diff --git a/_posts/2026-07-16-release-0_23_0.md b/_posts/2026-07-16-release-0_23_0.md
new file mode 100644
index 00000000..8f7e3ec0
--- /dev/null
+++ b/_posts/2026-07-16-release-0_23_0.md
@@ -0,0 +1,71 @@
+---
+layout: post
+title: "Kroxylicious release 0.23.0"
+date: 2026-07-16 00:00:00 +0000
+author: "Keith Wall"
+author_url: "https://github.com/k-wall"
+# noinspection YAMLSchemaValidation
+categories: blog kroxylicious-proxy releases
+tags: [ "releases", "kroxylicious-proxy" ]
+---
+
+Kroxylicious 0.23.0 has snapped🐊 into existence!
+
+This release adds PEM key material support to the KMS integrations, and adds support for multi-tenancy in the Thales Cipher Trust Manager integration.
+Router API integration work continues in incubation.
+
+Check out the full [Changelog](https://github.com/kroxylicious/kroxylicious/blob/main/CHANGELOG.md#0230) for everything including deprecations, changes, and removals.
+
+Here are the highlights:
+
+### PEM Key Material for KMS Integrations
+
+A long-standing request (this one goes all the way back to [#933](https://github.com/kroxylicious/kroxylicious/issues/933)!) is finally hatched: the KMS integrations now support PEM format key material for TLS trust and client identity. PKCS#1 and PKCS#8 private key formats are both supported.
+You can configure TLS for your KMS provider directly from PEM certificates, without converting to PKCS#12 keystores first.
+
+### CipherTrust Manager Multi-Tenant Support
+
+The CipherTrust Manager KMS plugin now supports an optional `domain` field in `userCredentials`.
+When set, the password-grant token request is scoped to that domain, enabling multi-tenant CipherTrust deployments where different virtual clusters authenticate against different CipherTrust domains:
+
+```yaml
+kms: CipherTrustKmsService
+kmsConfig:
+  endpointUrl: https://ctm.example.com
+  userCredentials:
+    username: myuser
+    password:
+      passwordFile: /path/to/password
+    domain: my-tenant-domain
+```
+
+If you use client certificate based authentication, domains are supported too.
+
+### Cross-Namespace Strimzi References
+
+[Rafael Reia](https://github.com/RafaelReia) contributed support for cross-namespace Strimzi Kafka references.
+`KafkaService.spec.strimziKafkaRef.namespace` can now point to a Strimzi `Kafka` cluster in any watched namespace, not just the namespace of the `KafkaService` itself.
+This is particularly useful for organisations that separate their Kafka infrastructure and proxy configurations into different namespaces.
+
+### Router API Integration 
+
+We continued integrating the [Router API](https://github.com/kroxylicious/design/blob/main/proposals/070-routing-api.md) into the heart of the proxy.
+A `RouterFactory` can now create a `Router` that fans out requests (`RouterContext.sendRequest()`) from a single client connection to multiple upstream clusters based on request content.
+
+This is still an incubating feature and not ready for production, but if you're curious, unlock the feature flag `KROXYLICIOUS_UNLOCK_ROUTING=true` (environment variable) and get routing! We'd love to hear your feedback.
+
+### Community Contributions
+
+This release included commits from:
+
+[AdityaThakur1998](https://github.com/AdityaThakur1998), [Dahyun Woo](https://github.com/dahyvuun), [DeCluttered](https://github.com/Decluttered), [Geonhyeon Kim](https://github.com/gggeon96), Keith Wall, [M Clavo](https://github.com/MClavo), [Rafael Reia](https://github.com/RafaelReia), Robert Young, Sam Barker, Tom Bentley, [Urjit Patel](https://github.com/Uzziee)
+
+Thank you all!
+
+### Artefacts
+
+Download binary distributions and container images from the [download](https://kroxylicious.io/download/0.23.0/) page.
+
+### Feedback
+
+Drop by and say hello on [Slack](https://kroxylicious.slack.com), [GitHub](https://github.com/kroxylicious/kroxylicious/issues), or [bsky](https://bsky.app/profile/kroxylicious.io). You can also join us in person at a [community call]({% link join-us/community-call/index.md %}).