..f193213 100644
--- a/apps/gateway/package.json
+++ b/apps/gateway/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@junctio/gateway",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "private": true,
   "type": "module",
   "license": "MIT",
diff --git a/bun.lock b/bun.lock
index 91c5559..e367865 100644
--- a/bun.lock
+++ b/bun.lock
@@ -11,7 +11,7 @@
     },
     "apps/gateway": {
       "name": "@junctio/gateway",
-      "version": "0.2.5",
+      "version": "0.2.6",
       "bin": {
         "junctio": "./src/cli/index.ts",
       },
diff --git a/package.json b/package.json
index b3ce80b..3987047 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "junctio",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "private": true,
   "type": "module",
   "license": "MIT",