diff --git a/package-lock.json b/package-lock.json
index 2a2894e..79f4e38 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7856,7 +7856,7 @@
     },
     "packages/core": {
       "name": "@openvtc/pnm-core",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@hpke/chacha20poly1305": "^1.8.0",
@@ -7882,7 +7882,7 @@
       "name": "@openvtc/pnm-extension",
       "version": "0.2.0",
       "dependencies": {
-        "@openvtc/pnm-core": "^0.2.0",
+        "@openvtc/pnm-core": "^0.3.0",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "zustand": "^5.0.0"
@@ -7903,7 +7903,7 @@
       "name": "@openvtc/pnm-pwa",
       "version": "0.2.0",
       "dependencies": {
-        "@openvtc/pnm-core": "^0.2.0",
+        "@openvtc/pnm-core": "^0.3.0",
         "@tanstack/react-query": "^5.101.2",
         "lucide-react": "^1.25.0",
         "react": "^19.0.0",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 4644c1c..ca0389b 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -8,6 +8,8 @@ For history before this file, see `git log` on `packages/core`.
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-08-09
+
 ### Added
 
 - **`digestMultibase` decoding, and the approver match code derived from the
@@ -54,6 +56,34 @@ For history before this file, see `git log` on `packages/core`.
   of it emits the explicit reason yet. The prior tests encoded the wrong wire
   shape as correct and were rewritten against the real one.
 
+### Migration
+
+The `payloadDigest` **wire format changed**, on both sides at once and without
+a type-URI version to signal it — Trust Tasks 0.4 re-pinned
+`task-consent/{request,decision,granted}` errata-style, in place. This release
+pairs with `verifiable-trust-infrastructure` **#911**; a wallet and an executor
+on opposite sides of that change do not interoperate on consent.
+
+**Upgrade the wallet and the VTA together.** Unlike the 0.1.3 authcrypt change
+there is no dual-accept fallback to stage behind, because the digest is the
+value the approver signs — accepting both encodings would mean accepting two
+different digests for one payload, which is precisely the substitution the
+digest exists to prevent.
+
+The failure is fail-closed in both directions, which bounds the blast radius:
+
+- **Wallet ≥ 0.3.0, VTA pre-0.4** (bare hex on the wire): the digest is refused
+  as non-conforming, no match code is rendered, and approval is blocked with an
+  explicit message.
+- **Wallet ≤ 0.2.0, VTA on 0.4** (multibase on the wire): the old code slices
+  the encoded string, so the wallet displays `zQmSK9…` where the requesting
+  screen and the mobile approver display `3b0c7f`. Destructive approvals become
+  impossible — the codes cannot match — while non-destructive ones still
+  complete with a cosmetically wrong code shown. **Rebuild and reinstall the
+  extension**; there is no store auto-update path in this repository.
+
+Nothing is silently mis-approved in either direction.
+
 ## [0.2.0] - 2026-06-08
 
 ### Changed
diff --git a/packages/core/package.json b/packages/core/package.json
index 86f2840..eb03fa6 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/pnm-core",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Browser-side bridge between WebAuthn passkeys and VTA-managed DIDs. Wire types, WebAuthn ceremony helpers, COSE→Multikey conversion, DID verificationMethod builder, REST + DIDComm transports, mediator client, SIOP / RP-login / provision-integration flows.",
   "license": "Apache-2.0",
   "repository": {
diff --git a/packages/extension/package.json b/packages/extension/package.json
index 33b8841..2a20701 100644
--- a/packages/extension/package.json
+++ b/packages/extension/package.json
@@ -11,7 +11,7 @@
     "render:icons": "scripts/render-icons.sh"
   },
   "dependencies": {
-    "@openvtc/pnm-core": "^0.2.0",
+    "@openvtc/pnm-core": "^0.3.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "zustand": "^5.0.0"
diff --git a/packages/pwa/package.json b/packages/pwa/package.json
index 26767b1..cc5deae 100644
--- a/packages/pwa/package.json
+++ b/packages/pwa/package.json
@@ -11,7 +11,7 @@
     "lint": "tsc -b"
   },
   "dependencies": {
-    "@openvtc/pnm-core": "^0.2.0",
+    "@openvtc/pnm-core": "^0.3.0",
     "@tanstack/react-query": "^5.101.2",
     "lucide-react": "^1.25.0",
     "react": "^19.0.0",