diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 13708fa58..64f3cdd64 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.7.1"
+  ".": "0.8.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c864d846..c45636d83 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,121 @@
 # Changelog
 
+## [0.8.0](https://github.com/Gitlawb/node/compare/v0.7.1...v0.8.0) (2026-08-26)
+
+
+### ⚠ BREAKING CHANGES
+
+* **node:** `git-receive-pack` now rejects a push whose authenticated DID is not the repo owner, returning 403 before any ref update is applied. Delegated and CI keys count as non-owners: a UCAN `git/push` capability is verified but not yet honored for authorization, so an agent pushing under its own DID cannot push while this is on. Set `GITLAWB_ENFORCE_OWNER_PUSH=false` during a rolling upgrade, or have automation push as the repo owner, until scoped collaborator / UCAN-delegated push rights land.
+
+### Features
+
+* **core:** carry the resumed candidate's identity in the scan token ([2656718](https://github.com/Gitlawb/node/commit/2656718916ab9c68dd7fccb8f6fba8bba6b43e82))
+* **node,git:** cap concurrent served git ops with a 503 load-shed ([#62](https://github.com/Gitlawb/node/issues/62)) ([5981257](https://github.com/Gitlawb/node/commit/5981257be582fe1d39980bb2b1b3ff5c98448e84))
+
+
+### Bug Fixes
+
+* **attest:** use strict Ed25519 verification with regression test ([1fcbbbd](https://github.com/Gitlawb/node/commit/1fcbbbd89c027ae7d1d903f705631d94f8dfbadc))
+* **ci:** add tested release tag resolver ([1b65f70](https://github.com/Gitlawb/node/commit/1b65f70403ab47ced8c2828745c1c79c89a185e4))
+* **ci:** recognize namespaced test attributes in pr-triage's needs-tests check ([1989fcc](https://github.com/Gitlawb/node/commit/1989fcca112d0efb56978efe09d9a836afa7cb59))
+* **ci:** reject unsafe release dispatch tags ([7b365b0](https://github.com/Gitlawb/node/commit/7b365b0dc3ef3b5e3d14fd62bccc434e57200612))
+* **ci:** reject unsafe release dispatch tags ([0b990d6](https://github.com/Gitlawb/node/commit/0b990d687f0eb379b62eb600ede2a6233017e419))
+* **core:** count distinct signer DIDs in certificate threshold check ([3993fd1](https://github.com/Gitlawb/node/commit/3993fd1f5daacbebb8f8e2c62af8856c493ec87a))
+* **core:** Count distinct signer DIDs in certificate threshold check ([50d3cbb](https://github.com/Gitlawb/node/commit/50d3cbbe97f77b3cab9fab220add9f3a0d0dbc2f))
+* **core:** enforce strict RFC 8032 Ed25519 signature verification ([425ebf4](https://github.com/Gitlawb/node/commit/425ebf40e7737f44c5fe4e9dc8995c8aeb074ce1))
+* **core:** put the redirect predicate behind a feature so core stays lean ([c82a70a](https://github.com/Gitlawb/node/commit/c82a70ab21a21192b2579693b7d7c13aeb8a4d20))
+* **core:** refuse a redirect that rewrites the signed request-target ([5c0d6f3](https://github.com/Gitlawb/node/commit/5c0d6f32522adea8f167f8e445a26377b6fe3963))
+* **core:** share the origin-scoped redirect rule with the git helper ([ba44a01](https://github.com/Gitlawb/node/commit/ba44a018ec8945b447977d89fc6a10d98fc1bb7b))
+* **core:** use strict Ed25519 signature verification ([a6c13be](https://github.com/Gitlawb/node/commit/a6c13be15b1421f3791e49a8219ea739f1e3ec6e))
+* **git-remote:** abort fetch on EOF without POSTing; harden the real-git test harness ([#192](https://github.com/Gitlawb/node/issues/192)) ([1cb930c](https://github.com/Gitlawb/node/commit/1cb930cbd57ea5d232edddc8e50dc94fab4362a5))
+* **git-remote:** drive multi-round fetch as a v0 stateless-RPC client loop ([#117](https://github.com/Gitlawb/node/issues/117)) ([5fdf155](https://github.com/Gitlawb/node/commit/5fdf155c7fd7398f61c200c256cb7327729f378a))
