diff --git a/CHANGELOG.md b/CHANGELOG.md
index a899f76e..b6f1273e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [1.25.15] - 2026-11-01
+
+### Changes
+- `/policy/v3/*` responses carry the same CORS headers as `/invoke` (`Access-Control-Allow-Origin: *`, the same allowed methods and headers, a 7200 s preflight `Max-Age`), for every origin, without `Access-Control-Allow-Credentials`. These paths no longer use the single `shareEmail` allowed origin and its fixed `GET, POST` method list; they keep `Cache-Control: no-store`, `X-Content-Type-Options: nosniff` and `Referrer-Policy: no-referrer`. With `cors = false` they now carry no CORS headers, like every other route. Details: TC-2192 (#490)
+- Internal, not reachable over HTTP: `tinycloud-threshold` bounds raw combine inputs (TC-2219, #491), gains a genesis DKG over owner-closed rounds with its test vector (TC-2220, #492; no route, no `/info` feature, and `tinycloud-node` does not depend on the crate), and its certificate-core vectors have a checker (TC-2223, #489).
+- CI only: the workspace test job is split and the PR Docker build caches its cargo mounts (#495).
+
 ## [1.25.14] - 2026-10-29
 
 ### Changes
diff --git a/Cargo.lock b/Cargo.lock
index c57ba16a..23569135 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9953,7 +9953,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.25.14"
+version = "1.25.15"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index aa20ae06..b5866d57 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8019,7 +8019,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.25.14"
+version = "1.25.15"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index f8383152..66f703a8 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.25.14"
+version = "1.25.15"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"