diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5fa630c..d680fe2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.28](https://github.com/encryption4all/cryptify/compare/v0.1.27...v0.1.28) - 2026-07-17
+
+### Added
+
+- configurable email attribute type for the finalize sender check ([#193](https://github.com/encryption4all/cryptify/pull/193))
+- *(metrics)* require a bearer token on /metrics when configured ([#177](https://github.com/encryption4all/cryptify/pull/177))
+- persist rolling-quota usage to SQLite (usage_db) ([#176](https://github.com/encryption4all/cryptify/pull/176))
+- add GET /email-template endpoint keyed on API key ([#175](https://github.com/encryption4all/cryptify/pull/175))
+- *(metrics)* capture X-POSTGUARD-CLIENT-VERSION client identity ([#174](https://github.com/encryption4all/cryptify/pull/174))
+- *(email)* remove circle around signer-verified checkmark ([#173](https://github.com/encryption4all/cryptify/pull/173))
+- *(email)* replace unicode checkmark with inline PNG image ([#172](https://github.com/encryption4all/cryptify/pull/172))
+- *(email)* staging-only /staging/preview/<uuid> + shared render API ([#171](https://github.com/encryption4all/cryptify/pull/171))
+- *(metrics)* pre-seed known channels at zero on startup ([#165](https://github.com/encryption4all/cryptify/pull/165))
+- expose Prometheus /metrics endpoint for usage dashboards ([#102](https://github.com/encryption4all/cryptify/pull/102))
+
+### Fixed
+
+- retry the startup verifying-key fetch instead of panicking ([#192](https://github.com/encryption4all/cryptify/pull/192))
+- *(cors)* allow X-Cryptify-Source in browser preflights ([#189](https://github.com/encryption4all/cryptify/pull/189))
+- *(email)* larger, selectable download-link code block in recipient email ([#187](https://github.com/encryption4all/cryptify/pull/187))
+- return generic body from 5xx responses, log detail server-side ([#185](https://github.com/encryption4all/cryptify/pull/185))
+- require validated API key on GET /usage (GHSA-5rhx-xgvv-h78h) ([#183](https://github.com/encryption4all/cryptify/pull/183))
+- *(cors)* allow Office add-in origins (addin.postguard.eu + localhost:3000) and DELETE method ([#179](https://github.com/encryption4all/cryptify/pull/179))
+- *(email)* address postguard#197 deliverability + show disclosed signer name ([#170](https://github.com/encryption4all/cryptify/pull/170))
+
+### Other
+
+- extend CLAUDE.md with migrated agent notes ([#190](https://github.com/encryption4all/cryptify/pull/190))
+- update dependencies ([#181](https://github.com/encryption4all/cryptify/pull/181))
+- *(deps)* cargo update lockfile ([#168](https://github.com/encryption4all/cryptify/pull/168))
+- replace pkg_url with https://pkg.postguard.eu/ ([#178](https://github.com/encryption4all/cryptify/pull/178))
+- bump pg-core 0.6.0 → 0.6.1 ([#164](https://github.com/encryption4all/cryptify/pull/164))
+- add semantic PR title check workflow ([#162](https://github.com/encryption4all/cryptify/pull/162))
+
 ### Security
 
 - require a validated API key on `GET /usage` and reject unauthenticated callers with 401 (GHSA-5rhx-xgvv-h78h)
diff --git a/Cargo.lock b/Cargo.lock
index f6bab90..a5088a3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -455,7 +455,7 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "cryptify"
-version = "0.1.27"
+version = "0.1.28"
 dependencies = [
  "askama",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index b88039a..a1e6db7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cryptify"
-version = "0.1.27"
+version = "0.1.28"
 authors = ["David Venhoek <david@tweedegolf.com>"]
 edition = "2021"
 repository = "https://github.com/encryption4all/cryptify"