diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7ccee789..53df7c79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ so anything that changes the schema irreversibly is called out explicitly.
 The published image tags: `latest` follows the most recent release below,
 `main` follows the tip of the default branch, and `sha-…` pins one commit.
 
-## Unreleased
+## v0.3.5 — 2026-10-13
 
 **Browsers and password managers kept offering your logins in client-secret fields.** Opening
 Admin → SSO, or a Google, Microsoft or integration provider form, could put your mail address in the
diff --git a/README.md b/README.md
index c74a785e..57ea20ce 100644
--- a/README.md
+++ b/README.md
@@ -78,8 +78,9 @@ provider doesn't.
 - **And when there is something newer** — follow releases or the main branch, and the
   administrators hear about each new build once: on their devices and at the top of the admin area,
   with what changed since the one they run.
-- **Yours** — two-factor auth, per-app JMAP passwords, 41 themes, ten icons for the tab and the
-  phone's home screen, English, German and Pirate.
+- **Yours** — two-factor auth, sign-in through Authentik, Keycloak or any other OpenID Connect
+  provider, per-app JMAP passwords, 41 themes, ten icons for the tab and the phone's home screen,
+  English, German and Pirate.
 
 ## A look around