diff --git a/CHANGELOG.md b/CHANGELOG.md
index f71b4cd..1277fa9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,12 +17,20 @@ The following emojis are used to highlight certain changes:
 
 ### Changed
 
-- [boxo v0.41.0](https://github.com/ipfs/boxo/releases/tag/v0.41.0) [#155](https://github.com/ipfs/someguy/pull/155)
-
 ### Removed
 
 ### Fixed
 
+### Security
+
+## [v0.14.0] - 2026-06-08
+
+### Changed
+
+- [boxo v0.41.0](https://github.com/ipfs/boxo/releases/tag/v0.41.0) [#155](https://github.com/ipfs/someguy/pull/155)
+
+### Fixed
+
 - `GetIPNS` no longer returns an IPNS record whose EOL has already passed. An expired record is cryptographically invalid, so it is treated as not found, and when multiple routers answer the first non-expired record is returned. [#154](https://github.com/ipfs/someguy/pull/154)
 - `/routing/v1/ipns/{name}` no longer gives a cache a freshness window that outlives the record. It caps `max-age` to the record's remaining validity and sizes the `stale-while-revalidate`/`stale-if-error` window to fit within its EOL. An expired record, or one without an EOL validity, returns `Cache-Control: no-store`. [#155](https://github.com/ipfs/someguy/pull/155)
 - `/routing/v1/peers/{peerid}` now serves addresses cache-first, the same way `/routing/v1/providers/{cid}` does. It answers from the cached address book and host peerstore before falling back to a DHT lookup, so a relay-dependent peer that is absent from peer routing but recently seen as a provider is no longer answered with an empty result. See [`docs/peer-address-caching.md`](https://github.com/ipfs/someguy/blob/main/docs/peer-address-caching.md). [#153](https://github.com/ipfs/someguy/pull/153)
diff --git a/version.json b/version.json
index d3f7968..7dd7b57 100644
--- a/version.json
+++ b/version.json
@@ -1,3 +1,3 @@
 {
-  "version": "v0.13.0"
+  "version": "v0.14.0"
 }