diff --git a/CHANGELOG.md b/CHANGELOG.md
index 372bd02..b23d345 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,19 @@ ADR-007 and ADR-002.
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-08-17
+
+A security release. The Windows installer left the directories it creates
+writable by every logged-on user, which made two of the files it puts there a
+local privilege escalation; that is fixed and verified on Windows. Alongside it,
+the work that makes this product genuinely adoptable by a second site: one
+site's hostnames, share paths and networks are out of the product code and out
+of the published documentation, and the rule that keeps them out now fails the
+build rather than printing a warning nobody read.
+
+The plugin contract moved to 0.19.0, which is a BREAKING change - see the
+Changed section and CONTRACT-STABILITY.md before upgrading a plugin you wrote.
+
 ### Added
 
 - Applications accept an uploaded image and an uploaded installer, rather than
@@ -1002,7 +1015,9 @@ letting other GE Aerospace sites stand up their own self-hosted instance
   integration that passed the key as a query parameter. See
   `docs/COLLECTOR-INTEGRATION.md`.
 
-[Unreleased]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.8.1...HEAD
+[Unreleased]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.10.0...HEAD
+[0.10.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.9.0...v0.10.0
+[0.9.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.8.1...v0.9.0
 [0.8.1]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.8.0...v0.8.1
 [0.8.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.7.0...v0.8.0
 [0.7.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.6.0...v0.7.0
diff --git a/docs/PROJECT-MAP.md b/docs/PROJECT-MAP.md
index 3118981..8809020 100644
--- a/docs/PROJECT-MAP.md
+++ b/docs/PROJECT-MAP.md
@@ -11,7 +11,7 @@ never by editing this file.
 
 | series | value | governed by |
 |---|---|---|
-| product `__version__` | `0.9.0` | ADR-007 |
+| product `__version__` | `0.10.0` | ADR-007 |
 | plugin contract `__contract_version__` | `0.19.0` | ADR-002 |
 
 They move independently. A contract bump is not a release.
diff --git a/frontend/package.json b/frontend/package.json
index 7cfad9c..5547c03 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "shopdb-frontend",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/shopdb/__init__.py b/shopdb/__init__.py
index d3db59a..10636fe 100644
--- a/shopdb/__init__.py
+++ b/shopdb/__init__.py
@@ -63,7 +63,7 @@ __contract_version__ = '0.19.0'
 # plugin-contract version above are distinct series with independent
 # bump rules. Not part of the shopdb.api contract surface, so it is
 # not re-exported there.
-__version__ = '0.9.0'
+__version__ = '0.10.0'
 
 
 def create_app(config_name: str = None) -> Flask: