diff --git a/CHANGELOG.md b/CHANGELOG.md
index eac213fee..4991fb00e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,38 @@
 # Changelog
 
-## [Unreleased]
+## [0.20.2] - 2026-10-30
+
+### Highlights
+
+- **Patched CPython sandbox engine.** Wasmtime 48.0.8 addresses RUSTSEC-2026-0422, RUSTSEC-2026-0423 and RUSTSEC-2026-0424; the embedded CPython artifact is rebuilt with the same exact engine version ([#2798](https://github.com/everruns/bashkit/pull/2798)).
+- **Signed Windows Python wheels.** Windows native modules receive Authenticode signatures and timestamps, verified before the final wheel is tested and published ([#2799](https://github.com/everruns/bashkit/pull/2799)).
+- **Binary-safe HTTP output.** curl downloads and curl/wget stdout preserve bytes through redirections and pipelines, including compressed responses ([#2778](https://github.com/everruns/bashkit/pull/2778)).
+- **Correct directory-content copies.** `cp -r source/. destination` copies contents into an existing destination without adding a source-directory layer ([#2796](https://github.com/everruns/bashkit/pull/2796)).
 
 ### What's Changed
 
-- fix(cp): copy directory contents for `source/.` operands without nesting the source directory in an existing destination.
-- fix(http): preserve binary curl downloads and curl/wget stdout through redirections and pipelines, including compressed responses and byte counts.
+* chore(python): sign Windows release wheels with Authenticode ([#2799](https://github.com/everruns/bashkit/pull/2799)) by @chaliy
+* Fix Wasmtime security advisories ([#2798](https://github.com/everruns/bashkit/pull/2798)) by @chaliy
+* fix(testing): render the diagnostic slot in the fuzz echo gate ([#2797](https://github.com/everruns/bashkit/pull/2797)) by @chaliy
+* fix(cp): preserve directory-dot contents operands ([#2796](https://github.com/everruns/bashkit/pull/2796)) by @chaliy
+* ci(npm): re-publish an existing release tag via a tag input ([#2794](https://github.com/everruns/bashkit/pull/2794)) by @chaliy
+* fix(deps): clear the seroval script-injection advisories in the site lockfile ([#2795](https://github.com/everruns/bashkit/pull/2795)) by @chaliy
+* chore(python): document Smart App Control workaround and reproduction ([#2793](https://github.com/everruns/bashkit/pull/2793)) by @chaliy
+* chore(deps): bump the rust-dependencies group and record its vet audits ([#2792](https://github.com/everruns/bashkit/pull/2792)) by @chaliy
+* ci(npm): publish via npm trusted publishing (GitHub OIDC) ([#2791](https://github.com/everruns/bashkit/pull/2791)) by @chaliy
+* chore(deps): bump vt100 to 0.18 and migrate the NonZero screen API ([#2789](https://github.com/everruns/bashkit/pull/2789)) by @chaliy
+* fix(ci): retry the Rosetta cross build through toolchain segfaults ([#2788](https://github.com/everruns/bashkit/pull/2788)) by @chaliy
+* chore(ci): bump the github-actions group across 1 directory with 4 updates ([#2787](https://github.com/everruns/bashkit/pull/2787)) by @app/dependabot
+* chore(deps): bump the examples-npm group across 2 directories with 7 updates ([#2785](https://github.com/everruns/bashkit/pull/2785)) by @app/dependabot
+* fix(js): size the host-callback timeout for the slowest shipped lane ([#2780](https://github.com/everruns/bashkit/pull/2780)) by @chaliy
+* chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 3 updates ([#2784](https://github.com/everruns/bashkit/pull/2784)) by @app/dependabot
+* chore(deps): bump the site-npm group in /site with 4 updates ([#2783](https://github.com/everruns/bashkit/pull/2783)) by @app/dependabot
+* chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 2 updates ([#2782](https://github.com/everruns/bashkit/pull/2782)) by @app/dependabot
+* chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates ([#2781](https://github.com/everruns/bashkit/pull/2781)) by @app/dependabot
+* chore(builtins): sync uutils/coreutils argument surfaces and vendored modules ([#2779](https://github.com/everruns/bashkit/pull/2779)) by @chaliy
+* fix(http): preserve binary download and stream output ([#2778](https://github.com/everruns/bashkit/pull/2778)) by @chaliy
+
+**Full Changelog**: https://github.com/everruns/bashkit/compare/v0.20.1...v0.20.2
 
 ## [0.20.1] - 2026-10-25
 
diff --git a/Cargo.lock b/Cargo.lock
index 54f36b837..ebc028bb1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -357,7 +357,7 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bashkit"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -438,7 +438,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-bench"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -453,7 +453,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-capi"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "bashkit",
  "serde",
@@ -463,7 +463,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-cli"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -477,7 +477,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-coreutils-port"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "prettyplease",
@@ -491,7 +491,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-cpython-wasm"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "lzma-rs",
  "wasmtime",
@@ -499,7 +499,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-eval"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -517,7 +517,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-js"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "bashkit",
  "bashkit-scripted-tool",
@@ -531,7 +531,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-python"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "bashkit",
  "bashkit-scripted-tool",
@@ -544,7 +544,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-scripted-tool"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -560,7 +560,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-wasm"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "bashkit",
  "console_error_panic_hook",
diff --git a/Cargo.toml b/Cargo.toml
index 5a9fc3718..5f7915e28 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,7 +7,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.20.1"
+version = "0.20.2"
 edition = "2024"
 license = "MIT"
 authors = ["Mykhailo Chalyi <mike@chaliy.name>", "Everruns"]
diff --git a/README.md b/README.md
index bd3f9fde6..77f8a27ba 100644
--- a/README.md
+++ b/README.md
@@ -442,7 +442,7 @@ Enable the `sqlite` feature to embed [Turso](https://github.com/tursodatabase/tu
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["sqlite"] }
+bashkit = { version = "0.20.2", features = ["sqlite"] }
 ```
 
 ```rust
diff --git a/crates/bashkit-cli/Cargo.toml b/crates/bashkit-cli/Cargo.toml
index 39bd69f18..baadf1045 100644
--- a/crates/bashkit-cli/Cargo.toml
+++ b/crates/bashkit-cli/Cargo.toml
@@ -39,7 +39,7 @@ interactive = ["dep:rustyline", "dep:terminal_size", "dep:signal-hook"]
 # `tzdata` is listed explicitly: an interactive shell must keep honouring
 # named `TZ=` zones in `date`, which stopped being implied when chrono-tz
 # moved behind a feature.
-bashkit = { path = "../bashkit", version = "0.20.1", default-features = false, features = ["http_client", "ring", "git", "jq", "tzdata"] }
+bashkit = { path = "../bashkit", version = "0.20.2", default-features = false, features = ["http_client", "ring", "git", "jq", "tzdata"] }
 tokio = { workspace = true, features = ["macros", "net", "rt", "rt-multi-thread", "time", "io-std"] }
 clap.workspace = true
 anyhow.workspace = true
diff --git a/crates/bashkit-js/package.json b/crates/bashkit-js/package.json
index 584e162e5..0570eff4a 100644
--- a/crates/bashkit-js/package.json
+++ b/crates/bashkit-js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@everruns/bashkit",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Sandboxed bash interpreter for JavaScript/TypeScript",
   "packageManager": "pnpm@10.33.0",
   "main": "wrapper.js",
diff --git a/crates/bashkit-scripted-tool/Cargo.toml b/crates/bashkit-scripted-tool/Cargo.toml
index 5c7fff317..2f619951d 100644
--- a/crates/bashkit-scripted-tool/Cargo.toml
+++ b/crates/bashkit-scripted-tool/Cargo.toml
@@ -30,7 +30,7 @@ jq = ["bashkit/jq"]
 tracing = ["dep:tracing"]
 
 [dependencies]
-bashkit = { path = "../bashkit", version = "0.20.1", default-features = false, features = ["bash_tool"] }
+bashkit = { path = "../bashkit", version = "0.20.2", default-features = false, features = ["bash_tool"] }
 tokio = { workspace = true }
 async-trait = { workspace = true }
 tower = { workspace = true }
diff --git a/crates/bashkit-wasm/package.json b/crates/bashkit-wasm/package.json
index 03cfd66c2..27bf3f136 100644
--- a/crates/bashkit-wasm/package.json
+++ b/crates/bashkit-wasm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@everruns/bashkit-wasm",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Sandboxed bash interpreter for the browser (WebAssembly). Single-threaded \u2014 no SharedArrayBuffer, no COOP/COEP headers.",
   "type": "module",
   "main": "index.js",
diff --git a/crates/bashkit/Cargo.toml b/crates/bashkit/Cargo.toml
index 0725ee2e9..c61ce4ea3 100644
--- a/crates/bashkit/Cargo.toml
+++ b/crates/bashkit/Cargo.toml
@@ -143,7 +143,7 @@ monty = { version = "=0.0.19", optional = true }
 
 # Real CPython 3.14 as a WASI guest, precompiled to Pulley (cpython feature).
 # See knowledge/runtimes/cpython-wasm.md.
-bashkit-cpython-wasm = { path = "../bashkit-cpython-wasm", version = "0.20.1", optional = true }
+bashkit-cpython-wasm = { path = "../bashkit-cpython-wasm", version = "0.20.2", optional = true }
 wasmtime = { workspace = true, optional = true, features = ["pooling-allocator"] }
 monty-types = { version = "=0.0.19", optional = true }
 # Monty's ruff AST uses compact_str 0.9; get-size2 >=0.10.2 only implements
diff --git a/crates/bashkit/docs/cpython.md b/crates/bashkit/docs/cpython.md
index f533b576f..5e4397b4c 100644
--- a/crates/bashkit/docs/cpython.md
+++ b/crates/bashkit/docs/cpython.md
@@ -19,7 +19,7 @@ Enable the `cpython` cargo feature and register the builtins:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["cpython"] }
+bashkit = { version = "0.20.2", features = ["cpython"] }
 ```
 
