diff --git a/CHANGELOG.md b/CHANGELOG.md
index 75fcc17..d6d219b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ All notable changes to CodeSnake are documented here. The format follows
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-09-03
+
+A security fix for anyone using CodeSnake as a CI gate. Upgrade if you run it against
+pull requests you do not control.
+
 ### Fixed
 
 - **`.gitignore` no longer hides committed files from a directory walk.** git's own
@@ -128,7 +133,8 @@ A correctness, precision, and packaging release. 189 tests, up from 91.
 - Version single-sourced from `codesnake/_version.py`.
 - MIT `LICENSE` added, with PEP 639 metadata; CI on Python 3.10 through 3.13.
 
-[Unreleased]: https://github.com/bitWarrior/codesnake/compare/v1.2.1...HEAD
+[Unreleased]: https://github.com/bitWarrior/codesnake/compare/v1.3.0...HEAD
+[1.3.0]: https://github.com/bitWarrior/codesnake/compare/v1.2.1...v1.3.0
 [1.2.1]: https://github.com/bitWarrior/codesnake/compare/v1.2.0...v1.2.1
 [1.2.0]: https://github.com/bitWarrior/codesnake/compare/v1.1.0...v1.2.0
 [1.1.0]: https://github.com/bitWarrior/codesnake/releases/tag/v1.1.0
diff --git a/docs/INTEGRATIONS.md b/docs/INTEGRATIONS.md
index 6410cbe..ee92c4b 100644
--- a/docs/INTEGRATIONS.md
+++ b/docs/INTEGRATIONS.md
@@ -42,7 +42,7 @@ repos:
 ```
 
 To have pre-commit manage the install instead, use `language: python` with
-`additional_dependencies: ["git+https://github.com/bitWarrior/codesnake@v1.2.1"]`.
+`additional_dependencies: ["git+https://github.com/bitWarrior/codesnake@v1.3.0"]`.
 
 ## GitHub Actions
 
@@ -76,7 +76,7 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - run: pip install "git+https://github.com/bitWarrior/codesnake@v1.2.1"
+      - run: pip install "git+https://github.com/bitWarrior/codesnake@v1.3.0"
       - run: codesnake check --format github --no-color src/
 ```
 
diff --git a/src/codesnake/_version.py b/src/codesnake/_version.py
index a6ec462..c85bae2 100644
--- a/src/codesnake/_version.py
+++ b/src/codesnake/_version.py
@@ -1,3 +1,3 @@
 """Single source of truth for the package version (read by pyproject.toml)."""
 
-__version__ = "1.2.1"
+__version__ = "1.3.0"