diff --git a/.changeset/rust-pii-hashing.md b/.changeset/rust-pii-hashing.md
deleted file mode 100644
index 6cc4d46..0000000
--- a/.changeset/rust-pii-hashing.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-'@smooai/observability': minor
----
-
-Rust: PII is now hashed rather than passed through. `pii::scrub_string` handled
-credentials only — `Bearer`, `password=`, `token`/`api_key`/`secret=`, `sk-…` —
-while the module doc claimed PII scrubbing, so an email or phone in a message,
-breadcrumb or GenAI tool argument reached the wire intact.
-
-Emails, phone numbers and street addresses are now detected and replaced with a
-keyed token: `a@b.com` → `[email:9f2a41c8]`. HMAC-SHA256, not a bare digest —
-those values are a small enumerable space a rainbow table reverses in seconds —
-and the org id is mixed into the message so identical PII hashes differently in
-different orgs. The type prefix stays visible, which keeps "are these two spans
-the same person?" answerable while storing nothing reversible.
-
-Credentials are still **dropped**, never hashed: a hash of a live token is a
-token oracle. With no key configured (`SMOOAI_OBSERVABILITY_PII_HASH_KEY`, or
-`pii::set_pii_hash_key`), personal identifiers are fully redacted rather than
-hashed under a guessable key.
-
-New: `pii::scrub_string_for_org`, `pii::scrub_headers_for_org`, `pii::pii_token`,
-`pii::PiiKind`, `pii::set_pii_hash_key`, `BootstrapEnv::pii_hash_key`.
-`scrub_string` / `scrub_headers` keep their signatures and now scrub personal
-identifiers too, under the empty org salt.
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 62ad88f..c776c3b 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,31 @@
 # @smooai/observability
 
+## 0.15.0
+
+### Minor Changes
+
+- 5648be2: Rust: PII is now hashed rather than passed through. `pii::scrub_string` handled
+  credentials only — `Bearer`, `password=`, `token`/`api_key`/`secret=`, `sk-…` —
+  while the module doc claimed PII scrubbing, so an email or phone in a message,
+  breadcrumb or GenAI tool argument reached the wire intact.
+
+  Emails, phone numbers and street addresses are now detected and replaced with a
+  keyed token: `a@b.com` → `[email:9f2a41c8]`. HMAC-SHA256, not a bare digest —
+  those values are a small enumerable space a rainbow table reverses in seconds —
+  and the org id is mixed into the message so identical PII hashes differently in
+  different orgs. The type prefix stays visible, which keeps "are these two spans
+  the same person?" answerable while storing nothing reversible.
+
+  Credentials are still **dropped**, never hashed: a hash of a live token is a
+  token oracle. With no key configured (`SMOOAI_OBSERVABILITY_PII_HASH_KEY`, or
+  `pii::set_pii_hash_key`), personal identifiers are fully redacted rather than
+  hashed under a guessable key.
+
+  New: `pii::scrub_string_for_org`, `pii::scrub_headers_for_org`, `pii::pii_token`,
+  `pii::PiiKind`, `pii::set_pii_hash_key`, `BootstrapEnv::pii_hash_key`.
+  `scrub_string` / `scrub_headers` keep their signatures and now scrub personal
+  identifiers too, under the empty org salt.
+
 ## 0.14.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 19f90ba..2773766 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@smooai/observability",
-    "version": "0.14.0",
+    "version": "0.15.0",
     "description": "Smoo AI Observability SDK — OTel-first error capture, traces, metrics, and React/Next.js integrations in a single package with subpath exports",
     "homepage": "https://github.com/SmooAI/observability",
     "bugs": {