diff --git a/.github/ISSUE_TEMPLATE/release-checklist.md b/.github/ISSUE_TEMPLATE/release-checklist.md
index 80a98f83a..3956c530d 100644
--- a/.github/ISSUE_TEMPLATE/release-checklist.md
+++ b/.github/ISSUE_TEMPLATE/release-checklist.md
@@ -23,5 +23,5 @@ Full release instructions are at: [RELEASING.md](/sigstore/sigstore-java/blob/ma
 
 ## Post Release
 - [ ] Update README if required
-- [ ] Update versions (`./scripts/update_version.sh`)
+- [ ] Update versions (`./scripts/update_versions.sh`)
 - [ ] Update CHANGELOG.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0136f310d..f3a55280c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,16 @@ All versions prior to 1.0.0 are untracked
 
 ## [Unreleased]
 
+# [2.3.0] - 2026-09-08
+
+## Added
+- Allow verifying bundles without transparency-log entries (for private deployments), relying on signed RFC 3161 timestamps: https://github.com/sigstore/sigstore-java/pull/1252
+- Add Automatic-Module-Name to sigstore-java: https://github.com/sigstore/sigstore-java/pull/1269
+- Support Gradle Project Isolation in the Gradle plugin: https://github.com/sigstore/sigstore-java/pull/1246
+
+## Fixed
+- Handle 409 responses from Rekor: https://github.com/sigstore/sigstore-java/pull/1266
+
 # [2.2.0] - 2026-06-10
 
 ## Added
diff --git a/build-logic/publishing/build.gradle.kts b/build-logic/publishing/build.gradle.kts
index 5792c1df1..1de0d4bb8 100644
--- a/build-logic/publishing/build.gradle.kts
+++ b/build-logic/publishing/build.gradle.kts
@@ -11,7 +11,7 @@ dependencies {
     implementation(project(":basics"))
     implementation(project(":jvm"))
     implementation("dev.sigstore.build-logic:gradle-plugin")
-    implementation("dev.sigstore:sigstore-gradle-sign-plugin:2.2.0")
+    implementation("dev.sigstore:sigstore-gradle-sign-plugin:2.3.0")
     implementation("com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin:2.1.1")
     implementation("com.gradleup.nmcp:com.gradleup.nmcp.gradle.plugin:1.6.2")
 }
diff --git a/examples/hello-world/build.gradle.kts b/examples/hello-world/build.gradle.kts
index cf20c6340..7cf934cd0 100644
--- a/examples/hello-world/build.gradle.kts
+++ b/examples/hello-world/build.gradle.kts
@@ -1,7 +1,7 @@
 plugins {
   `java-library`
   `maven-publish`
-  val sigstoreVersion = System.getProperty("sigstore.version") ?: "2.2.0"
+  val sigstoreVersion = System.getProperty("sigstore.version") ?: "2.3.0"
   id("dev.sigstore.sign") version "$sigstoreVersion"
   signing
 }
diff --git a/examples/hello-world/pom.xml b/examples/hello-world/pom.xml
index 5e9722a1a..d9717a04f 100644
--- a/examples/hello-world/pom.xml
+++ b/examples/hello-world/pom.xml
@@ -16,7 +16,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <maven.compiler.release>11</maven.compiler.release>
-    <sigstore.version>2.2.0</sigstore.version>
+    <sigstore.version>2.3.0</sigstore.version>
   </properties>
 
   <build>
diff --git a/gradle.properties b/gradle.properties
index 69f5ff52c..54abd9b29 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -3,8 +3,8 @@ org.gradle.jvmargs=-XX:MaxMetaspaceSize=768m
 
 group=dev.sigstore
 
-# use the ./scripts/update_version.sh script to update all versions
-version=2.3.0
+# use the ./scripts/update_versions.sh script to update all versions
+version=2.4.0
 
 # Kotlin Dokka is experemental, and we want silence the build warning
 org.jetbrains.dokka.experimental.gradle.pluginMode=V2Enabled
diff --git a/sigstore-gradle/README.md b/sigstore-gradle/README.md
index bda9e84c6..b9ed93f12 100644
--- a/sigstore-gradle/README.md
+++ b/sigstore-gradle/README.md
@@ -15,7 +15,7 @@ Signature format uses [Sigstore bundle](https://github.com/sigstore/protobuf-spe
 
 ```kotlin
 plugins {
-    id("dev.sigstore.sign") version "2.2.0"
+    id("dev.sigstore.sign") version "2.3.0"
 }
 
 // Automatically sign all Maven publications, using GitHub Actions OIDC when available,
diff --git a/sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt b/sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
index 11da31997..1d6d52b57 100644
--- a/sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
+++ b/sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
@@ -42,7 +42,7 @@ abstract class SigstoreSignExtension @Inject constructor (private val project: P
     abstract val sigstoreJavaVersion : Property<String>
 
     init {
-        sigstoreJavaVersion.convention("2.3.0")
+        sigstoreJavaVersion.convention("2.4.0")
     }
 
     fun sign(publications: DomainObjectCollection<Publication>) {
diff --git a/sigstore-maven-plugin/README.md b/sigstore-maven-plugin/README.md
index f098f7e13..1488f09c1 100644
--- a/sigstore-maven-plugin/README.md
+++ b/sigstore-maven-plugin/README.md
@@ -17,7 +17,7 @@ Signature format uses [Sigstore bundle](https://github.com/sigstore/protobuf-spe
       <plugin>
         <groupId>dev.sigstore</groupId>
         <artifactId>sigstore-maven-plugin</artifactId>
-        <version>2.2.0</version>
+        <version>2.3.0</version>
         <executions>
           <execution>
             <id>sign</id>