diff --git a/CHANGELOG.md b/CHANGELOG.md
index d7fb565c..b7091742 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,76 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md).
 For how long each fixed defect had been shipping before it was found, see
 [docs/defect-windows.md](docs/defect-windows.md).
 
+## v0.8.0
+
+A security and correctness release, from an audit of the codebase against its own
+requirements and against current Android/Tauri practice. Most of it is invisible
+in use; three things change behaviour you can see, listed first.
+
+### ✨ Changes
+
+- **The app no longer backs its data up to your Google account.** It never
+  should have: `allowBackup` was on by default, which sent the library catalogue
+  and watch history off the device — and the credentials went with it in a form
+  that could never be read again, because they are encrypted under an Android
+  Keystore key and Keystore keys are never backed up. Restoring onto a new phone
+  therefore produced ciphertext with no key: an authentication failure with no
+  explanation. Backup is now off, for device-to-device transfer as well as cloud
+  (a separate channel with the identical failure), and an unreadable credential
+  blob is now treated as "logged out" rather than an error, so the next sign-in
+  repairs it. (UR-012 → DR-135)
+
+- **The app no longer offers itself as an Android TV app.** (This is about the
+  app icon on a TV device's home screen — your TV shows library is untouched.)
+  It advertised a leanback launcher entry without any of what makes a TV app work — no D-pad focus model,
+  no banner, and a missing touchscreen declaration that fails Play's TV
+  validation. Launching it on a TV would have landed you in a UI you could not
+  navigate. It can be re-declared when TV support is actually built.
+
+- **Lockscreen skip scrubs a film instead of leaving it.** While a video's audio
+  plays in the background, the skip buttons jump 30 seconds forward and 10
+  seconds back, rather than advancing to the next episode. There is no "next
+  track" inside a film, and pressing skip to re-hear a line should not eject you
+  from what you are watching. Music is unchanged: skip still moves through the
+  queue. (UR-040, UR-006 → DR-201)
+
+### 🔒 Security
+
+- **The webview now runs under a Content-Security-Policy.** It had none, so any
+  script reaching the web layer inherited the full IPC surface. `script-src` is
+  now `'self'` with no inline or eval, and plugins and frames are refused
+  outright. (UR-071 → DR-198)
+
+- **The webview stops undoing the network security config.** It set a blanket
+  cleartext opt-in by hand, along with file and content access it never used —
+  defeating the config that exists to block exactly that, and whose own comment
+  warned against it. (UR-071 → DR-199)
+
+- **The asset protocol no longer reaches the database or the credential store.**
+  Its scope was the whole app data directory; it is now the one subdirectory it
+  serves. (UR-012, UR-071 → DR-198)
+
+### 🐛 Fixes
+
+- **A credential store that could not be read is now recoverable.** The decrypt
+  failure surfaced as a hard error rather than a logged-out state, so the app got
+  stuck instead of offering the login screen. (UR-012 → DR-135)
+
+### 🔧 Internal
+
+- CI now enforces the checks the contributor rules already required —
+  `cargo fmt --check` and clippy — neither of which had ever run there. The
+  traceability gate was also raised from 50% to 82%, a floor low enough that half
+  the matrix could rot before it fired, and a new check fails the build on a
+  requirement ID that no longer exists.
+- Twelve requirements marked "Done" carried no implementation trace at all;
+  they are now tagged, and stale integration requirements that named a backend
+  never built have been re-scoped to the ones that actually deliver them.
+  Coverage moved 86% → 90%.
+- The Rust lint backlog is cleared (51 warnings → 0), and a flaky test that
+  intermittently reddened CI is fixed — it was paying a cold module-transform
+  cost inside a test body, not waiting on a timer.
+
 ## v0.7.0
 
 ### ✨ Changes
diff --git a/package.json b/package.json
index 403ef2e1..a3c51585 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jellytau",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "",
   "type": "module",
   "packageManager": "bun@1.3.5",
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 14695b25..7af9e8fc 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -2018,7 +2018,7 @@ dependencies = [
 
 [[package]]
 name = "jellytau"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "aes-gcm",
  "async-trait",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index e406fabc..1aa37447 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "jellytau"
-version = "0.7.0"
+version = "0.8.0"
 description = "A Tauri App"
 authors = ["you"]
 edition = "2021"
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 9755e824..77e0753f 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "jellytau",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "identifier": "com.dtourolle.jellytau",
   "build": {
     "beforeDevCommand": "bun run dev",