diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 5677a32..f0af317 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.16.0"
+  ".": "1.16.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d9e9fd..f23c477 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.16.1](https://github.com/chrisleekr/github-app/compare/v1.16.0...v1.16.1) (2026-07-18)
+
+
+### Bug Fixes
+
+* **deps:** pin transitive adm-zip to 0.6.0 for CVE-2026-39244 ([#268](https://github.com/chrisleekr/github-app/issues/268)) ([a4db980](https://github.com/chrisleekr/github-app/commit/a4db980751eed6764373e503bafaf82efef73a87))
+
 ## [1.16.0](https://github.com/chrisleekr/github-app/compare/v1.15.0...v1.16.0) (2026-07-18)
 
 
diff --git a/package.json b/package.json
index 0accfc9..a56e562 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "@chrisleekr/github-app",
   "description": "A GitHub App that listens for @chrisleekr-bot mentions on PRs and issues, then autonomously responds using the Claude Agent SDK (@anthropic-ai/claude-agent-sdk) with MCP servers",
   "author": "Chris Lee <git@chrislee.kr>",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "main": "dist/app.js",
   "bin": {
     "github-app": "dist/app.js"