+* **git-remote:** drive multi-round fetch as a v0 stateless-RPC client loop ([#117](https://github.com/Gitlawb/node/issues/117)) ([a64b141](https://github.com/Gitlawb/node/commit/a64b14150dfb7e369c16e5fab98375ba0ce38404))
+* **git-remote:** normalize the shim's accepted socket to blocking ([10e0840](https://github.com/Gitlawb/node/commit/10e0840dd95204d2b8faa1c594808e2ad57bc9c4))
+* **git-remote:** normalize the shim's accepted socket to blocking ([#192](https://github.com/Gitlawb/node/issues/192)) ([8d7f95f](https://github.com/Gitlawb/node/commit/8d7f95fd63769ef30540f216190e1bb52ccd4f69))
+* **git-remote:** reject malformed pkt-line length headers instead of flushing ([8c04043](https://github.com/Gitlawb/node/commit/8c04043fb56b5030a0aa6b328c91f20173352aa6))
+* **git-remote:** skip content-free flush rounds in the fetch loop ([#117](https://github.com/Gitlawb/node/issues/117)) ([68ba492](https://github.com/Gitlawb/node/commit/68ba49267c8d65169ab9adf0552761f87baba4c1))
+* **gl:** accept the resume token the incomplete-scan message tells you to pass ([181f617](https://github.com/Gitlawb/node/commit/181f6178a0e0f5b9506093fa7579ad6ef8dd2ff5))
+* **gl:** assert 404 verdict and harden transport error handling in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([a329174](https://github.com/Gitlawb/node/commit/a3291741757038307e61d3952e6c20aa4901c8a3))
+* **gl:** assert whoami 404 verdict and preserve transport error cause ([#220](https://github.com/Gitlawb/node/issues/220)) ([b4007a5](https://github.com/Gitlawb/node/commit/b4007a5e005c63aa0c083b969cd8b5f65b918adb))
+* **gl:** follow scan continuations in gl ipfs get, bounded three ways ([9a8d190](https://github.com/Gitlawb/node/commit/9a8d190492315cf767807dd1a98470debff4bd25))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([21c74c6](https://github.com/Gitlawb/node/commit/21c74c65d985200221489fa342d7419e8626362f))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([fd78cfa](https://github.com/Gitlawb/node/commit/fd78cfa3ad0e7997b284371a55b7fb52753236d1))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([3cc15cf](https://github.com/Gitlawb/node/commit/3cc15cf7247396ab1efcd279d3dd51dd8deaf014))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([16cc3b3](https://github.com/Gitlawb/node/commit/16cc3b37e8268d048f3145ab16978dae297df5d4))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([3f41df5](https://github.com/Gitlawb/node/commit/3f41df5868838544876473c2560c3d6be20e679c))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([b0e5cc0](https://github.com/Gitlawb/node/commit/b0e5cc0ee0e91ebe35689bb1e073fa7e48ab37ee))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([12bc759](https://github.com/Gitlawb/node/commit/12bc759ea6b20ab97c9dfeb4e00d7c6a6ca4fcfe))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([10e3492](https://github.com/Gitlawb/node/commit/10e34928254205fafa8e96513a3df7899bfb10b1))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([c10f2ca](https://github.com/Gitlawb/node/commit/c10f2ca255d63331f6acf3a29629e2a1c11ff355))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([3add535](https://github.com/Gitlawb/node/commit/3add5356e36f0c2f89a0617fcb8018209bf722ff))
+* **gl:** only report registered: false on 404 in whoami ([#220](https://github.com/Gitlawb/node/issues/220)) ([fdd1103](https://github.com/Gitlawb/node/commit/fdd11030dc55a68142441ecf05f0bf33a8d38695))
+* **gl:** read whoami error bodies through CappedBody.text ([bfc44f9](https://github.com/Gitlawb/node/commit/bfc44f926d08c0bf774e2c05dd76b245871294f1))
+* **gl:** read whoami error bodies through CappedBody.text ([4725146](https://github.com/Gitlawb/node/commit/4725146db2c13cd3b8f998260d9df3a4b5f70c9e))
