diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04a02e5..4d509a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.12] - 2026-09-06
+
+### Fixed
+
+- Config: an atomic save creates its temp file 0600 with a unique name and
+  carries the existing mode over the rename, so a config holding
+  `server-token` no longer widens to the umask default. A key shadowed by a
+  trailing `config-file` include is appended after the include (scalar keys
+  only, so repeatable keys such as `font-family` and `keybind` do not
+  accumulate stale entries), and the watcher tracks transitive includes,
+  re-deriving the list even when a reload fails (#73, #74).
+- Sixel: geometric canvas growth for column-at-a-time streams; DEC HLS hue 0
+  is blue; P2 0/2 fills with the terminal background, 1 is transparent.
+  Kitty: `d=n/N` honors `p=`, and uppercase delete frees images that were
+  transmitted but never placed (#73).
+- IPC: the absolute hello deadline stays enforced at the stream level after
+  the WebSocket handshake. Token provisioning publishes via temp file +
+  `hard_link` so concurrent first-run servers converge on one token, and a
+  stale staging file from a reused PID no longer blocks it (#73, #74).
+- Paste: bracketed-frame bytes are excluded from the 8 MiB cap so a capped
+  AppleScript/`sendText` payload is not rejected by the pty budget (#73).
+- Grid keeps only tracked DEC modes in the mode set; session restore caps
+  the file at 16 MiB / 128 JSON levels so a corrupt file fails as "no
+  session" instead of overflowing the stack; `open` children for URIs are
+  reaped on a detached thread (#74).
+
 ## [0.2.11] - 2026-09-06
 
 ### Changed
diff --git a/Cargo.lock b/Cargo.lock
index 202c661..f25d8ac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -773,7 +773,7 @@ checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
 [[package]]
 name = "drain-staircase"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "crossbeam-channel",
  "libc",
@@ -1614,7 +1614,7 @@ dependencies = [
 
 [[package]]
 name = "noa"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "anyhow",
  "clap",
@@ -1625,7 +1625,7 @@ dependencies = [
 
 [[package]]
 name = "noa-app"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -1664,7 +1664,7 @@ dependencies = [
 
 [[package]]
 name = "noa-config"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "anyhow",
  "dirs",
@@ -1673,14 +1673,14 @@ dependencies = [
 
 [[package]]
 name = "noa-core"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "bitflags 2.13.0",
 ]
 
 [[package]]
 name = "noa-font"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "core-foundation 0.9.4",
  "core-text",
@@ -1697,7 +1697,7 @@ dependencies = [
 
 [[package]]
 name = "noa-grid"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "bitflags 2.13.0",
  "flate2",
@@ -1711,7 +1711,7 @@ dependencies = [
 
 [[package]]
 name = "noa-ipc"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "crossbeam-channel",
  "libc",
@@ -1726,7 +1726,7 @@ dependencies = [
 
 [[package]]
 name = "noa-parity"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "noa-core",
  "noa-grid",
@@ -1735,7 +1735,7 @@ dependencies = [
 
 [[package]]
 name = "noa-pty"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "crossbeam-channel",
  "libc",
@@ -1748,7 +1748,7 @@ dependencies = [
 
 [[package]]
 name = "noa-render"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "anyhow",
  "bytemuck",
@@ -1765,14 +1765,14 @@ dependencies = [
 
 [[package]]
 name = "noa-theme"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "noa-core",
 ]
 
 [[package]]
 name = "noa-vt"
-version = "0.2.11"
+version = "0.2.12"
 dependencies = [
  "noa-core",
  "simdutf8",
diff --git a/Cargo.toml b/Cargo.toml
index e8bd4ec..7e8afeb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ codegen-units = 1
 
 [workspace.package]
 edition = "2024"
-version = "0.2.11"
+version = "0.2.12"
 license = "MIT"
 repository = "https://github.com/simota/Noa"
 
diff --git a/Casks/noa.rb b/Casks/noa.rb
index bc9c03b..fbc533f 100644
--- a/Casks/noa.rb
+++ b/Casks/noa.rb
@@ -1,5 +1,5 @@
 cask "noa" do
-  version "0.2.11"
+  version "0.2.12"
   sha256 :no_check
 
   url "https://github.com/simota/Noa/releases/download/v#{version}/Noa-#{version}-macos-arm64.zip"