diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 2ca6c52..1e9145b 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,5 +1,5 @@
 {
-  "packages/krm-stream": "0.5.0",
-  "gateway": "0.5.0",
-  "gateway/kube": "0.5.0"
+  "packages/krm-stream": "0.6.0",
+  "gateway": "0.6.0",
+  "gateway/kube": "0.6.0"
 }
diff --git a/gateway/CHANGELOG.md b/gateway/CHANGELOG.md
index b2ea9f4..5dd4878 100644
--- a/gateway/CHANGELOG.md
+++ b/gateway/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.6.0](https://github.com/ConfigButler/krm-stream/compare/gateway/v0.5.0...gateway/v0.6.0) (2026-10-02)
+
+
+### Features
+
+* refuse credential-carrying redirects, stop reopening early-ending watches, and let releases own versions ([#42](https://github.com/ConfigButler/krm-stream/issues/42)) ([fb52085](https://github.com/ConfigButler/krm-stream/commit/fb52085847e15996ba69fab16f4f021342a20608))
+
 ## [0.5.0](https://github.com/ConfigButler/krm-stream/compare/gateway/v0.4.0...gateway/v0.5.0) (2026-10-02)
 
 
diff --git a/gateway/kube/CHANGELOG.md b/gateway/kube/CHANGELOG.md
index 3b9380e..5b42af0 100644
--- a/gateway/kube/CHANGELOG.md
+++ b/gateway/kube/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.6.0](https://github.com/ConfigButler/krm-stream/compare/gateway/kube/v0.5.0...gateway/kube/v0.6.0) (2026-10-02)
+
+
+### Features
+
+* refuse credential-carrying redirects, stop reopening early-ending watches, and let releases own versions ([#42](https://github.com/ConfigButler/krm-stream/issues/42)) ([fb52085](https://github.com/ConfigButler/krm-stream/commit/fb52085847e15996ba69fab16f4f021342a20608))
+
 ## [0.5.0](https://github.com/ConfigButler/krm-stream/compare/gateway/kube/v0.4.0...gateway/kube/v0.5.0) (2026-10-02)
 
 
diff --git a/gateway/kube/go.mod b/gateway/kube/go.mod
index cdd9a70..bba1997 100644
--- a/gateway/kube/go.mod
+++ b/gateway/kube/go.mod
@@ -27,7 +27,7 @@ go 1.27.1
 // unreleased adapter with the core from the same commit. The adapter relies on core behaviour, not
 // only API, so it must never resolve an older core than the one it was released with.
 require (
-	github.com/ConfigButler/krm-stream/gateway v0.5.0 // x-release-please-version
+	github.com/ConfigButler/krm-stream/gateway v0.6.0 // x-release-please-version
 	k8s.io/api v0.36.0
 	k8s.io/apimachinery v0.36.0
 	k8s.io/client-go v0.36.0
diff --git a/go.work b/go.work
index a4cb12c..f323292 100644
--- a/go.work
+++ b/go.work
@@ -28,4 +28,4 @@ use (
 // This points that exact version at the working tree. Go refuses an unversioned replace of a
 // workspace module, so the version is spelled out, and Release Please moves it together with
 // gateway/kube/go.mod; CI fails if the two disagree.
-replace github.com/ConfigButler/krm-stream/gateway v0.5.0 => ./gateway // x-release-please-version
+replace github.com/ConfigButler/krm-stream/gateway v0.6.0 => ./gateway // x-release-please-version
diff --git a/packages/krm-stream/CHANGELOG.md b/packages/krm-stream/CHANGELOG.md
index 8657934..9880738 100644
--- a/packages/krm-stream/CHANGELOG.md
+++ b/packages/krm-stream/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.6.0](https://github.com/ConfigButler/krm-stream/compare/@configbutler/krm-stream-v0.5.0...@configbutler/krm-stream-v0.6.0) (2026-10-02)
+
+
+### Features
+
+* refuse credential-carrying redirects, stop reopening early-ending watches, and let releases own versions ([#42](https://github.com/ConfigButler/krm-stream/issues/42)) ([fb52085](https://github.com/ConfigButler/krm-stream/commit/fb52085847e15996ba69fab16f4f021342a20608))
+
 ## [0.5.0](https://github.com/ConfigButler/krm-stream/compare/@configbutler/krm-stream-v0.4.0...@configbutler/krm-stream-v0.5.0) (2026-10-02)
 
 
diff --git a/packages/krm-stream/package-lock.json b/packages/krm-stream/package-lock.json
index feacf5e..4f69d3f 100644
--- a/packages/krm-stream/package-lock.json
+++ b/packages/krm-stream/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@configbutler/krm-stream",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@configbutler/krm-stream",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@biomejs/biome": "^2.5.13",
diff --git a/packages/krm-stream/package.json b/packages/krm-stream/package.json
index a555529..f35fda0 100644
--- a/packages/krm-stream/package.json
+++ b/packages/krm-stream/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@configbutler/krm-stream",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Receive live Kubernetes resource updates in browser apps and three-way merge them with form edits.",
   "keywords": [
     "kubernetes",
diff --git a/packages/krm-stream/src/version.ts b/packages/krm-stream/src/version.ts
index adffccf..3961efe 100644
--- a/packages/krm-stream/src/version.ts
+++ b/packages/krm-stream/src/version.ts
@@ -22,7 +22,7 @@
 // line together, and version.test.ts fails if they ever disagree.
 
 /** The npm package version of this build. Assert it against the copy you vendored. */
-export const VERSION = "0.5.0"; // x-release-please-version
+export const VERSION = "0.6.0"; // x-release-please-version
 
 /** The wire protocol this build speaks (spec/v1.md). The gateway sends it as `X-KRM-Stream-Protocol`. */
 export const PROTOCOL_VERSION = 1;