diff --git a/.vitepress/data/CHANGELOG.md b/.vitepress/data/CHANGELOG.md
new file mode 100644
index 0000000..03ca10c
--- /dev/null
+++ b/.vitepress/data/CHANGELOG.md
@@ -0,0 +1,114 @@
+# Changelog
+
+## [0.4.0] — 2026-06-23
+
+### Added
+
+- ✨ dotnet: Debian 13 trixie + selectable version bands (8.0/9.0/10.0)
+- ✨ Install additional pip packages and uv tools via env vars (#703)
+- ✨ Install additional npm packages via `WS_NPM_ADDITIONAL_PACKAGES`
+- ✨ Run `cloudflared` as a supervised s6 tunnel daemon (#700)
+- ✨ Skip feature-install sections via `--skip-*` flags (#698)
+- ✨ Enable built-in Markdown features and markdownlint parity (#697)
+- ✨ Add user feature playbooks under `~/.ws/features.d` (#696)
+- ✨ Query `show env` by canonical dotted keys, retire WS_* query form (#693)
+- ✨ Enforce WS_* value validation via declared patterns
+- ✨ Retire common.sh env wrappers into `ws-cli show env`
+- ✨ Add in-workspace OIDC auth via oauth2-proxy (#690)
+- ✨ Add fonts.yaml manifest and render to fonts.sh (#683)
+
+### Changed
+
+- 🏗️ Automate release tagging and changelog from a WS_VERSION literal (#722)
+- ♻️ dotnet: DRY the version var, trim zshenv comments
+- 🚚 Move shell/REPL history to `~/.ws/history` and consolidate env into `zshenv` (#704)
+- ♻️ Extract `github_binary` role task and sweep feature playbooks (#701)
+- 🚚 Replace `dumb-init` with `s6-overlay` v3 daemon supervision (#699)
+- 🏗️ Audit image build: isolate code-server into a cache-stable stage (#695)
+- 🏗️ Audit dependency manifest: sudo PATH parity + Renovate hygiene (#694)
+
+### Fixed
+
+- 🐛 Fixed renovate syntax
+- 🐛 Own proxy-domain {{port}} prefix in startup, reject wildcards
+
+## [0.3.0] — 2026-06-01
+
+### Added
+
+- ✨ Add a `--target` flag to `ws-cli logs` for the metrics and `dockerd` components
+- ✨ Add the `ripgrep` fast recursive search tool
+- ✨ Add the `tshark` terminal network-protocol analyzer
+- ✨ Add GitHub authentication support
+- ✨ Bundle the `syft`, `grype`, `dive`, and `osv-scanner` SBOM and vulnerability tools as an `image-extras` feature
+- ✨ Add a `version` option to the `cpp` feature and support offline installation
+- ✨ Add a `WS_APT_DISABLE_RESTRICTIONS` toggle
+
+### Changed
+
+- 🏗️ Slim the dev image and install `pnpm` from npm
+- 🏗️ Render `extensions.sh` from a new `extensions.yaml` manifest
+- 🏗️ Harden the `~/.ws/` convention: add `ca.d/` and drop the override environment variables
+- 🏗️ Resolve the pip and npm registries from the environment or user config
+- 🏗️ Add a drift-safe APT resolver for `ws-feature-store` drift
+- 🏗️ Route additional APT installs through a feature playbook
+- 🚚 Move `dive` to an opt-in feature
+- ♻️ Migrate secret-shaped and path-shaped `WS_*` variables to the `secret: true` and `type: path` schema flags
+- ♻️ Read every `WS_*` variable through `ws-cli show env`, dropping `check_env_set` and `resolve_secret`
+- 🏗️ Add `server.ssl_root` and an absolute `secrets.vault` default
+
+### Removed
+
+- 🔥 Trim dead-weight bundled assets from the VSCode extensions
+
+### Fixed
+
+- 🐛 Fix a prompt-hide regression and harden the zsh shell-init layer
+- 🐛 Harden the workspace startup scripts for first boot
+- 🐛 Fix the Claude statusline ahead/behind icons to match starship
+- 🐛 Fix web-font loading and cache the static assets
+- 🐛 Rename `server.root_dir` to `server.root` to match the runtime environment variable
+- 🐛 Stamp debug "Skipped" lines from the `common.sh` environment helpers
+
+### Security
+
+- 🔒 Deny CNI plugins by default
+
+### Dependencies
+
+- ⬆️ Bump the `base-image` to `v0.1.1`
+- ⬆️ Bump `ws-cli`
+- ⬆️ Bump `ansible-core` to `v2.21.0`
+
+## [0.2.1] — 2026-05-05
+
+### Dependencies
+
+- ⬆️ Bump `kubectl`
+
+## [0.2.0] — 2026-04-27
+
+### Added
+
+- ✨ Add the GitLab CLI
+- ✨ Add the `claude-code` CLI
+- ✨ Add the `bun` JavaScript runtime as a feature
+- ✨ Add a `notify` endpoint to the IPC interface
+- ✨ Add an opt-in open-code (`oc`) environment
+- ✨ Support a custom `.ws` configuration directory
+
+### Changed
+
+- 🚚 Move `oc` into a feature
+- 🚚 Migrate to `uv` for Python package management
+- 🚚 Move delimited parsing to the `dilimit` helper
+- 🏗️ Source features from `ws-feature-store`
+- 🏗️ Package build artifacts as well
+
+### Fixed
+
+- 🐛 Fix `fzf` history search
+
+### Dependencies
+
+- ⬆️ Update Helm to v4
diff --git a/.vitepress/data/dependencies.yaml b/.vitepress/data/dependencies.yaml
index 12aa9cf..803240d 100644
--- a/.vitepress/data/dependencies.yaml
+++ b/.vitepress/data/dependencies.yaml
@@ -23,7 +23,7 @@ dependencies:
     group: Ansible
     home: https://github.com/ansible/ansible
     license: GPL 3
-    version: 2.21.0
+    version: 2.21.1
 
