diff --git a/CHANGELOG.md b/CHANGELOG.md
index d06b07c4..7f62517c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [1.21.6] - 2026-10-21
+
+### Release notes
+
+- **SQL schema statements use `tinycloud.sql/schema`.** `CREATE`, `ALTER` and `DROP` of tables, views and indexes are run with a schema-conferring ability (`sql/schema`, `sql/admin` or `sql/*`); `tinycloud.sql/write` covers data statements (`INSERT`, `UPDATE`, `DELETE`, `SELECT`). Clients that hold both `write` and `schema`, as the SDK does for `execute({ schema })` and for migrations (since 2.5.0), work as before. The setting `[global.storage.sql] ddl_requires_schema` takes `enforce` (the default), `log` or `off`. Details: TC-1581.
+- **Statements with an `INSERT` or `UPDATE` inside a `WITH`** are write statements: they are quota-gated, publish write events and are persisted. Details: TC-1585.
+- **`sql/admin` PRAGMAs** are an allow-list (schema reports, `user_version`, `application_id`, the check pragmas and read-only reports), and the connection returns to its opening state after a request that ran one. Details: TC-1586.
+- **Authorization graph in one SQL round trip** on PostgreSQL, SQLite and MySQL; authorization decisions are unchanged. Details: TC-735.
+- No database migrations. Rollback is the 1.21.5 image, with no database step.
+
 ### Changes
 
 - Load each invocation's authorization graph in one SQL round trip on PostgreSQL, SQLite and MySQL rather than four. Revocations in that statement resolve through the persisted CID-alias index exactly like `revocation::effective_rows`, so a delegation revoked under another accepted encoding is still refused (TC-1071). Bound metadata lookups to 65 nodes for indexed access on large tables while the unchanged 64-node authorization limit still denies oversized chains. Sort abilities by `(resource, ability)` on every backend; authorization decisions are unchanged, but the diagnostic reason when multiple caveats all reject may normalize. No schema change (TC-735).
diff --git a/Cargo.lock b/Cargo.lock
index 4a91dd43..cc5c798e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9931,7 +9931,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.21.5"
+version = "1.21.6"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index f4dade64..f914258f 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8017,7 +8017,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.21.5"
+version = "1.21.6"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/w5-policy-runtime-node-e2e/Cargo.lock b/test/w5-policy-runtime-node-e2e/Cargo.lock
index a4b92c73..1f4098e9 100644
--- a/test/w5-policy-runtime-node-e2e/Cargo.lock
+++ b/test/w5-policy-runtime-node-e2e/Cargo.lock
@@ -8465,7 +8465,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.21.5"
+version = "1.21.6"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index 9db398dd..e9cb7897 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.21.5"
+version = "1.21.6"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"