diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de7f461..db5012c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,8 +6,12 @@ name: Release
 #
 #   git tag -a v0.4.0 -m "v0.4.0" && git push origin v0.4.0
 #
-# workflow_dispatch exists to create a release for a tag that already exists
-# (backfilling history), since re-pushing an existing tag triggers nothing.
+# workflow_dispatch re-cuts (or updates) the release for a tag that already
+# exists, since re-pushing an existing tag triggers nothing.
+#
+# It checks out the TAG, because the tagged code is what people install and it has
+# to pass its own tests. That means it only works for tags that actually contain
+# this tooling (>= v0.3.0). Tags older than that were backfilled by hand.
 
 on:
   push:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d223bc1..39a3a55 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,26 @@
 # Changelog
 
+## v0.3.1 — 2026-07-13
+
+### Added
+
+- **Automated releases.** Pushing a `v*` tag runs the full test suite and then
+  cuts a GitHub release whose body is the matching `CHANGELOG.md` section — so
+  release notes have exactly one source of truth, and no second place to go stale.
+  The workflow refuses to publish if the tests fail, if the tag does not match the
+  `VERSION=` declared by every script, or if the CHANGELOG has no section for it.
+
+- **Version-drift check.** `VERSION=` had silently diverged to three different
+  values across `install.sh`, `uninstall.sh`, `recover.sh`, and `patch/apply.sh`,
+  and nothing noticed. CI now asserts every script agrees with the others and with
+  the newest CHANGELOG entry.
+
+### Note
+
+- Releases for `v0.2.0` and `v0.2.1` were backfilled — they had been tagged but
+  never released, so the releases page jumped v0.1.0 → v0.3.0 and hid the fix for
+  the boot race that took every app down.
+
 ## v0.3.0 — 2026-07-13
 
 ### Added
@@ -83,14 +104,6 @@
   `.zfs/snapshot/<name>-<timestamp>/` path changes every run, which defeats
   restic's parent detection and forces a full re-scan each time.
 
-- **Automated releases.** Pushing a `v*` tag runs the full test suite and then
-  cuts a GitHub release whose body is the matching `CHANGELOG.md` section — so
-  release notes have exactly one source of truth. The workflow refuses to publish
-  if the tests fail, if the tag does not match the `VERSION=` declared by every
-  script, or if the CHANGELOG has no section for it. (`VERSION=` had silently
-  drifted to three different values across the scripts, and nothing noticed.)
-  `workflow_dispatch` can create a release for an already-existing tag.
-
 - **CI** (GitHub Actions): shellcheck + `bash -n` on every script, ruff, and
   pytest on Python 3.11/3.12/3.13. Includes tests that `compile()` the
   `*_BLOCK` strings — they are Python source appended to live middlewared
diff --git a/install.sh b/install.sh
index 56facbe..b23aee0 100755
--- a/install.sh
+++ b/install.sh
@@ -18,7 +18,7 @@
 
 set -euo pipefail
 
-VERSION="0.3.0"
+VERSION="0.3.1"
 
 # The directory containing install.sh is the permanent install location.
 PATCH_DIR="$(cd "$(dirname "$0")" && pwd)"
diff --git a/patch/apply.sh b/patch/apply.sh
index dff2795..ebfd23d 100755
--- a/patch/apply.sh
+++ b/patch/apply.sh
@@ -32,7 +32,7 @@
 # Derive PATCH_DIR from this script's location (parent of the patch/ directory).
 PATCH_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 LOG="$PATCH_DIR/apply.log"
-VERSION="0.3.0"
+VERSION="0.3.1"
 
 # Rotate log at 512 KB to avoid unbounded growth on a system volume.
 # Keep two prior generations (.1 and .2) so the last three boots are always available.
diff --git a/recover.sh b/recover.sh
index a6a6a0f..a479664 100755
--- a/recover.sh
+++ b/recover.sh
@@ -17,7 +17,7 @@
 #   bash /mnt/tank/truenas-truecloud-patch/patch/apply.sh
 #   systemctl restart middlewared
 
-VERSION="0.3.0"
+VERSION="0.3.1"
 
 PATCH_DIR="$(cd "$(dirname "$0")" && pwd)"
 
diff --git a/uninstall.sh b/uninstall.sh
index 3c314d2..a24ea15 100755
--- a/uninstall.sh
+++ b/uninstall.sh
@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-VERSION="0.3.0"
+VERSION="0.3.1"
 
 PATCH_DIR="$(cd "$(dirname "$0")" && pwd)"
 _HOOK_COMMENT='TrueCloud provider patch (S3/B2)'