+* **gl:** require non-empty error message and use ephemeral port in whoami tests ([#220](https://github.com/Gitlawb/node/issues/220)) ([a27a267](https://github.com/Gitlawb/node/commit/a27a2678712cc512b316f143d8c053dbdf981a4b))
+* **gl:** sanitize full transport error chain in whoami, remove raw error attachment ([#220](https://github.com/Gitlawb/node/issues/220)) ([39ce655](https://github.com/Gitlawb/node/commit/39ce655904f516094cbbef6f2ee585906ef77e05))
+* **gl:** stop carrying request signatures to a host the node redirected us to ([de3f230](https://github.com/Gitlawb/node/commit/de3f230940f21d88da48a972bddeb877420d2165))
+* **infra:** serialize the upgrade and write compose through a unique temp path ([888fab6](https://github.com/Gitlawb/node/commit/888fab602828dc8b514cfa5fbb4d027a3a2db019))
+* **ipfs:** page the legacy CID scan instead of materializing every repo ([4985e38](https://github.com/Gitlawb/node/commit/4985e38af2bd629fa81ec70aec63937ed9894b73))
+* **node,infra,macos:** make the owner-push opt-out reach every launch path ([1f0d9ff](https://github.com/Gitlawb/node/commit/1f0d9ff368c0169048aeec219de4114c2630dff6))
+* **node:** bind a peer row to its DID so only its keyholder can repoint it ([#273](https://github.com/Gitlawb/node/issues/273)) ([8d38043](https://github.com/Gitlawb/node/commit/8d38043a4ca7d0df3c9a4c4bdbb171d7adcdec4f))
+* **node:** bound legacy readiness fallback ([5af14c2](https://github.com/Gitlawb/node/commit/5af14c203d07fdd2d0b5689fcb12e189237dbbb2))
+* **node:** bound peer failure tracking ([74f7554](https://github.com/Gitlawb/node/commit/74f75548941712573d344aa058d162f40189b4df))
+* **node:** bound the fruitless reads one sweep run will spend ([e4aaae8](https://github.com/Gitlawb/node/commit/e4aaae8c5229355010ca710abf22c181210201c3))
+* **node:** bound the legacy CID scan and let the caller carry its position ([22f4db9](https://github.com/Gitlawb/node/commit/22f4db94b2fb3b3c7c43c5bd34608ea77ce5d197))
+* **node:** bound the legacy scan's query by the remaining row budget ([21e6873](https://github.com/Gitlawb/node/commit/21e687368336fd219d82308ee20b3d6bb018a3dc))
+* **node:** bound the legacy-repair read by the pin batch deadline ([ea2219b](https://github.com/Gitlawb/node/commit/ea2219b2cb635da61f120f65434db4c427494f6c))
+* **node:** bound the pin loops' DB work by the batch deadline, both lanes ([9984e08](https://github.com/Gitlawb/node/commit/9984e082121f3e8d25750dd54c0d60c85cef0ac7))
+* **node:** bound the pre-walk CID resolve on its own short budget ([0d7711c](https://github.com/Gitlawb/node/commit/0d7711c08917a70f982391249439485ddce382b0))
+* **node:** bring the Pinata pin path back into lockstep with the Kubo one ([4681f54](https://github.com/Gitlawb/node/commit/4681f54327b58b6ebdd569a1cec17a3c2643ad13))
+* **node:** budget provenance and fallback walks separately ([ae96ffa](https://github.com/Gitlawb/node/commit/ae96ffa46706a6d088a412aa02dbf2f715ceaa37))
+* **node:** carry discovery onto the per-(oid, repo) incompleteness marker ([bd0bef1](https://github.com/Gitlawb/node/commit/bd0bef1476f90e99d9a697e2520c32b954f3ba6f))
+* **node:** charge discovery's probes against the per-run read budget ([bc20236](https://github.com/Gitlawb/node/commit/bc202368e13202504fe77534273b508f7559a84a))
+* **node:** clamp every admission-held DB await in the CID resolver ([bad82b3](https://github.com/Gitlawb/node/commit/bad82b3cd9fa970ebf67817395bfbd98591879b1))
+* **node:** close review findings on the owner-push default ([2f0174c](https://github.com/Gitlawb/node/commit/2f0174cc041fb6e9eb3c904172b37b5b9a6c094b))
+* **node:** count a completed fetch once per fetch, not per stateless-RPC POST ([1c690c1](https://github.com/Gitlawb/node/commit/1c690c125c16ad2ed38a5885d0e16b96789b715e))
+* **node:** count fetch completion from the response outcome, not the request ([5a5d4e1](https://github.com/Gitlawb/node/commit/5a5d4e1b43a5b37fcc57731ec504b221a58931f1))
+* **node:** enforce owner-only push by default ([cdbda19](https://github.com/Gitlawb/node/commit/cdbda19c29db576d2ea37ae74578c899b4eb3bb9))
+* **node:** Escape LIKE metacharacters in certificate prefix search ([eeafa1f](https://github.com/Gitlawb/node/commit/eeafa1fa5350fb2d15ba30ac6cd6ad8247b4b7ec))
+* **node:** Escape LIKE wildcards in certificate prefix search ([96d8123](https://github.com/Gitlawb/node/commit/96d8123e0f84e85a7b0234ad84f5e603a5a303aa))
+* **node:** gate GET /ipfs/{cid} tree objects so a withheld subtree's structure can't leak ([#135](https://github.com/Gitlawb/node/issues/135)) ([21f8cb6](https://github.com/Gitlawb/node/commit/21f8cb61350b2355edd2b2ed527d9fb9c4305bd9))
+* **node:** gate two Unix-only tests so the crate compiles on Windows ([5a7a77b](https://github.com/Gitlawb/node/commit/5a7a77b8dc1723cde44b0439327e517e23a048ab)), closes [#228](https://github.com/Gitlawb/node/issues/228)
+* **node:** give each discovery row its own slice of the pass budget ([22560b0](https://github.com/Gitlawb/node/commit/22560b0872bd16dd66100681b1050faa677fc568))
+* **node:** harden peer readiness state ([6bd8f41](https://github.com/Gitlawb/node/commit/6bd8f4121235ec6c4b7062aadcf3a631f174510c))
+* **node:** make metrics::init race-safe with Once ([c45ec96](https://github.com/Gitlawb/node/commit/c45ec9605d55171f7b8f1b0b542478097ddf43a3))
+* **node:** make the pin-source incompleteness marker per (object, repo) ([5575da4](https://github.com/Gitlawb/node/commit/5575da4b65ff19da78a6b218da07f854706a811c))
+* **node:** map ipfs/arweave DB outages to 503 via bare ? ([#251](https://github.com/Gitlawb/node/issues/251)) ([0e2328b](https://github.com/Gitlawb/node/commit/0e2328bd8044ce6e8923cc6bd42219068d3f6b9d))
+* **node:** map ipfs/arweave DB outages to 503 via bare ? ([#251](https://github.com/Gitlawb/node/issues/251)) ([c29a91a](https://github.com/Gitlawb/node/commit/c29a91af6b7eb444e202f4724e3f677d2ef25466))
+* **node:** mint a continuation when a ceiling stops the /ipfs scan mid-page ([69cfbd4](https://github.com/Gitlawb/node/commit/69cfbd4b3ccde243ff669392820f0fce86381663))
+* **node:** never hand back a continuation that made no progress ([76f6300](https://github.com/Gitlawb/node/commit/76f630008f0088c952755b643126affdf962d12b))
+* **node:** opaque AppError::Internal and AppError::Db HTTP bodies ([#226](https://github.com/Gitlawb/node/issues/226)) ([241b366](https://github.com/Gitlawb/node/commit/241b36633bca7e0ead33bf670b7c1531c3bd9ab5))
+* **node:** opaque AppError::Internal and AppError::Db HTTP bodies ([#226](https://github.com/Gitlawb/node/issues/226)) ([d192028](https://github.com/Gitlawb/node/commit/d192028ee1487a3638c545d6a39e58a4575df1f1))
+* **node:** opaque GraphQL DB error messages ([#250](https://github.com/Gitlawb/node/issues/250)) ([c10ccf1](https://github.com/Gitlawb/node/commit/c10ccf1f059eae18fcb0b7058a35bb134838b790))
+* **node:** order the CID candidate list so it cannot depend on heap order ([366b599](https://github.com/Gitlawb/node/commit/366b59933112b345113501a65f0f30e76518ff61))
+* **node:** port discovery's candidate load onto the paged repo query ([4c665fb](https://github.com/Gitlawb/node/commit/4c665fbca8641f7dfe6770d1ee5384a0af3d215c))
+* **node:** preserve legacy peer compatibility ([547f9ae](https://github.com/Gitlawb/node/commit/547f9aed10706bc617d0e1e2e5346cf52d19a901))
+* **node:** record a discovered source and its marker in one commit ([9babb5e](https://github.com/Gitlawb/node/commit/9babb5ece053608c522f49b4528de23d5b61b749))
+* **node:** repair source-less legacy pins by bounded additive discovery ([d88c0c7](https://github.com/Gitlawb/node/commit/d88c0c726c8630e104e0161366d1815d69e96428))
+* **node:** resume the /ipfs scan per candidate so a starved one is not skipped ([d0635d9](https://github.com/Gitlawb/node/commit/d0635d95b7d601490474419c6bdb99b0ce402e71))
+* **node:** rewind the pin repair sweep cursor on every completed walk ([1b44b12](https://github.com/Gitlawb/node/commit/1b44b12b468c265f946390a57cd815d67d205166))
+* **node:** rotate discovery candidates across traversals ([4fdfa1c](https://github.com/Gitlawb/node/commit/4fdfa1cedb3dcb6d7d6cc4004e7277a9fa95de94))
+* **node:** size the ipfs work floor for provenance walks plus one full search ([dc5daa1](https://github.com/Gitlawb/node/commit/dc5daa14b4d0816d8a14fabdf057259c1d177a46))
+* **node:** stop reporting a Kubo pin whose DB record never landed ([f839fb9](https://github.com/Gitlawb/node/commit/f839fb924653f1b012c2b34d51260ea3faba7f62))
+* **node:** stop the /ipfs size probe reporting a fault as a missing object ([ed6355e](https://github.com/Gitlawb/node/commit/ed6355ed2c42bed09dec35d46904805e97de806c))
+* **node:** use readiness for peer liveness ([225644a](https://github.com/Gitlawb/node/commit/225644a3ea0302ae91959016928df1040ddd9cb5))
+* **node:** use readiness for peer liveness ([1a841a9](https://github.com/Gitlawb/node/commit/1a841a99e2d40129a33f1898d3ce28d05eb04632))
+* **release:** bump icaptcha-client with the rest of the workspace ([6668525](https://github.com/Gitlawb/node/commit/6668525f41936ed2e1f8a1334b0dd17eaea866f0))
+* **repo_store:** use SHA-256 for stable advisory-lock key ([#210](https://github.com/Gitlawb/node/issues/210)) ([c380f9c](https://github.com/Gitlawb/node/commit/c380f9cee5139a2cab6fc52000d43844b86bb143))
+* **repo_store:** use SHA-256 for stable advisory-lock key ([#210](https://github.com/Gitlawb/node/issues/210)) ([89e10d0](https://github.com/Gitlawb/node/commit/89e10d0ff12dcccae3bd4490548d906f77d76636))
+* **review:** assert the read-timeout postcondition and drop the socket clone ([4d9bd5a](https://github.com/Gitlawb/node/commit/4d9bd5a18a0692baa67f94aac8e8663d8e69bdac))
+* **review:** bound the probe's channel waits and stop overstating the handshake ([d4e5ecf](https://github.com/Gitlawb/node/commit/d4e5ecf299afaabf05eee22db462b9314b5a6998))
+* **review:** bound token key, rule bytes, and the discovery load ([e6cfb58](https://github.com/Gitlawb/node/commit/e6cfb588c2a1600d59f2af88471d248a99532f03))
+* **review:** keep the resume token on every terminal that still holds one ([8c39cfd](https://github.com/Gitlawb/node/commit/8c39cfdcb347ca824cbec7d6b56720df9517a472))
+* **review:** make the coupled sites findable and pin two more properties ([a7e8e35](https://github.com/Gitlawb/node/commit/a7e8e35030cae4e1126cda6c161bc516e3b8ffff))
+* **review:** make the LIKE escape independent of the SQL parser mode ([1d3987b](https://github.com/Gitlawb/node/commit/1d3987bba6619a64a2cef15023224cbaa6cc8d1b)), closes [#319](https://github.com/Gitlawb/node/issues/319)
+* **review:** mint a continuation at every ceiling and widen the token ([342dd48](https://github.com/Gitlawb/node/commit/342dd48d2426a8870423cd537781b52d03e8f175))
+* **test:** match SHA-256 advisory-lock key in receive-pack deadline test ([c68e1b0](https://github.com/Gitlawb/node/commit/c68e1b07f8db752cff786bdc9c226b49889a40b1))
+* **whoami:** update registered status handling on 404 response ([75b0df8](https://github.com/Gitlawb/node/commit/75b0df8f1c7bda6a02444ce17e11088b839a51b6))
+
 ## [0.7.1](https://github.com/Gitlawb/node/compare/v0.7.0...v0.7.1) (2026-08-03)
 
 
diff --git a/Cargo.lock b/Cargo.lock
