diff --git a/CHANGELOG.md b/CHANGELOG.md
index d11faf1..d05ec2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,15 +10,38 @@ schemas and the `paramify` CLI — not the internal code.
 
 ## [Unreleased]
 
-## [0.2.0] - 2026-07-09
+## [0.2.1-beta] - 2026-07-10
 
-First public release.
+### Changed
+
+- The `deploy/` bundle is now **Docker-only** (Dockerfile + compose + cron) — a
+  smaller, less prescriptive deployment footprint for public use.
+
+### Removed
+
+- The Kubernetes deployment manifests and the multi-account hub-and-spoke
+  Terraform (`deploy/k8s/`). The Kubernetes *fetchers* (`fetchers/k8s/`) are
+  unaffected.
+
+### Fixed
+
+- The containerized deploy no longer defaults evidence uploads to Paramify
+  staging; it uses production (`app.paramify.com`), matching the uploader's own
+  default.
+
+## [0.2.0-beta] - 2026-07-10
+
+First public release — a beta / pre-release. Pre-1.0, so the contract may still
+change before 1.0 (see [`docs/versioning.md`](docs/versioning.md)).
 
 ### Added
 
 - Fetcher framework: the `paramify` CLI (list · catalog · describe · manifests ·
   validate · run · runs · evidence · upload · manifest builder) plus the
   `paramify tui` front-end, both talking only to `framework.api`.
+- `paramify doctor` — a preflight that checks the Python version, the external
+  CLIs each category needs on `PATH`, and (given a manifest) whether its secret
+  env vars are set.
 - 108 fetchers across 8 categories (aws 79, okta 8, sentinelone 5, knowbe4 4,
   gitlab 3, k8s 3, rippling 3, checkov 2). The AWS category collects where
   deployed via the ambient credential chain, with optional per-target
@@ -26,6 +49,12 @@ First public release.
 - Evidence envelope (`{schema_version, metadata, payload}`, `schema_version`
   `1.0`) wrapped around every fetcher output by the runner.
 - Paramify evidence uploader (`uploaders/paramify_evidence/`).
+- A containerized deployment bundle (`deploy/`) — a Docker image + compose that
+  runs the collector on a schedule and uploads, with secrets injected at run time
+  (environment or AWS Secrets Manager).
+- A credential-free demo (`demo_hello` fetcher + `examples/demo.yaml`) that emits
+  synthetic evidence, so the whole collect → envelope pipeline runs with no cloud
+  account.
 - KSI metadata: an optional `ksis` array on `fetcher.yaml`, mappings populated
   for 89 fetchers, and `paramify ksi` — a FedRAMP 20x KSI coverage view over
   `api.ksi_coverage()`.
@@ -38,7 +67,11 @@ First public release.
 ### Changed
 
 - Licensed under GPL-3.0-only.
-- Documentation rewritten for public consumption.
+- Documentation rewritten for public consumption; the README leads with the TUI,
+  then the AI-agent path, then the CLI.
+- TUI restyled — border titles, status pills, denser controls, and hatched empty
+  states.
 
-[Unreleased]: https://github.com/paramify/paramify-fetchers/compare/v0.2.0...HEAD
-[0.2.0]: https://github.com/paramify/paramify-fetchers/releases/tag/v0.2.0
+[Unreleased]: https://github.com/paramify/paramify-fetchers/compare/v0.2.1-beta...HEAD
+[0.2.1-beta]: https://github.com/paramify/paramify-fetchers/compare/v0.2.0-beta...v0.2.1-beta
+[0.2.0-beta]: https://github.com/paramify/paramify-fetchers/releases/tag/v0.2.0-beta
diff --git a/pyproject.toml b/pyproject.toml
index 45e388a..eb5b938 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "paramify-fetchers"
-version = "0.2.0"
+version = "0.2.1"
 description = "Paramify evidence fetcher framework — discover, build, run, and inspect evidence fetchers."
 readme = "README.md"
 requires-python = ">=3.10"