diff --git a/.github/release-allowed-signers b/.github/release-allowed-signers
new file mode 100644
index 0000000..6b993ec
--- /dev/null
+++ b/.github/release-allowed-signers
@@ -0,0 +1 @@
+steipete namespaces="git" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII9XsaCcr8TInPnHcuTVfvXXcsoUFrOE7menfbEIHFW9 steipete@gmail.com
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed8831c..d5682fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,11 @@
 # Changelog
 
-## [0.3.5] - Unreleased
-
 ## [Unreleased]
 
+## [0.3.5] - 2026-10-23
+
+**Highlights:** Fix the reachable crypto/x509 vulnerability GO-2026-6809 with Go 1.27.3, explain SMAPI API-client identity rejections, and correctly label initial watch events.
+
 ### Fixed
 - Explain SMAPI API-client identity rejections and suggest supported playback alternatives without exposing service response bodies. Thanks @DonnieFi.
 - Label initial `watch` notifications with the correct service even when they arrive before subscription setup finishes.
diff --git a/docs/install.md b/docs/install.md
index bb1a848..b0fcfcb 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -28,13 +28,13 @@ go install github.com/steipete/sonoscli/cmd/sonos@latest
 sonos --version
 ```
 
-Source builds retain Go 1.26 as the minimum and prefer Go 1.26.8 via `go.mod`. CI and Docker builds use the same preferred patch version.
+Source builds retain Go 1.26 as the minimum and prefer Go 1.27.3 via `go.mod`. CI and Docker builds use the same preferred patch version.
 
 The binary lands in `$(go env GOBIN)` (defaults to `$HOME/go/bin`) — make sure that's on your `PATH`.
 
 ## Prebuilt release archives
 
-Each tagged release publishes archives for macOS (universal, plus Intel and Apple Silicon compatibility archives), Linux (amd64 + arm64), and Windows (amd64 + arm64) on the [GitHub releases page](https://github.com/steipete/sonoscli/releases). Download, extract, drop the `sonos` binary somewhere on your `PATH`.
+Each tagged release publishes archives for macOS (universal, plus Intel and Apple Silicon compatibility archives), Linux (amd64 + arm64), and Windows (amd64 + arm64) on the [GitHub releases page](https://github.com/steipete/sonoscli/releases). The prebuilt macOS binaries require macOS 13 or later. Download, extract, drop the `sonos` binary somewhere on your `PATH`.
 
 ## From source