index 3f29b0767..6e2236a20 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3374,7 +3374,7 @@ dependencies = [
 
 [[package]]
 name = "git-remote-gitlawb"
-version = "0.7.1"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "gitlawb-core",
@@ -3389,7 +3389,7 @@ dependencies = [
 
 [[package]]
 name = "gitlawb-attest"
-version = "0.7.1"
+version = "0.8.0"
 dependencies = [
  "base64",
  "ed25519-dalek",
@@ -3406,7 +3406,7 @@ dependencies = [
 
 [[package]]
 name = "gitlawb-core"
-version = "0.7.1"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -3434,7 +3434,7 @@ dependencies = [
 
 [[package]]
 name = "gitlawb-node"
-version = "0.7.1"
+version = "0.8.0"
 dependencies = [
  "alloy",
  "anyhow",
@@ -3490,7 +3490,7 @@ dependencies = [
 
 [[package]]
 name = "gl"
-version = "0.7.1"
+version = "0.8.0"
 dependencies = [
  "alloy",
  "anyhow",
@@ -3896,7 +3896,7 @@ dependencies = [
 
 [[package]]
 name = "icaptcha-client"
-version = "0.4.0"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "gitlawb-core",
diff --git a/crates/git-remote-gitlawb/Cargo.toml b/crates/git-remote-gitlawb/Cargo.toml
index b704329ec..e271708b1 100644
--- a/crates/git-remote-gitlawb/Cargo.toml
+++ b/crates/git-remote-gitlawb/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "git-remote-gitlawb"
 description = "Git remote helper — enables 'git clone gitlawb://did:gitlawb:...'"
-version = "0.7.1" # x-release-please-version
+version = "0.8.0" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
diff --git a/crates/gitlawb-attest/Cargo.toml b/crates/gitlawb-attest/Cargo.toml
index e6276b1fd..edceb6730 100644
--- a/crates/gitlawb-attest/Cargo.toml
+++ b/crates/gitlawb-attest/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "gitlawb-attest"
 description = "External Attestation v1: pluggable provenance attachments for gitlawb ref-update certs"
-version = "0.7.1" # x-release-please-version
+version = "0.8.0" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
diff --git a/crates/gitlawb-core/Cargo.toml b/crates/gitlawb-core/Cargo.toml
index 67e9ed9c1..95fe9cf54 100644
--- a/crates/gitlawb-core/Cargo.toml
+++ b/crates/gitlawb-core/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "gitlawb-core"
 description = "Core cryptographic primitives for the gitlawb network: DIDs, CIDs, UCAN, HTTP Signatures, ref-update certificates"
-version = "0.7.1" # x-release-please-version
+version = "0.8.0" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
diff --git a/crates/gitlawb-node/Cargo.toml b/crates/gitlawb-node/Cargo.toml
index c583569cb..c95152694 100644
--- a/crates/gitlawb-node/Cargo.toml
+++ b/crates/gitlawb-node/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "gitlawb-node"
 description = "The gitlawb node daemon — git hosting over HTTP with DID auth"
-version = "0.7.1" # x-release-please-version
+version = "0.8.0" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
diff --git a/crates/gl/Cargo.toml b/crates/gl/Cargo.toml
index 2b973a4c6..6e1d918b3 100644
--- a/crates/gl/Cargo.toml
+++ b/crates/gl/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "gl"
 description = "The gitlawb CLI — identity management, node control, MCP server"
-version = "0.7.1" # x-release-please-version
+version = "0.8.0" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
diff --git a/crates/icaptcha-client/Cargo.toml b/crates/icaptcha-client/Cargo.toml
index 673785362..a2be3796b 100644
--- a/crates/icaptcha-client/Cargo.toml
+++ b/crates/icaptcha-client/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "icaptcha-client"
-version = "0.4.0" # x-release-please-version
+version = "0.8.0" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true