diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 70b8605..10a8b76 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,17 +11,25 @@ jobs:
   publish:
     name: Build and publish to PyPI
     runs-on: ubuntu-latest
+    environment: pypi
     permissions:
+      contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
+      - name: Verify release tag matches package version
+        run: |
+          package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          test "${GITHUB_REF_NAME}" = "v${package_version}"
       - name: Build sdist and wheel
         run: |
           python -m pip install --upgrade pip build
           python -m build
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
diff --git a/.zenodo.json b/.zenodo.json
index f5603c3..6d477da 100644
--- a/.zenodo.json
+++ b/.zenodo.json
@@ -20,7 +20,7 @@
     "zero-LLM"
   ],
   "license": "MIT",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "related_identifiers": [
     {
       "identifier": "10.5281/zenodo.19042469",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27e4cef..f44d1f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.2 - 2026-08-04
+
+- Clarified the README and the boundary between lexical coverage and semantic
+  verification without changing checker behavior.
+- Added canonical package links and modernized license metadata.
+- Added a tag-bound OIDC Trusted Publishing workflow for PyPI.
+
+## 0.1.1 - 2026-05-30
+
+- Added citation and Zenodo metadata.
+- Aligned the public repository and Hermes Labs identity surfaces.
+
 ## 0.1.0
 
 - Initial public release.
diff --git a/CITATION.cff b/CITATION.cff
index 1ccb669..5d76fcd 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -9,7 +9,7 @@ authors:
     orcid: "https://orcid.org/0009-0005-4896-1112"
     affiliation: "Hermes Labs"
 license: MIT
-version: "0.1.1"
+version: "0.1.2"
 date-released: "2026-04-19"
 repository-code: "https://github.com/hermes-labs-ai/intent-verify"
 references:
diff --git a/pyproject.toml b/pyproject.toml
index 844af9c..8f9f68a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "intent-verify"
-version = "0.1.1"
+version = "0.1.2"
 description = "Repo intent verification and spec drift checks for markdown specs, handoffs, and codebases."
 readme = "README.md"
 requires-python = ">=3.10"