diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1933d80..3de3917 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,8 @@ ADR-007 and ADR-002.
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-07-12
+
 ### Added
 
 - Email sending. A stdlib-only mail service (`shopdb/utils/mailer.py`;
@@ -415,5 +417,7 @@ letting other GE Aerospace sites stand up their own self-hosted instance
   integration that passed the key as a query parameter. See
   `docs/COLLECTOR-INTEGRATION.md`.
 
-[Unreleased]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.5.0...HEAD
+[Unreleased]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.7.0...HEAD
+[0.7.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.6.0...v0.7.0
+[0.6.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/compare/v0.5.0...v0.6.0
 [0.5.0]: https://gitea.proudtech.net/ge-aerospace/shopdb-flask/releases/tag/v0.5.0
diff --git a/CLAUDE.md b/CLAUDE.md
index cd0fddd..a81ba55 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -41,10 +41,10 @@ Refactor phases 0-5 landed; phase 6 (multi-site distribution readiness) largely
 
 ### Active state
 
-- 781 tests passing, naming/style check green, Gitea Actions CI (backend + naming + frontend build)
-- `__contract_version__` at 0.10.0 (product `__version__` 0.6.0, tags v0.5.0/v0.6.0 - distinct series, ADR-007; a large [Unreleased] pile is due a release cut)
+- 808 tests passing, naming/style check green, Gitea Actions CI (backend + naming + frontend build)
+- `__contract_version__` at 0.10.0 (product `__version__` 0.7.0, tags v0.5.0/v0.6.0/v0.7.0 - distinct series, ADR-007)
 - 11 bundled plugins all satisfy contract: computers, employees, knowledgebase, machines, measuringtools, network, notifications, printers, slides, usb, warranty
-- Core Alembic chain: baseline `68b3947ae14f` -> head `7d22_apitokens_scopes` (29 core migrations). Each plugin owns its own chain (ADR-008); deploy runs `flask db upgrade` then `flask plugin upgrade-all`. Reproducible + idempotent from empty.
+- Core Alembic chain: baseline `68b3947ae14f` -> head `7d23_user_mustchangepassword` (30 core migrations). Each plugin owns its own chain (ADR-008); deploy runs `flask db upgrade` then `flask plugin upgrade-all`. Reproducible + idempotent from empty.
 - API is migration-complete: an admin PAT + docs/IMPORT-API.md let a script/LLM import the whole legacy DB (X-Import-Mode preserves timestamps).
 - Pre-1.0 framework; sister sites should pin tight `core_version` ranges until contract reaches 1.0
 
diff --git a/frontend/package.json b/frontend/package.json
index 23acebf..da66b8f 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "shopdb-frontend",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/shopdb/__init__.py b/shopdb/__init__.py
index 7e88a45..73db900 100644
--- a/shopdb/__init__.py
+++ b/shopdb/__init__.py
@@ -38,7 +38,7 @@ __contract_version__ = '0.10.0'
 # plugin-contract version above are distinct series with independent
 # bump rules. Not part of the shopdb.api contract surface, so it is
 # not re-exported there.
-__version__ = '0.6.0'
+__version__ = '0.7.0'
 
 
 def create_app(config_name: str = None) -> Flask: