diff --git a/changelog/index.mdx b/changelog/index.mdx
index 68057d89..9ee5bdb8 100644
--- a/changelog/index.mdx
+++ b/changelog/index.mdx
@@ -4,6 +4,16 @@ description: "Release notes for Kosli products."
 rss: true
 ---
 
+<Update label="October 15, 2026" description="v2.48.0" tags={["CLI"]}>
+
+## New features
+
+- **Attachments up to 100 MB** — `--attachments` on every `kosli attest` command, and the file given to `kosli attest sbom`, now take files up to 100 MB (previously 10 MB, and 9 MiB for an SBOM). The CLI uploads the file straight to the Evidence Vault over the Kosli hostname, so no new network access is needed. The limit is per organization; contact Kosli support to raise it. See [attachments](/getting_started/attestations#when-to-use-which).
+
+[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.48.0)
+
+</Update>
+
 <Update label="October 9, 2026" description="v2.47.0" tags={["CLI"]}>
 
 ## New features
diff --git a/getting_started/attestations.md b/getting_started/attestations.md
index b9f6580e..85828cdb 100644
--- a/getting_started/attestations.md
+++ b/getting_started/attestations.md
@@ -190,7 +190,12 @@ kosli attest generic \
 
 Use **`--attachments`** when you want to archive files for audit purposes — such as test reports,
 scan output, or policy files — in the Evidence Vault for later retrieval. Provide multiple paths
-as a comma-separated list.
+as a comma-separated list. A single file is uploaded as it is; a directory, or several paths, are
+packaged into one tar archive first.
+
+The upload can be up to 100 MB by default. The limit is per organization; contact Kosli support
+to raise it. The CLI sends the file to the Evidence Vault over the same Kosli hostname it uses
+for everything else, so no further network access is needed.
 
 ```shell
 kosli attest generic \
@@ -363,9 +368,6 @@ Currently, we support the following types of evidence:
     dot-qualified as `<artifact>.<name>` for an artifact-scoped one. Anything left out is absent
     from the input, and a rule reading it does not match rather than failing.
 
-    The CLI refuses an SBOM file larger than 9 MiB, which leaves room for the attestation
-    itself within the 10 MB the server accepts. We are working on raising this.
-
     See [attest an SBOM to an artifact or a trail](/client_reference/kosli_attest_sbom/) for usage details and examples.
   </Accordion>
   <Accordion title="Jira issues" icon="clipboard-list-check">
diff --git a/tutorials/attest_large_documents.md b/tutorials/attest_large_documents.md
index 2b898dfb..55977fa1 100644
--- a/tutorials/attest_large_documents.md
+++ b/tutorials/attest_large_documents.md
@@ -11,7 +11,7 @@ This two-part approach keeps attestation payloads focused on what compliance rul
 For SBOMs there is now a dedicated type, `kosli attest sbom`, which reads the format, tools, subject and package count from the file for you. It is in beta. This tutorial remains the approach for any report Kosli does not parse, such as SARIF.
 
 <Note>
-The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below.
+The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below. An attachment can be up to 100 MB by default; contact Kosli support to raise the limit for your organization.
 </Note>
 
 ## Prerequisites