   ansible-lint:
     cmd: ansible-lint --version
@@ -71,7 +71,7 @@ dependencies:
     home: https://github.com/anthropics/claude-code
     license: Anthropic PBC
     package: anthropics/claude-code
-    version: 2.1.177
+    version: 2.1.186
 
   community.docker:
     datasource: galaxy-collection
@@ -85,7 +85,7 @@ dependencies:
     group: Ansible
     home: https://github.com/ansible-collections/community.general
     license: GPL 3
-    version: 13.0.1
+    version: 13.1.0
 
   containerd.io:
     cmd: containerd --version
@@ -103,7 +103,7 @@ dependencies:
     home: https://github.com/google/go-containerregistry
     license: Apache 2
     package: google/go-containerregistry
-    version: 0.21.6
+    version: 0.21.7
 
   cspell:
     cmd: cspell --version
@@ -304,7 +304,7 @@ dependencies:
     home: https://github.com/helm/helm
     license: Apache 2
     package: helm/helm
-    version: 4.2.0
+    version: 4.2.2
 
   htop:
     cmd: htop --version
@@ -346,7 +346,7 @@ dependencies:
     home: https://github.com/derailed/k9s
     license: Apache 2
     package: derailed/k9s
-    version: 0.50.18
+    version: 0.51.0
 
   kind:
     cmd: kind version
@@ -355,7 +355,7 @@ dependencies:
     home: https://github.com/kubernetes-sigs/kind
     license: Apache 2
     package: kubernetes-sigs/kind
-    version: 0.31.0
+    version: 0.32.0
 
   kube-linter:
     cmd: kube-linter version
@@ -430,7 +430,7 @@ dependencies:
     home: https://github.com/igorshubovych/markdownlint-cli
     license: MIT
     package: markdownlint-cli
-    version: 0.48.0
+    version: 0.49.0
 
   nc:
     cmd: (nc -h) > >(cat) 2>&1
@@ -473,7 +473,7 @@ dependencies:
     home: https://github.com/oauth2-proxy/oauth2-proxy
     license: MIT
     package: oauth2-proxy/oauth2-proxy
-    version: 7.15.2
+    version: 7.15.3
 
   oh-my-zsh:
     datasource: github-releases
@@ -530,7 +530,7 @@ dependencies:
     home: https://github.com/pnpm/pnpm
     license: MIT
     package: pnpm
-    version: 11.5.0
+    version: 11.8.0
 
   podman:
     cmd: podman --version
@@ -566,7 +566,7 @@ dependencies:
     home: https://github.com/pylint-dev/pylint
     license: GPL 2
     tool: true
-    version: 4.0.5
+    version: 4.0.6
 
   pyrefly:
     cmd: pyrefly --version
@@ -602,7 +602,7 @@ dependencies:
     home: https://github.com/astral-sh/ruff
     license: MIT
     tool: true
-    version: 0.15.15
+    version: 0.15.18
 
   ShellCheck:
     cmd: shellcheck --version
@@ -690,7 +690,7 @@ dependencies:
     home: https://github.com/astral-sh/uv
     package: astral-sh/uv
     license: MIT
-    version: 0.11.19
+    version: 0.11.23
 
   vim:
     cmd: vim --version