diff --git a/CHANGELOG.md b/CHANGELOG.md
index 96461fc..be0bf6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # changelog
 
+## 0.2.17
+
+- **feat**: `Keypair.jwk()`, `Keypair.jwkThumbprint()`, `Keypair.uncompressedPublicKey()` — JWK export and RFC 7638 thumbprints for both P-256 and secp256k1
+- **feat**: `oauth` module — stateless PKCE, DPoP proofs, client assertions, form encoding, and related helpers for AT Protocol OAuth 2.0 flows
+- **feat**: `jwt.base64UrlEncode`, `jwt.base64UrlDecode` now public
+- **test**: interop tests for did:key derivation and data model fixtures
+
 ## 0.2.16
 
 - **fix**: bump websocket.zig to `395d0f4` — reads full HTTP body on TCP split writes (fixes empty body when headers and body arrive in separate TCP segments)
diff --git a/build.zig.zon b/build.zig.zon
index f79892d..00f6179 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .zat,
-    .version = "0.2.16",
+    .version = "0.2.17",
     .fingerprint = 0x8da9db57ee82fbe4,
     .minimum_zig_version = "0.15.0",
     .dependencies = .{