diff --git a/CLAUDE.md b/CLAUDE.md
index 9e2d478..7ee225c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this is
 
-pk-auth is a **passkeys-first authentication library set for the JVM**, published to Maven Central under `com.codeheadsystems`. All modules share one version (`gradle.properties` → currently `2.0.0-SNAPSHOT`). It is *not* an identity provider: it owns passkeys/credentials, never users — the host maps users via the `UserLookup` SPI.
+pk-auth is a **passkeys-first authentication library set for the JVM**, published to Maven Central under `com.codeheadsystems`. All modules share one version (`gradle.properties` → currently `2.0.1-SNAPSHOT`). It is *not* an identity provider: it owns passkeys/credentials, never users — the host maps users via the `UserLookup` SPI.
 
 The canonical architecture reference is [`DESIGN.md`](./DESIGN.md); per-decision rationale lives in [`docs/adr/`](./docs/adr/) (Nygard format, numbered). Read the relevant ADR before changing cross-module behavior.
 
diff --git a/README.md b/README.md
index ff19d3f..45b0eef 100644
--- a/README.md
+++ b/README.md
@@ -151,7 +151,7 @@ tests and Playwright end-to-end suites:
 ## Status
 
 1.0.0 cut the stable baseline; the current development line is
-**2.0.0-SNAPSHOT** (see `gradle.properties` for the authoritative
+**2.0.1-SNAPSHOT** (see `gradle.properties` for the authoritative
 version). The 1.1 line added per-audience JWT TTLs, the
 `AccessTokenStore` (stateful access tokens), the
 `UserDeletionService` fan-out, and the `pk-auth-refresh-tokens`
diff --git a/clients/passkeys-browser/package.json b/clients/passkeys-browser/package.json
index b548fe7..1271d02 100644
--- a/clients/passkeys-browser/package.json
+++ b/clients/passkeys-browser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@pk-auth/passkeys-browser",
-  "version": "2.0.0",
+  "version": "2.0.1-SNAPSHOT",
   "description": "pk-auth browser SDK: WebAuthn ceremonies + admin operations against the pk-auth wire contract.",
   "license": "MIT",
   "author": "Ned Wolpert",
diff --git a/docs/stability.md b/docs/stability.md
index c049b4a..11f4b45 100644
--- a/docs/stability.md
+++ b/docs/stability.md
@@ -3,8 +3,8 @@
 ## Current status: 2.x
 
 pk-auth is **post-1.0** as of the `v1.0.0` tag. The current development line is
-**2.0.0-SNAPSHOT** (`gradle.properties` is authoritative); the 1.1, 1.2, and
-1.3 releases have shipped. See [`CHANGELOG.md`](../CHANGELOG.md) for the
+**2.0.1-SNAPSHOT** (`gradle.properties` is authoritative); the 1.1, 1.2, 1.3, and
+2.0 releases have shipped. See [`CHANGELOG.md`](../CHANGELOG.md) for the
 per-release delta.
 
 Post-1.0, pk-auth follows [Semantic Versioning](https://semver.org/):
diff --git a/gradle.properties b/gradle.properties
index 654f753..6e3d0aa 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -21,4 +21,4 @@ org.gradle.jvmargs=-Xmx2g \
 
 # Project identity
 group=com.codeheadsystems
-version=2.0.0-SNAPSHOT
+version=2.0.1-SNAPSHOT
diff --git a/site/og-image.png b/site/og-image.png
index 0edaa74..f513ab8 100644
Binary files a/site/og-image.png and b/site/og-image.png differ