diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee05efa..dc301c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.3.0
+
+Run `canaryhook init --force` on an existing install to add the `PostToolUse` hook.
+
+### Added
+
+- A `PostToolUse` hook checks each tool's output for canary strings, so a sweep like `grep -r AKIA .` that reads a decoy without naming it is recorded and the agent is told the value is fake.
+- The hook trips on tampering: deleting or rewriting `.canaryhook/`, running `canaryhook clean`, removing the hook from the settings, or setting `disableAllHooks`. These are denied and recorded as `tamper`.
+- Shell globs that expand to a decoy, like `cat .env*` or `grep key *.bak`, trip the read path.
+
+### Fixed
+
+- The hook and every command except `init` find the project from a subdirectory. Before, an agent working in `src/` was not guarded at all, and `verify` run there reported no trips.
+- `verify` fails where canaryhook was never initialized, instead of reporting a clean record. A CI checkout has no record, so the old CI step could never fail; the README now shows `init` before the agent step.
+- Unknown flags and arguments are rejected instead of ignored, so `clean --keep-alert` no longer deletes the alerts it meant to keep.
+
+### Changed
+
+- `status` reports the `PostToolUse` hook and counts it towards healthy.
+
 ## 0.2.0
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index 4348af9..6af07da 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "canarykit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "canarykit",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "license": "MIT",
       "bin": {
         "canarykit": "dist/index.js"
diff --git a/package.json b/package.json
index e49746b..63ee6de 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "canaryhook",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Honeyfiles and canary tokens for AI coding agents. Plants decoy credentials your agents should never touch, then trips on any read or exfiltration.",
   "type": "module",
   "bin": {
diff --git a/src/version.ts b/src/version.ts
index edbab61..387b59e 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = "0.2.0";
+export const VERSION = "0.3.0";