diff --git a/AGENTS.md b/AGENTS.md
index 6612e09..25dc395 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,7 +12,7 @@ Command sources: `.github/workflows/ci.yml` (the gates), `.github/workflows/rele
 - **Type:** app — published as a PyPI wheel (`uvx blc-ssh-mcp`) *and* a container image (`ghcr.io/blackaxgit/ssh-mcp`). **The PyPI distribution is `blc-ssh-mcp`, not `ssh-mcp`** — that name belongs to an unrelated project this repo has never owned; see the comment above `name` in `pyproject.toml`. The import package is still `ssh_mcp` and the image is still `.../ssh-mcp`.
 - **Stacks:** Python 3.11-3.15, `uv` + hatchling, asyncssh, MCP SDK, Starlette/uvicorn (HTTP transport only)
 - **Deploy targets:** N/A — this is a tool operators run themselves, not a hosted service
-- **Version:** `src/ssh_mcp/__init__.py` is the single source (hatchling reads it). Currently `0.9.0`. `0.7.0` shipped 2026-09-06 (the MCP SDK v2 migration) and is the first release published under a reviewer-gated `pypi` environment; `0.6.0`, `0.6.1` and `0.6.2` all shipped 2026-07-26. `CHANGELOG.md` `[Unreleased]` is where post-0.9.0 work accrues.
+- **Version:** `src/ssh_mcp/__init__.py` is the single source (hatchling reads it). Currently `0.9.1`. `0.7.0` shipped 2026-09-06 (the MCP SDK v2 migration) and is the first release published under a reviewer-gated `pypi` environment; `0.6.0`, `0.6.1` and `0.6.2` all shipped 2026-07-26. `CHANGELOG.md` `[Unreleased]` is where post-0.9.1 work accrues.
 
 **What this tool does matters for how you treat it.** Every tool call runs a shell command or transfers a file on a remote host. A bug here is not a crashed request; it is an unintended command on someone's infrastructure, or a write to the operator's own machine.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 009e413..c4e4176 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-10-16
+
+> **Why 0.9.1 and not 0.10.0:** nothing here makes a configuration that started on 0.9.0 refuse to start, which is the test 0.8.0 recorded for taking the minor. Python 3.15 support adds an interpreter without dropping one. The runtime dependency upgrades under Changed are lockfile-only: no declared floor in `pyproject.toml` moved, so a `pip install` of 0.9.0 could already resolve every one of them, and the full suite passes on the locked set.
+
 ### Added
 
 **Python 3.15 is supported and tested.** CI and the release gate now run the test suite on 3.15 alongside 3.11-3.14, and the wheel carries the 3.15 classifier. No code change was needed. The pinned `uv` moves from 0.12.10 to 0.13.1 in every workflow and the Dockerfile, because 0.12.10 only knows CPython 3.15.0rc2 — a 3.15 leg on it would have tested a release candidate while reporting 3.15. 0.13.1 rather than 0.13.0 because 0.13.0 regressed on extracting source distributions that contain hard links, and the 3.15 leg builds PyYAML from its sdist (6.0.3 ships no cp315 wheel). The container image stays on Python 3.14.
 
+### Changed
+
+**Locked dependency upgrades (#74, #76).** Runtime: `mcp` and `mcp-types` 2.2.0 → 2.3.0, `asyncssh` 2.24.0 → 2.24.1, `pydantic` 2.13.5 → 2.14.0 (`pydantic-core` 2.46.5 → 2.50.0), `orjson` 3.12.0 → 3.13.0, `opentelemetry-api` 1.45.0 → 1.45.1. These are what the container image and `uv sync --locked` install. Dev-only: `ruff` 0.16.9 → 0.17.0 (exact pin in the `dev` extra), `mypy` 2.3.1 → 2.4.0, `hypothesis` 6.168.1 → 6.168.5, `opentelemetry-sdk` 1.45.0 → 1.45.1, `pip-api` 0.0.34 → 0.0.35 (see Fixed). The behaviour of mcp that `server.py` relies on for transport security and tool-error logging was re-checked against 2.3.0 and is unchanged.
+
+**Image and CI pins.** The `python:3.14-slim-trixie` base digest is refreshed (#72). `astral-sh/setup-uv` moves 10.1.0 → 10.3.0, and `actions/upload-artifact` / `actions/download-artifact` to 7.0.2 / 8.0.2 (#71, #73), each still pinned to a commit SHA.
+
+### Documentation
+
+`SECURITY.md`'s supported-versions table now names 0.9.x (#70).
+
 ### Fixed
 
 **`uv run pip-audit` works on Python 3.15.** `pip-api` is locked at 0.0.35 instead of 0.0.34, whose vendored pyparsing imports `sre_constants`, a module 3.15 removed, so the audit gate crashed before scanning in a 3.15 dev environment. Since uv 0.13 made 3.15 its default download, a fresh `uv sync` can create exactly that environment. CI was not affected because its audit job runs on 3.13. The change is dev-only: `pip-api` comes in through `pip-audit`, and neither the wheel nor the image ships it.
diff --git a/src/ssh_mcp/__init__.py b/src/ssh_mcp/__init__.py
index 0a57f26..f794b88 100644
--- a/src/ssh_mcp/__init__.py
+++ b/src/ssh_mcp/__init__.py
@@ -1,3 +1,3 @@
 """SSH MCP Server - Manage infrastructure via MCP clients like Claude Code."""
 
-__version__ = "0.9.0"
+__version__ = "0.9.1"