diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index e7650f7..1354356 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -4,6 +4,11 @@ on:
   push:
     branches: [main]
     paths: [Cargo.lock, Cargo.toml]
+  # No paths filter here on purpose. This job is a required status check on
+  # main, and a required check that is skipped never reports — it leaves the
+  # PR permanently blocked. It must run on every pull request.
+  pull_request:
+    branches: [main]
   schedule:
     - cron: "0 0 * * 0"
   workflow_dispatch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35b9955..eefdece 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,12 +4,13 @@ All notable changes to linear-cli will be documented in this file.
 
 Versioning follows [CalVer](https://calver.org/) with format `YYYY.MM.PATCH`.
 
-## [Unreleased]
+## [2026.9.0] — 2026-09-06
 
 The weekly Security Audit workflow had been failing since 2026-07-19 without running its audit, so five advisories accumulated undetected. The workflow is fixed and all five are cleared. Severity: LOW — one advisory was reachable in principle and rated low by upstream; the rest were unreachable, dev-only, or lockfile-only.
 
 ### Fixed
 - Security Audit workflow now builds `cargo-audit` with the latest stable toolchain. `rustsec/audit-check` installs the tool unlocked, so it resolved `kstring 2.0.4`, which requires rustc 1.96 — the job's pinned 1.94 channel could not compile it, and the audit had not actually run for seven consecutive weeks. `RUSTUP_TOOLCHAIN` now overrides `rust-toolchain.toml` for that job only; the crate's pinned channel is unchanged everywhere else.
+- Security Audit now runs on every pull request, with no path filter. It is a required status check on `main`, and a required check that is skipped never reports its status — so any PR that did not touch `Cargo.toml` or `Cargo.lock` was left permanently unmergeable. The `push` trigger keeps its path filter.
 
 ### Security
 - Bumped `crossbeam-epoch` to 0.9.20 to patch RUSTSEC-2026-0204 (invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared`). Transitive via `termimad` — `lin` never formats those types.
diff --git a/Cargo.lock b/Cargo.lock
index 98cc425..13cb67a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1184,7 +1184,7 @@ dependencies = [
 
 [[package]]
 name = "lincli"
-version = "2026.5.5"
+version = "2026.9.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
diff --git a/Cargo.toml b/Cargo.toml
index af3ddec..ee5dd7a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "lincli"
-version = "2026.5.5"
+version = "2026.9.0"
 edition = "2024"
 description = "Fast, agent-friendly Linear CLI — manage issues, projects, cycles from the terminal"
 license = "MIT"