diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4bd138a..727e1b81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [1.25.0] - 2026-10-26
+
 - Encryption: `POST /encryption/networks/<network>/key-actions/delete` (served when `named_keys_v1` is on) deletes one key under `apps/` (`keyPath` without a trailing `/`) or every key under `apps/<app id>/` (`keyPath` with one). The network owner signs the request: a UCAN invocation (with `nbf`) for a `did:key` owner, a SIWE CACAO for a `did:pkh` owner, valid for at most 300 seconds and usable once. The response is `{ keyPath, state, deleted, alreadyDeleted, count }`; a deterministic key answers 409 `key_not_deletable`. A deleted key keeps its path with state `deleted` and no seed. Details: TC-1777.
 - Configuration: adds `[global.encryption_network] deletion_ledger_path`, required while `named_keys_v1` is on. Every delete operation is appended to this file before the database commit and settled after it. At every start the node replays the file onto the database before serving the key routes; if the file cannot be opened or replayed the key routes stay off and the node logs `deletion_ledger_open_failed` or `deletion_ledger_replay_failed`. `tinycloud node deletion-ledger replay` applies the file to a restored database. Details: TC-1777.
 - Encryption: a deletion ledger append whose write or fsync fails is cut back to the file's length before it. The node image contains `/var/lib/tinycloud/ledger`, owned by uid 1000 with mode 0700. Details: TC-1777.
diff --git a/Cargo.lock b/Cargo.lock
index 0f995ca8..886d836a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9933,7 +9933,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.24.0"
+version = "1.25.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index 354b4ec8..d6cde776 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8019,7 +8019,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.24.0"
+version = "1.25.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/w5-policy-runtime-node-e2e/Cargo.lock b/test/w5-policy-runtime-node-e2e/Cargo.lock
index 2e04be9d..23bad6f2 100644
--- a/test/w5-policy-runtime-node-e2e/Cargo.lock
+++ b/test/w5-policy-runtime-node-e2e/Cargo.lock
@@ -8467,7 +8467,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.24.0"
+version = "1.25.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index 6156b5bf..39a01b41 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.24.0"
+version = "1.25.0"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"