diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a4647e4..ef2f457 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,6 +1,7 @@
 name: release
 
-# Build and publish a multi-arch pasu-egress image to GHCR on version tags.
+# Build and publish the multi-arch pasu images to GHCR on version tags:
+# pasu-egress (kernel eBPF guard) and pasu-proxy (unprivileged LLM-API guard).
 on:
   push:
     tags: ["v*"]
@@ -11,8 +12,16 @@ permissions:
 
 jobs:
   image:
-    name: ghcr image (amd64 + arm64)
+    name: ghcr ${{ matrix.image }} (amd64 + arm64)
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: pasu-egress
+            dockerfile: deploy/Dockerfile
+          - image: pasu-proxy
+            dockerfile: deploy/proxy/Dockerfile
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-qemu-action@v3
@@ -25,7 +34,7 @@ jobs:
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: ghcr.io/${{ github.repository_owner }}/pasu-egress
+          images: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
@@ -33,7 +42,7 @@ jobs:
       - uses: docker/build-push-action@v6
         with:
           context: .
-          file: deploy/Dockerfile
+          file: ${{ matrix.dockerfile }}
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83c68d9..4162347 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +1,16 @@
 # Changelog
 
 All notable changes to pasu are documented here. The format follows
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project aims
-for [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once it reaches
-its first tagged release.
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project follows
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.0] - 2026-07-22
+
+First tagged release — the two-layer guard (LLM-API proxy + eBPF kernel egress)
+with policy, HITL UI, audit, containers, and verified deploy paths.
+
 ### Added
 - **Podman deployment notes (verified)** — `docs/deployment.md` documents running
   the eBPF egress guard under Podman (cgroup-v2-native, daemonless), **verified on
diff --git a/Cargo.lock b/Cargo.lock
index 948b145..44d4b98 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1306,7 +1306,7 @@ dependencies = [
 
 [[package]]
 name = "pasu-audit"
-version = "0.0.0"
+version = "0.1.0"
 dependencies = [
  "log",
  "opentelemetry",
@@ -1332,7 +1332,7 @@ dependencies = [
 
 [[package]]
 name = "pasu-core"
-version = "0.0.0"
+version = "0.1.0"
 dependencies = [
  "serde",
 ]
@@ -1408,7 +1408,7 @@ dependencies = [
 
 [[package]]
 name = "pasu-rules"
-version = "0.0.0"
+version = "0.1.0"
 dependencies = [
  "criterion",
  "pasu-core",
@@ -1418,7 +1418,7 @@ dependencies = [
 
 [[package]]
 name = "pasu-ui"
-version = "0.0.0"
+version = "0.1.0"
 dependencies = [
  "axum",
  "pasu-core",
diff --git a/crates/pasu-audit/Cargo.toml b/crates/pasu-audit/Cargo.toml
index 628c657..7427a4c 100644
--- a/crates/pasu-audit/Cargo.toml
+++ b/crates/pasu-audit/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pasu-audit"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
diff --git a/crates/pasu-core/Cargo.toml b/crates/pasu-core/Cargo.toml
index 6f303f6..3c82c43 100644
--- a/crates/pasu-core/Cargo.toml
+++ b/crates/pasu-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pasu-core"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
diff --git a/crates/pasu-rules/Cargo.toml b/crates/pasu-rules/Cargo.toml
index b13705c..cd61fc9 100644
--- a/crates/pasu-rules/Cargo.toml
+++ b/crates/pasu-rules/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pasu-rules"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
diff --git a/crates/pasu-ui/Cargo.toml b/crates/pasu-ui/Cargo.toml
index 7b62592..4ab9964 100644
--- a/crates/pasu-ui/Cargo.toml
+++ b/crates/pasu-ui/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pasu-ui"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true