diff --git a/CHANGELOG.md b/CHANGELOG.md
index d94e76e..bb313f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-10-08
+
 ### Security
 
 - **Project `.cora.yaml` can no longer redirect your API key.** `provider.base_url` from a discovered project config is ignored unless `CORA_TRUST_PROJECT_CONFIG=1`; `base_url` must be `https` (plain `http` only for loopback); LLM error bodies echoed to the terminal are length-capped (#563).
@@ -932,7 +934,10 @@ Benchmarked on the cora-code repository (1,864 symbols, 115 Rust files, x86_64):
 - **Cross-platform** — Linux (x86_64, ARM64), macOS (Apple Silicon), Windows (x86_64)
 - **MIT License** — fully open source
 
-[Unreleased]: https://github.com/codecoradev/cora-code/compare/v0.13.0...develop
+[Unreleased]: https://github.com/codecoradev/cora-code/compare/v0.16.0...develop
+[0.16.0]: https://github.com/codecoradev/cora-code/compare/v0.15.0...v0.16.0
+[0.15.0]: https://github.com/codecoradev/cora-code/compare/v0.14.0...v0.15.0
+[0.14.0]: https://github.com/codecoradev/cora-code/compare/v0.13.0...v0.14.0
 [0.13.0]: https://github.com/codecoradev/cora-code/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/codecoradev/cora-code/compare/v0.11.1...v0.12.0
 [0.11.1]: https://github.com/codecoradev/cora-code/compare/v0.11.0...v0.11.1
diff --git a/Cargo.lock b/Cargo.lock
index 14eca7b..e1324e9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -303,7 +303,7 @@ dependencies = [
 
 [[package]]
 name = "cora-code"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
diff --git a/Cargo.toml b/Cargo.toml
index b28982d..d411463 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cora-code"
-version = "0.15.0"
+version = "0.16.0"
 edition = "2024"
 description = "CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks"
 license = "Apache-2.0"