diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35c05ef6..a899f76e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [1.25.14] - 2026-10-29
+
 ### Changes
 - PolicyV3 decrypt checks the authoritative registered `contentSource`, never caller metadata: the capability resource, owner-qualified `encryptionNetwork` and optional `encryptionKeyPath` must match exactly. Every path-scoped Share source, whether mutable or immutable, requires a registered `encryptedSymmetricKeyDigestHex` (SHA-256 of the base64-decoded wrapped key) and binds that digest and `keyVersion` at use-time, before decrypt. Legacy immutable sources use their signed canonical wire digest, while older digest-less policies retain prior behavior; mutable legacy sources retain wrapped-key rotation. A copied `exact` selector cannot authorize a descendant or sibling resource. Details: TC-2192
 - Path-scoped Share policy sessions (`contentSource.encryptionKeyPath = share/<shareId>`) are minted with `remainingRedelegationDepth = 0`, preventing re-delegation. Policies without that field retain depth 8 and their existing delegation behavior; ordinary delegations are unchanged. Details: TC-2192
diff --git a/Cargo.lock b/Cargo.lock
index 68bcaa71..c57ba16a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9953,7 +9953,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.25.13"
+version = "1.25.14"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index 56588768..aa20ae06 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8019,7 +8019,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.25.13"
+version = "1.25.14"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index 4017ec9a..f8383152 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.25.13"
+version = "1.25.14"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"