diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f0db304..293e711 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
           version="$GITHUB_REF_NAME"
           [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
           [ "$(cat VERSION)" = "$version" ]
-          grep -Fxq "## [$version] - 2026-08-25" CHANGELOG.md
+          grep -Fxq "## [$version] - 2026-08-26" CHANGELOG.md
           git fetch --no-tags origin main
           git merge-base --is-ancestor "$GITHUB_SHA" origin/main
           printf 'version=%s\n' "$version" >>"$GITHUB_OUTPUT"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56dcb07..1479e6d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,14 @@ Versioning.
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-08-26
+
+### Changed
+
+- Hosted reusable release, CodeQL and supply-chain callers now pin signed
+  immutable `ci-workflows 0.1.11`; the canonical action catalog carries the
+  same exact commit and version.
+
 ## [0.1.1] - 2026-08-25
 
 ### Fixed
diff --git a/VERSION b/VERSION
index 17e51c3..d917d3e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.1.1
+0.1.2