diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6fd3012..1277298 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.28.0-r1 — 2026-07-28
+
+- Update the pinned upstream runtime to ONNX Runtime `v1.28.0` (`da9b5e364c465de65c49d91e696cd6485270757f`).
+- Include the upstream 1.28 security and runtime fixes and WebGPU plugin EP 0.3.0 update.
+- Revalidate the CoreML runtime-availability and public-vcpkg patches against the new upstream tag.
+- Build every supported target from source for the first stable 1.28 packaging revision.
+
 ## 1.27.0-r3 — 2026-07-27
 
 - Package iOS as one static-library XCFramework whose device and ARM64 Simulator slices each contain `libonnxruntime.a` and public headers.
diff --git a/README.md b/README.md
index 8190915..28222d6 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # Custom ONNX Runtime Packaging
 
-Builds pinned, self-contained ONNX Runtime runtime packages for Android, iOS, Linux, macOS, and Windows without consuming Microsoft-provided ONNX Runtime binaries. The current upstream base is **ONNX Runtime 1.27.0** from `v1.27.0`; package-channel and toolchain pins live in [`versions.env`](versions.env).
+Builds pinned, self-contained ONNX Runtime runtime packages for Android, iOS, Linux, macOS, and Windows without consuming Microsoft-provided ONNX Runtime binaries. The current upstream base is **ONNX Runtime 1.28.0** from `v1.28.0`; package-channel and toolchain pins live in [`versions.env`](versions.env).
 
-This repository's release tags describe a **custom packaging** of upstream ONNX Runtime, not an upstream Microsoft release. A stable package revision is named `ort-<upstream-version>-r<revision>`; the first stable release is therefore `ort-1.27.0-r1`.
+This repository's release tags describe a **custom packaging** of upstream ONNX Runtime, not an upstream Microsoft release. A stable package revision is named `ort-<upstream-version>-r<revision>`; the first stable 1.28 release is therefore `ort-1.28.0-r1`.
 
 ## Packages
 
@@ -48,14 +48,14 @@ For a packaging-only correction, `scope=repackage` can derive a complete release
 
 `versions.env` is the release source of truth. The workflow derives the required tag from `ORT_VERSION`, `PACKAGE_CHANNEL`, and `PACKAGE_REVISION`; a release rejects a mismatched tag, a mismatched prerelease flag, or any ref other than `main` before starting platform builds.
 
-For a Linux-only stable release that rebuilds Linux while reusing verified non-Linux binaries from the preceding immutable release:
+For a Linux-only follow-up that rebuilds Linux while reusing verified non-Linux binaries from the preceding immutable release, first increment `PACKAGE_REVISION`, then dispatch the new tag with its source tag. For example:
 
 ```sh
 gh workflow run release.yml \
   --repo laurens-pilot/ort-packaging \
   --ref main \
-  -f tag=ort-1.27.0-r4 \
-  -f source_tag=ort-1.27.0-r3 \
+  -f tag=ort-1.28.0-r2 \
+  -f source_tag=ort-1.28.0-r1 \
   -f prerelease=false \
   -f scope=linux
 ```
@@ -73,8 +73,8 @@ Custom-built binaries are stripped of or packaged without debug-symbol data. Lin
 Example:
 
 ```sh
-tag=ort-1.27.0-r3
-asset=onnxruntime-webgpu-android-1.27.0-r3.aar
+tag=ort-1.28.0-r1
+asset=onnxruntime-webgpu-android-1.28.0-r1.aar
 base=https://github.com/laurens-pilot/ort-packaging/releases/download/$tag
 
 curl -fL -o "$asset" "$base/$asset"
diff --git a/versions.env b/versions.env
index 3ea5c23..d4d75e5 100644
--- a/versions.env
+++ b/versions.env
@@ -1,7 +1,7 @@
-ORT_REF=v1.27.0
-ORT_VERSION=1.27.0
+ORT_REF=v1.28.0
+ORT_VERSION=1.28.0
 PACKAGE_CHANNEL=stable
-PACKAGE_REVISION=4
+PACKAGE_REVISION=1
 PYTHON_VERSION=3.12
 NODE_VERSION=20
 ANDROID_NDK_VERSION=28.0.13004108