diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41788096..24aa8495 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [1.21.3] - 2026-10-19
+
+### Release notes
+
+- Batch reads are cheaper: a read invocation of several `kv/get` or `kv/metadata` capabilities (the SDK's `batchGet` and `batchHead`) now costs 22 database round trips for a 100-key batch instead of 216, with the same responses and the same read-audit record (TC-1274, #375).
+- Index: one migration, `m20261020_000000_current_kv_key_c_index` (TC-1274, #374). It is performance-only. The node boots and serves without the index; until it is built the node logs the warning `current_kv_c_index_missing` and KV list requests are slower. It is built by an operator after the PS-10 resize (the exact SQL is in `docs/releasing.md`), and it is never built during startup on a non-empty table.
+- Stats route (TC-1482, #370, #371, #372): `GET /admin/stats` is disabled (`404`) until `NODE_STATS_READ_TOKEN` (at least 32 bytes) is set. Never delete or blank the `PROD_TINYCLOUD_NODE_STATS_READ_TOKEN` secret once the name is in the CVM's `allowed_envs`: a later deploy without it fails before any change, and that includes rollbacks. The first deploy that adds the token restarts the CVM twice.
+- The SQL/DuckDB legacy-artifact fence scan is reused for 60 s instead of 1 s. The durable fence stays off: turning it on answers every SQL and DuckDB request with `503`.
+- **Rollback:** the same-digest rollback is unaffected. Rolling back to an image below 1.21.3 needs `DELETE FROM seaql_migrations WHERE version = 'm20261020_000000_current_kv_key_c_index';` first, because a node refuses to start with a recorded migration it does not ship.
+
 ### Changes
 
 - `/admin/stats` is a logged route label (TC-1482). The log shipper and the ingress log it as the route template plus status only, with no query string, `Authorization` header, request or response body, or client address (TC-961).
diff --git a/Cargo.lock b/Cargo.lock
index 29d59d23..f7d82e83 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9678,7 +9678,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.21.2"
+version = "1.21.3"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index 15880a2c..a59daf0c 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -7771,7 +7771,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.21.2"
+version = "1.21.3"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index d037e02e..93246ce3 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.21.2"
+version = "1.21.3"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"