diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ea684a..6b170ee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,19 @@
 # changelog
 
-## unreleased
+## 0.3.30
+
+Every phase of an HTTP fetch is now bounded. The 2026-08-13 zlay authority
+stall showed that StallGuard only guards the response body: a peer that
+accepts a connection and never answers held callers in receiveHead
+indefinitely, and a wedged connect rode the kernel's ~2min SYN timeout.
+
+- **feat**: `HttpTransport.head_deadline_ns` (default 10s, 0 disables)
+  bounds connect, TLS, request send, and the wait for the response head,
+  surfacing `error.ResponseHeadTimeout`. StallGuard remains the trickle
+  guard for unbounded-size bodies. Mirrors indigo's identity client, which
+  deadlines every phase.
+- **fix**: `default_user_agent` names the released version again (was
+  frozen at 0.3.22).
 
 `zat.ArchiveBackfill` works against post-proposal-0015 jetstream archives —
 including Bluesky's token-gated hosted instances (Jetstream v2 launched
diff --git a/build.zig.zon b/build.zig.zon
index 01cb27f..505b818 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .zat,
-    .version = "0.3.29",
+    .version = "0.3.30",
     .fingerprint = 0x8da9db57ee82fbe4,
     .minimum_zig_version = "0.16.0-dev.3070+b22eb176b",
     .dependencies = .{
diff --git a/src/internal/xrpc/transport.zig b/src/internal/xrpc/transport.zig
index d2380fb..d40a820 100644
--- a/src/internal/xrpc/transport.zig
+++ b/src/internal/xrpc/transport.zig
@@ -11,7 +11,7 @@ const std = @import("std");
 /// scale should say what it is: operators seeing unexplained load have no way
 /// to ask about it otherwise, and every other atproto client on the network
 /// identifies itself.
-pub const default_user_agent = "zat/0.3.22 (+https://tangled.org/zat.dev/zat)";
+pub const default_user_agent = "zat/0.3.30 (+https://tangled.org/zat.dev/zat)";
 
 pub const HttpTransport = struct {
     allocator: std.mem.Allocator,