diff --git a/.changeset/exact-audiences-authorize.md b/.changeset/exact-audiences-authorize.md
deleted file mode 100644
index 38d486b..0000000
--- a/.changeset/exact-audiences-authorize.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@atmo-dev/contrail": minor
----
-
-Correct service auth to use an exact fragmented DID service audience and deterministic least-privilege OAuth RPC scope. Discovery, provider locks, generated clients, and DID documents now distinguish the base service DID from the JWT audience and pin the protected method set. Existing consumers must reconnect, regenerate, and reauthorize; old plain-DID/wildcard OAuth grants are not compatible.
diff --git a/packages/contrail/CHANGELOG.md b/packages/contrail/CHANGELOG.md
index 1a89c1f..3dd7217 100644
--- a/packages/contrail/CHANGELOG.md
+++ b/packages/contrail/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @atmo-dev/contrail
 
+## 0.19.0
+
+### Minor Changes
+
+- 2e01ffe: Correct service auth to use an exact fragmented DID service audience and deterministic least-privilege OAuth RPC scope. Discovery, provider locks, generated clients, and DID documents now distinguish the base service DID from the JWT audience and pin the protected method set. Existing consumers must reconnect, regenerate, and reauthorize; old plain-DID/wildcard OAuth grants are not compatible.
+
 ## 0.18.0
 
 ### Minor Changes
diff --git a/packages/contrail/package.json b/packages/contrail/package.json
index d695f92..6392eba 100644
--- a/packages/contrail/package.json
+++ b/packages/contrail/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@atmo-dev/contrail",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Index AT Protocol records with typed XRPC endpoints. Cloudflare Workers + D1, SvelteKit, Node.js.",
   "type": "module",
   "sideEffects": false,