diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa05568..8c2080e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-06
+
 ### Security
 
 - **The fast path could grant what the packet path denies.** The two deciders
diff --git a/Cargo.lock b/Cargo.lock
index b7e1dad..f4b7bd8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -690,7 +690,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-cli"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "cfc-client",
@@ -719,7 +719,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-client"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "cfc-core",
@@ -739,7 +739,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-core"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "chrono",
  "ipnet",
@@ -754,7 +754,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-daemon"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "aya",
@@ -793,11 +793,11 @@ dependencies = [
 
 [[package]]
 name = "cfc-ebpf-common"
-version = "0.4.0"
+version = "0.5.0"
 
 [[package]]
 name = "cfc-proto"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "prost",
  "serde",
@@ -809,7 +809,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-tray"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "cfc-client",
@@ -826,7 +826,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-ui"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "cfc-client",
@@ -6414,7 +6414,7 @@ checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
 
 [[package]]
 name = "xtask"
-version = "0.4.0"
+version = "0.5.0"
 
 [[package]]
 name = "y4m"
diff --git a/Cargo.toml b/Cargo.toml
index 1c8884b..ca793d1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,7 +17,7 @@ members = [
 exclude = ["crates/cfc-ebpf"]
 
 [workspace.package]
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 rust-version = "1.88"
 license = "GPL-3.0-or-later"
diff --git a/crates/cfc-ebpf/Cargo.lock b/crates/cfc-ebpf/Cargo.lock
index 510312d..b84df45 100644
--- a/crates/cfc-ebpf/Cargo.lock
+++ b/crates/cfc-ebpf/Cargo.lock
@@ -106,7 +106,7 @@ dependencies = [
 
 [[package]]
 name = "cfc-ebpf-common"
-version = "0.4.0"
+version = "0.5.0"
 
 [[package]]
 name = "itoa"
diff --git a/packaging/rpm/colony-firewall-control.spec b/packaging/rpm/colony-firewall-control.spec
index 5e73720..0830fd8 100644
--- a/packaging/rpm/colony-firewall-control.spec
+++ b/packaging/rpm/colony-firewall-control.spec
@@ -11,7 +11,7 @@
 %global debug_package %{nil}
 
 Name:           colony-firewall-control
-Version:        0.4.0
+Version:        0.5.0
 Release:        1%{?dist}
 Summary:        Application-aware outbound firewall for Linux
 
@@ -239,6 +239,13 @@ fi
 %{_datadir}/selinux/devel/include/distributed/%{modulename}.if
 
 %changelog
+* Sun Sep 06 2026 MotherSphere <linhajahad@gmail.com> - 0.5.0-1
+- Security: the fast path could grant what the packet path denies (uid divergence)
+- Security: a rule that could not be decided was walked past into a lower allow
+- Security: an unconfirmed hostname may now refuse but not admit
+- Security: ICMP refusals no longer forged with a multicast source, and are budgeted off-box
+- The measured cost of the fast path, and scripts/vm-bench that measures it
+
 * Sat Sep 05 2026 MotherSphere <linhajahad@gmail.com> - 0.4.0-1
 - Fast-allow path, opt-in: lastingly allowed processes skip the NFQUEUE round trip
 - eBPF ABI v4
diff --git a/pkg/PKGBUILD b/pkg/PKGBUILD
index 6fb965e..22a2e7a 100644
--- a/pkg/PKGBUILD
+++ b/pkg/PKGBUILD
@@ -4,7 +4,7 @@
 # For building from a git checkout during development, see PKGBUILD-git.
 
 pkgname=colony-firewall-control
-pkgver=0.4.0
+pkgver=0.5.0
 pkgrel=1
 pkgdesc="Application-aware outbound firewall for Linux, written in Rust"
 arch=('x86_64')
diff --git a/pkg/README.md b/pkg/README.md
index 1f96bc9..80dd2f1 100644
--- a/pkg/README.md
+++ b/pkg/README.md
@@ -148,7 +148,7 @@ To reproduce the tarball locally, from the repo root:
 cargo build --workspace --release --locked
 cargo xtask build-ebpf   # cfc-ebpf.o; postInstall fails outright without it
 
-V=0.4.0
+V=0.5.0
 NAME="colony-firewall-control-${V}-linux-x86_64"
 STAGE="$(mktemp -d)/${NAME}"
 mkdir -p "${STAGE}"
diff --git a/pkg/colony.json b/pkg/colony.json
index ca50c4f..35d00ec 100644
--- a/pkg/colony.json
+++ b/pkg/colony.json
@@ -1,7 +1,7 @@
 {
   "id": "colony-firewall-control",
   "name": "Colony Firewall Control",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Application-aware outbound firewall for Linux. Per-app prompts, persistent rules, live connection feed.",
   "license": "GPL-3.0-or-later",
   "homepage": "https://github.com/Project-Colony/Colony-Firewall-Control",
@@ -11,7 +11,7 @@
   "tags": ["firewall", "security", "network", "outbound", "opensnitch"],
   "platforms": {
     "linux-x86_64": {
-      "asset": "colony-firewall-control-0.4.0-linux-x86_64.tar.zst",
+      "asset": "colony-firewall-control-0.5.0-linux-x86_64.tar.zst",
       "binaries": ["colony-firewalld", "colony-firewall", "colony-firewall-tray", "cfc"],
       "installPath": "/usr/bin",
       "postInstall": [