diff --git a/README.md b/README.md
index be0d372..584f73e 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@ your app ──▶ cordon ──▶ api.openai.com / api.anthropic.com
 ```bash
 docker run -d --name cordon --init -p 127.0.0.1:8080:8080 \
   -v cordon-data:/app/data -e ADMIN_TOKEN=change-me \
-  ghcr.io/askalf/cordon:v0.2.0
+  ghcr.io/askalf/cordon:v0.3.0
 ```
 
 Then change one thing in your client: the base URL. Anthropic clients use `http://localhost:8080`, OpenAI clients use `http://localhost:8080/v1`. Your provider key goes through untouched; cordon never holds it. Every response says what it did: `X-Redacted: 2`, `X-Redacted-Types: EMAIL:1,CREDIT_CARD:1`.
diff --git a/docs/deploy.md b/docs/deploy.md
index 34c5caf..9617cd0 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -12,7 +12,7 @@ docker compose up -d --build      # from a clone: cordon on 127.0.0.1:8080, audi
 Every tagged release publishes a multi-arch image (linux/amd64, linux/arm64) to GHCR with keyless Sigstore provenance and an SBOM. Verify it came from this repository's release workflow:
 
 ```bash
-gh attestation verify oci://ghcr.io/askalf/cordon:v0.2.0 --repo askalf/cordon
+gh attestation verify oci://ghcr.io/askalf/cordon:v0.3.0 --repo askalf/cordon
 ```
 
 Sharing one Claude or ChatGPT subscription through [dario](https://github.com/askalf/dario) without leaking PII: dario's [cordon integration guide](https://github.com/askalf/dario/blob/main/docs/integrations/cordon.md).