diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b4d9fa..118a0b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,36 @@
 # Changelog
 
+## [0.2.0](https://github.com/nullplatform/scopes-lambda/compare/v0.1.0...v0.2.0) (2026-07-31)
+
+
+### Features
+
+* add dynamic assume role support via scope-configurations provider ([085964a](https://github.com/nullplatform/scopes-lambda/commit/085964ac38c51559cf583e68469cc20c750d4962))
+* add requirements module with IAM policies for Lambda scope operations ([d9ff61b](https://github.com/nullplatform/scopes-lambda/commit/d9ff61bbf712c2c39ea3479338aef5bf1afb88c7))
+* **assume-role:** resolve role ARN from nullplatform IAM provider by selector ([779eef9](https://github.com/nullplatform/scopes-lambda/commit/779eef99afc7b328103b3b3b665c10b64d2efe97))
+* dynamic assume-role support, configurable placeholder image & install tofu consolidation ([847e5fd](https://github.com/nullplatform/scopes-lambda/commit/847e5fd85650dedeac5b2db07caa9dc83117527b))
+* **iam:** make Lambda execution-role prefix configurable ([23e2515](https://github.com/nullplatform/scopes-lambda/commit/23e25154a706e45f6101b23ff5561f7555e97123))
+* **lambda:** optional public ALB in requirements module ([#30](https://github.com/nullplatform/scopes-lambda/issues/30)) ([fae610e](https://github.com/nullplatform/scopes-lambda/commit/fae610ebcd058165a093763775d99d9859ba1f76))
+* **lambda:** update ZIP runtime list and default to nodejs22.x ([#31](https://github.com/nullplatform/scopes-lambda/issues/31)) ([d5982f0](https://github.com/nullplatform/scopes-lambda/commit/d5982f0326b14c43c2ad87119be441415a83c371))
+* **placeholder:** make placeholder image configurable via PLACEHOLDER_IMAGE_URI_DEFAULT ([bd26af4](https://github.com/nullplatform/scopes-lambda/commit/bd26af424b97875ca50fbc16da8a0d06753f3ce6))
+* **workflows:** assume IAM role via dedicated first step in every workflow ([5109c0e](https://github.com/nullplatform/scopes-lambda/commit/5109c0ef721f5128580bc8ba545658cb380e3fa8))
+
+
+### Bug Fixes
+
+* correct nullplatform provider version constraint in specs/tofu ([d49d2b9](https://github.com/nullplatform/scopes-lambda/commit/d49d2b983a2db8bd980a92173a2fd865316ee6a1))
+* **deploy:** add missing diagnose.yaml workflow for diagnose-deployment action ([c04e9cc](https://github.com/nullplatform/scopes-lambda/commit/c04e9cc67aaa1f4de47fda2630417d7f51cb87db))
+* **deploy:** ensure Lambda pull policy on the image's ECR repo before update ([2dc0a3e](https://github.com/nullplatform/scopes-lambda/commit/2dc0a3ef0836d525000998870cf106682ad01784))
+* **iam:** add modern CloudWatch Logs tagging actions to lambda requirements policy ([b9e41d3](https://github.com/nullplatform/scopes-lambda/commit/b9e41d3bfdde1586a6f89cbb61e3b76b8a203ac2))
+* **iam:** prefix lambda execution role with np-lambda- to match requirements policy ([97121e4](https://github.com/nullplatform/scopes-lambda/commit/97121e48ce48a57544fab74f987c213e2b61a1e3))
+* read TOFU_STATE_BUCKET from .provider.aws_state_bucket as fallback ([3f89288](https://github.com/nullplatform/scopes-lambda/commit/3f89288f8b0246beb6011658249c6ef65e904d2a))
+* remove automatic arch suffix from placeholder image URI ([fc8bc76](https://github.com/nullplatform/scopes-lambda/commit/fc8bc760f83316b69a07fb2eb3c32feb91da02c5))
+* **specs/tofu:** bump aws provider constraint to ~> 6.47.0 ([6752bee](https://github.com/nullplatform/scopes-lambda/commit/6752beefd4ebc313c936efd46c8d3e027b4022fe))
+* **specs:** derive asset_type from deployment_type ([fa34054](https://github.com/nullplatform/scopes-lambda/commit/fa34054828af58dd6e6e0ba4bbd41628b8f5ca71))
+* surface sts:AssumeRole errors to stdout for visibility in NP logs ([33842ec](https://github.com/nullplatform/scopes-lambda/commit/33842ec3194eee25162bddc5669cd0035a18bcd7))
+* **tofu:** surface tofu apply stderr to stdout for visibility in NP logs ([684d9f7](https://github.com/nullplatform/scopes-lambda/commit/684d9f7fd5aab98a2686e55901fa62b27db9a9a1))
+* use exact PLACEHOLDER_IMAGE_URI when explicitly set, skip arch suffix ([14d3ad5](https://github.com/nullplatform/scopes-lambda/commit/14d3ad54b4ee082c44037b4b1f746f0b45c35705))
+
 ## [0.1.0](https://github.com/nullplatform/scopes-lambda/compare/0.0.1...v0.1.0) (2026-07-31)