diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ea87acc6..176473de 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-    ".": "0.6.0"
+    ".": "0.7.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d013272a..471a1a09 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,50 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.7.0](https://github.com/DevSecNinja/dotfiles/compare/v0.6.0...v0.7.0) (2026-07-30)
+
+
+### Features
+
+* **1password:** manage the SSH agent vault config ([#650](https://github.com/DevSecNinja/dotfiles/issues/650)) ([0c293ea](https://github.com/DevSecNinja/dotfiles/commit/0c293ea1bfec7c49ac896c61112e0d142dd620de))
+* add GitHub Copilot CLI to packages.yaml ([ae73555](https://github.com/DevSecNinja/dotfiles/commit/ae73555324994b1f6e3fa6f5bf2cf27bff9ffabb))
+* add Microsoft APM to package configurations ([d50a7b9](https://github.com/DevSecNinja/dotfiles/commit/d50a7b993adf15c30cac725fe99dee093e61d973))
+* **chezmoi-up:** warn when the source repo is off its default branch ([#623](https://github.com/DevSecNinja/dotfiles/issues/623)) ([837912e](https://github.com/DevSecNinja/dotfiles/commit/837912e77d5769ff6d8b1f0554a9bcac9a0cdd5f))
+* copilot-ssh reachability pre-flight, Windows Terminal profile and PATH tweaks ([#610](https://github.com/DevSecNinja/dotfiles/issues/610)) ([aa90b05](https://github.com/DevSecNinja/dotfiles/commit/aa90b0564a360a1075f1882ce1d1b9d83f444b81))
+* **copilot:** cli token forwarding ([#540](https://github.com/DevSecNinja/dotfiles/issues/540)) ([b987dbe](https://github.com/DevSecNinja/dotfiles/commit/b987dbe5da9a99a182a381ee7d5b591a6a15dcf7))
+* **fastfetch:** add cached update, reboot and ansible-pull status modules ([#601](https://github.com/DevSecNinja/dotfiles/issues/601)) ([fb9d53e](https://github.com/DevSecNinja/dotfiles/commit/fb9d53ee7dbfb0db66f947daee6ccdcdc975585c))
+* **fastfetch:** date the updates line and quieten pwsh startup ([#654](https://github.com/DevSecNinja/dotfiles/issues/654)) ([72d30ce](https://github.com/DevSecNinja/dotfiles/commit/72d30ced1bc10582a0329e76b002cb8230a8cdd8))
+* **fastfetch:** show winget update count on Windows ([#645](https://github.com/DevSecNinja/dotfiles/issues/645)) ([b836495](https://github.com/DevSecNinja/dotfiles/commit/b8364957948b097e955272d0ec4bfcc8102bb95c))
+* **github-release:** update release jdx/mise ( v2026.6.14 ➔ v2026.7.0 ) [automerge] ([#571](https://github.com/DevSecNinja/dotfiles/issues/571)) ([257964c](https://github.com/DevSecNinja/dotfiles/commit/257964c649938983d1c46afdb81ed4f73a04c1de))
+* **git:** pick the Git signing key based on isWork ([#648](https://github.com/DevSecNinja/dotfiles/issues/648)) ([9441cd0](https://github.com/DevSecNinja/dotfiles/commit/9441cd021b15e4a6cd34d6d365fa7d6d1667b1c9))
+* **macos:** support Homebrew casks and Mac App Store apps ([#543](https://github.com/DevSecNinja/dotfiles/issues/543)) ([61d9aac](https://github.com/DevSecNinja/dotfiles/commit/61d9aac87d849fe90466913ec4fd388028ee2b58))
+* manage 1Password shell plugins in the dotfiles + finish WSL SSH integration ([#614](https://github.com/DevSecNinja/dotfiles/issues/614)) ([6f4bbc9](https://github.com/DevSecNinja/dotfiles/commit/6f4bbc915b42eaa329abc53375d0b929deeb77e6))
+* **mise:** update chezmoi ( 2.70.5 ➔ 2.71.0 ) [automerge] ([#586](https://github.com/DevSecNinja/dotfiles/issues/586)) ([52a4a5b](https://github.com/DevSecNinja/dotfiles/commit/52a4a5b18246114e02e7a3fc6dbe31558fa450d2))
+* **mise:** update tool pipx:apm-cli ( 0.21.0 ➔ 0.22.0 ) [automerge] ([#562](https://github.com/DevSecNinja/dotfiles/issues/562)) ([e1cc539](https://github.com/DevSecNinja/dotfiles/commit/e1cc539c49ec0b9ddbd5092efdd4a433882b1521))
+* **mise:** update tool pipx:apm-cli ( 0.24.1 ➔ 0.25.0 ) [automerge] ([#599](https://github.com/DevSecNinja/dotfiles/issues/599)) ([1da8690](https://github.com/DevSecNinja/dotfiles/commit/1da8690b783b52c7c1123240dfe3eaba43e31c84))