 ```rust
@@ -242,7 +242,7 @@ executable memory. Enable `cpython-native` instead of `cpython` to compile it
 to machine code for your target at build time:
 
 ```toml
-bashkit = { version = "0.20.1", features = ["cpython-native"] }
+bashkit = { version = "0.20.2", features = ["cpython-native"] }
 ```
 
 Calls get 4-10x faster (`print(1)` ~1 ms instead of ~4 ms; CPU-bound code
diff --git a/crates/bashkit/docs/logging.md b/crates/bashkit/docs/logging.md
index 1fb9a8c33..ac39697fc 100644
--- a/crates/bashkit/docs/logging.md
+++ b/crates/bashkit/docs/logging.md
@@ -14,7 +14,7 @@ Add the `logging` feature to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["logging"] }
+bashkit = { version = "0.20.2", features = ["logging"] }
 tracing-subscriber = "0.3"  # or your preferred subscriber
 ```
 
diff --git a/crates/bashkit/docs/sqlite.md b/crates/bashkit/docs/sqlite.md
index 846daf88e..40fa0c4bf 100644
--- a/crates/bashkit/docs/sqlite.md
+++ b/crates/bashkit/docs/sqlite.md
@@ -13,7 +13,7 @@ the `sqlite` feature. The engine is [Turso](https://github.com/tursodatabase/tur
 
 ```toml
 # Cargo.toml
-bashkit = { version = "0.20.1", features = ["sqlite"] }
+bashkit = { version = "0.20.2", features = ["sqlite"] }
 ```
 
 ```rust,ignore
diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock
index ba05b5704..185cf1060 100644
--- a/crates/bashkit/fuzz/Cargo.lock
+++ b/crates/bashkit/fuzz/Cargo.lock
@@ -90,7 +90,7 @@ checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
 [[package]]
 name = "bashkit"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -140,7 +140,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-cpython-wasm"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "lzma-rs",
  "wasmtime",
diff --git a/crates/bashkit/src/lib.rs b/crates/bashkit/src/lib.rs
index 279d0f279..2a9511ac0 100644
--- a/crates/bashkit/src/lib.rs
+++ b/crates/bashkit/src/lib.rs
@@ -323,7 +323,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! bashkit = { version = "0.20.1", features = ["git"] }
+//! bashkit = { version = "0.20.2", features = ["git"] }
 //! ```
 //!
 //! ```rust,ignore
@@ -354,7 +354,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! bashkit = { version = "0.20.1", features = ["python"] }
+//! bashkit = { version = "0.20.2", features = ["python"] }
 //! ```
 //!
 //! ```rust,ignore
diff --git a/docs/builtin_typescript.md b/docs/builtin_typescript.md
index 1aa9bf90b..9d44b689b 100644
--- a/docs/builtin_typescript.md
+++ b/docs/builtin_typescript.md
@@ -12,7 +12,7 @@ Add the `typescript` feature to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["typescript"] }
+bashkit = { version = "0.20.2", features = ["typescript"] }
 ```
 
 Enable TypeScript in the builder:
diff --git a/docs/migrating-scripted-tool.md b/docs/migrating-scripted-tool.md
index 8b34e7e0d..558ec19ee 100644
--- a/docs/migrating-scripted-tool.md
+++ b/docs/migrating-scripted-tool.md
@@ -23,8 +23,8 @@ features = ["scripted_tool", "python", "typescript", "jq"]
 After:
 
 ```toml
-bashkit = { version = "0.20.1", features = ["python", "typescript", "jq"] }
-bashkit-scripted-tool = { version = "0.20.1", features = ["python", "typescript", "jq"] }
+bashkit = { version = "0.20.2", features = ["python", "typescript", "jq"] }
+bashkit-scripted-tool = { version = "0.20.2", features = ["python", "typescript", "jq"] }
 ```
 
 Keep `bashkit` only if you use it directly (`Bash`, `BashTool`, the `Tool`
diff --git a/examples/hyperlight/Cargo.lock b/examples/hyperlight/Cargo.lock
index f4a11897f..e3c53e4bc 100644
--- a/examples/hyperlight/Cargo.lock
+++ b/examples/hyperlight/Cargo.lock
@@ -69,7 +69,7 @@ checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
 [[package]]
 name = "bashkit"
-version = "0.20.1"
+version = "0.20.2"
 dependencies = [
  "anyhow",
  "async-trait",