diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c9d2e30..484063f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [1.23.0] - 2026-10-25
+
+### Release notes
+
+- **Share email authorizes from a short link.** `POST /policy/v3/deliveries/authorize` takes the short link only; the node reads the record from the links API (`share_email.links_origin`), signs each read (`TinyCloud-Read-Auth`) and signs delivery admission v1. The old long-link URL forms are not accepted. Deploy order: links API, OpenCredentials witness, node, Share composer, CLI. Details: TC-1737.
+- **Log sidecar error caps.** Request events with status 400 and above are capped per minute per sidecar instance, with one `errors_dropped` event per class per minute. Details: TC-1843.
+- **SQL local durability.** File-backed SQL databases run `PRAGMA synchronous = FULL` by default (`[global.storage.sql] synchronous`), and a write is checked against the storage budget before commit. Details: TC-1491.
+- No database migration since 1.22.0.
+
 ### Changes
 - Added `sql_store` settings, validation, and manifest format and timestamp rules; `enabled = true` refuses to start (no uploader in this build).
 
diff --git a/Cargo.lock b/Cargo.lock
index 013fd222..7120cc31 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9932,7 +9932,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.22.0"
+version = "1.23.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index db1ca850..3b492c2d 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8018,7 +8018,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.22.0"
+version = "1.23.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/w5-policy-runtime-node-e2e/Cargo.lock b/test/w5-policy-runtime-node-e2e/Cargo.lock
index beffcffc..878b6f0e 100644
--- a/test/w5-policy-runtime-node-e2e/Cargo.lock
+++ b/test/w5-policy-runtime-node-e2e/Cargo.lock
@@ -8466,7 +8466,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.22.0"
+version = "1.23.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index 618b3681..c030bb27 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.22.0"
+version = "1.23.0"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"