+* **pwsh:** add copilot-ssh helper forwarding GitHub tokens over SSH ([d685789](https://github.com/DevSecNinja/dotfiles/commit/d6857899cc032aff18240835c6ed5e0d68810907))
+* **pwsh:** add Set-WindowsTerminalDefaultProfile to patch defaultProfile non-destructively ([c71420e](https://github.com/DevSecNinja/dotfiles/commit/c71420e69fb4a3135fa0486c50ee00e28d411b87))
+* **pwsh:** audit and enforce GitHub repo config from the shell ([#621](https://github.com/DevSecNinja/dotfiles/issues/621)) ([8b35fbd](https://github.com/DevSecNinja/dotfiles/commit/8b35fbd7ba9e7cdfd5f78e86b589789ce1ee7173))
+* **pwsh:** show fastfetch at PowerShell startup ([#626](https://github.com/DevSecNinja/dotfiles/issues/626)) ([71c0626](https://github.com/DevSecNinja/dotfiles/commit/71c0626b4412149cce85970c9767e9e5a3b01b7b))
+* **pwsh:** tab-complete copilot-ssh host from ssh config and improve op guidance ([e01322f](https://github.com/DevSecNinja/dotfiles/commit/e01322f42b79ca8a8e9167c92c6d3d3b04f5e5a6))
+* **shell:** add chezmoi-up to pull, re-init and apply in one step ([#618](https://github.com/DevSecNinja/dotfiles/issues/618)) ([c785067](https://github.com/DevSecNinja/dotfiles/commit/c785067a2797991b56c4c750894faecd3fd70c57))
+
+
+### Bug Fixes
+
+* **devcontainer:** repin image to the stable v0.6.0 release digest ([6e6d6d0](https://github.com/DevSecNinja/dotfiles/commit/6e6d6d0de6a66db6994c7a538aa733cc4f2d9dc9))
+* **fastfetch:** harden the status cache and sign the terminal args script ([#657](https://github.com/DevSecNinja/dotfiles/issues/657)) ([e9cc781](https://github.com/DevSecNinja/dotfiles/commit/e9cc7819726c891583caf0cdbc6d47882d733fcb))
+* **github-release:** update release jdx/mise ( v2026.6.11 ➔ v2026.6.14 ) [automerge] ([#557](https://github.com/DevSecNinja/dotfiles/issues/557)) ([bb70945](https://github.com/DevSecNinja/dotfiles/commit/bb709451a56b990a1ba09d666d4e53788260e095))
+* **github-release:** update release jdx/mise ( v2026.6.9 ➔ v2026.6.11 ) [automerge] ([#550](https://github.com/DevSecNinja/dotfiles/issues/550)) ([d6086ae](https://github.com/DevSecNinja/dotfiles/commit/d6086aedabc51beb95d1637f76857ab0a40149dc))
+* **github-release:** update release jdx/mise ( v2026.7.2 ➔ v2026.7.5 ) [automerge] ([#583](https://github.com/DevSecNinja/dotfiles/issues/583)) ([eebca37](https://github.com/DevSecNinja/dotfiles/commit/eebca37265fd61ef806c93c38700d1e9a30e5747))
+* **git:** sign commits on native Windows and macOS too, not just WSL ([#616](https://github.com/DevSecNinja/dotfiles/issues/616)) ([6df0092](https://github.com/DevSecNinja/dotfiles/commit/6df009270b426dbc33b6df4c8934c703d925f7cf))
+* **mise:** update tool pipx:apm-cli ( 0.24.0 ➔ 0.24.1 ) [automerge] ([#593](https://github.com/DevSecNinja/dotfiles/issues/593)) ([d2b6e92](https://github.com/DevSecNinja/dotfiles/commit/d2b6e92ba2c1b5ce1f041c0f4a6ccb3d0b3c1d0e))
+* **pwsh:** keep copilot-ssh pre-flight aborts non-terminating under ErrorActionPreference=Stop ([8910d01](https://github.com/DevSecNinja/dotfiles/commit/8910d0107f30fb819d2b54c55aa5e4e675b8137f))
+* **pwsh:** make copilot-ssh abort on failed pre-flight checks instead of plain ssh ([4997604](https://github.com/DevSecNinja/dotfiles/commit/49976045a8d1029e1ac5e3210033b16f60a48f4a))
+* **test:** make the branch guard ordering test line-ending agnostic ([#629](https://github.com/DevSecNinja/dotfiles/issues/629)) ([c0e07dd](https://github.com/DevSecNinja/dotfiles/commit/c0e07dd6f1b4d7247a04fa0a8ad2e1eebd3061cb))
+* **windows:** repair fresh install flow and document manual steps ([58110f4](https://github.com/DevSecNinja/dotfiles/commit/58110f46327ec04639f80fe74f29bf2901ae021c))
+* **wsl:** scope 1Password signer detection to current user ([#652](https://github.com/DevSecNinja/dotfiles/issues/652)) ([a75c1e5](https://github.com/DevSecNinja/dotfiles/commit/a75c1e571d9f3a863e069f1f743e2c098e2b5a2e))
+
 ## [0.6.0](https://github.com/DevSecNinja/dotfiles/compare/v0.5.0...v0.6.0) (2026-07-01)