diff --git a/.github/workflows/distribution.yml b/.github/workflows/distribution.yml
index 10379ea..72b966e 100644
--- a/.github/workflows/distribution.yml
+++ b/.github/workflows/distribution.yml
@@ -2,8 +2,8 @@
 # same inputs as duckdb-acl's - for the two platforms a platform node runs on, linux_amd64 and linux_arm64. Nothing
 # else is built: no macOS, Windows or WASM artifact of hugr_node exists (duckdb-acl, the open node, keeps its matrix).
 #
-# Like duckdb-acl's, it builds against the 2.0 LINE (`duckdb_version: v2.0-cyanoptera`, the branch head) rather than
-# our submodule pin - the early warning for drift, before the pin follows.
+# Like duckdb-acl's, it builds against the release, `duckdb_version: v2.0.0` (spec 016; the 2.0 line's head until the
+# tag), as community-extensions builds for 2.0.0.
 name: Distribution build
 
 on:
@@ -25,7 +25,7 @@ jobs:
     uses: duckdb/extension-ci-tools/.github/workflows/_extension_distribution.yml@main
     with:
       extension_name: hugr_node
-      duckdb_version: v2.0-cyanoptera
+      duckdb_version: v2.0.0
       ci_tools_version: main
       # linux_amd64 and linux_arm64 only (the musl legs and windows_arm64 are opt-in, so not built either)
       exclude_archs: 'osx_amd64;osx_arm64;windows_amd64;windows_amd64_mingw;wasm_mvp;wasm_eh;wasm_threads'
diff --git a/Makefile b/Makefile
index 030aa02..b9a8b3b 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,10 @@ VCPKG_TOOLCHAIN_PATH ?= $(PROJ_DIR)vcpkg/scripts/buildsystems/vcpkg.cmake
 # (spec 026) found it. hugr_node builds duckdb from the pinned source, as they do.
 override DUCKDB_PREBUILT_LIBRARY :=
 override DUCKDB_PREBUILT_EXTENSIONS :=
+# Spec 016: the pin is duckdb's v2.0.0 tag, and duckdb 2.0 no longer reads `git describe` - a build is
+# v2.0.0-dev<commits>, its extensions' folder the commit, unless the version is given. Given here, the node and the
+# extensions of its release are v2.0.0: what DuckDB's own repositories serve, and what kista mirrors. Bump with the pin.
+export DUCKDB_VERSION ?= v2.0.0
 include extension-ci-tools/makefiles/duckdb_extension.Makefile
 
 # --- the platform part's C++ test (duckdb-acl's style: one program per test/cpp/test_*.cpp, linked against the
diff --git a/acl-otel b/acl-otel
index 8542cad..3916552 160000
--- a/acl-otel
+++ b/acl-otel
@@ -1 +1 @@
-Subproject commit 8542cad19072a0a9567c340927a39a1fcdfb0cb6
+Subproject commit 39165522b813bdf7d74672b49dd55b84a92d439b
diff --git a/docker/Dockerfile b/docker/Dockerfile
index c808c71..f654966 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -5,7 +5,7 @@
 # Built by the release workflow on each platform's own runner from that platform's assets
 # (scripts/release_assets.sh); the build context is the assets directory:
 #   docker build -f docker/Dockerfile --build-arg VERSION=<tag> --build-arg REVISION=<sha> \
-#       --build-arg DUCKDB_VERSION=<source id> <assets dir>
+#       --build-arg DUCKDB_VERSION=<the release manifest's duckdb_version: v2.0.0> <assets dir>
 #
 # ubuntu:24.04 is the glibc the binary was built against (the ubuntu-24.04 runners). tini is PID 1: it forwards
 # SIGTERM, so a node stopped during its bootstrap ends at once (its own handler serves only once the doors are open)
diff --git a/duckdb b/duckdb
index f8f3f4d..d54cbbe 160000
--- a/duckdb
+++ b/duckdb
@@ -1 +1 @@
-Subproject commit f8f3f4dcd954cea2613572e8cc40a8612698d232
+Subproject commit d54cbbe3df17e8e5ce68312f483b4155836112aa
diff --git a/duckdb-acl b/duckdb-acl
index 8d0c1d9..41ec046 160000
--- a/duckdb-acl
+++ b/duckdb-acl
@@ -1 +1 @@
-Subproject commit 8d0c1d9a79911eadb419e37d3bad60f18dfb8630
+Subproject commit 41ec0465d19471468560e1dbc584fc10a85dbc83
diff --git a/extension-ci-tools b/extension-ci-tools
index 39ffc46..fe955ed 160000
--- a/extension-ci-tools
+++ b/extension-ci-tools
@@ -1 +1 @@
-Subproject commit 39ffc46ca8c70021d741c7be2e7bcadf3fd1c503
+Subproject commit fe955ed3a046b0324cac2c691e73d8d776a7d5cc
diff --git a/scripts/publish_to_kista.sh b/scripts/publish_to_kista.sh
index 53b34ef..4257023 100755
--- a/scripts/publish_to_kista.sh
+++ b/scripts/publish_to_kista.sh
@@ -20,12 +20,12 @@ for file in "$@"; do
 	meta="$(python3 "$HERE/ext_footer.py" "$file")"
 	name="$(field "$meta" name)"
 	version="$(field "$meta" duckdb_version)"
-	case "$version" in
-	v*) echo "publish_to_kista: $file is built for the release $version - register it with its C API version by hand" >&2
-		exit 1 ;;
-	esac
+	# a release's builds (vX.Y.Z) are kista's release kind, a commit's its dev kind; a CPP build is served under its
+	# exact version, so it needs no C API maximum
+	kind=dev
+	case "$version" in v[0-9]*.[0-9]*.[0-9]*) kind=release ;; esac
 	if ! ka version list | grep -qw -- "$version"; then
-		ka version add "$version" -kind dev >/dev/null
+		ka version add "$version" -kind "$kind" >/dev/null
 	fi
 	if ! ka channel versions "$CHANNEL" | grep -qx -- "$version"; then
 		ka channel versions "$CHANNEL" -add "$version" >/dev/null
diff --git a/specs/016-pin-duckdb-v2.0.0/spec.md b/specs/016-pin-duckdb-v2.0.0/spec.md
new file mode 100644
index 0000000..c74ba3a
--- /dev/null
+++ b/specs/016-pin-duckdb-v2.0.0/spec.md
@@ -0,0 +1,53 @@
+# Spec 016: re-pin duckdb to the v2.0.0 tag - the node is v2.0.0
+
+- **Status**: implemented
+- **Date**: 2026-10-21
+- **Author**: the agent, at the owner's ask ("да можно сделать перепин всю семью")
+
+DuckDB v2.0.0 was released on 2026-10-21. hugr_node builds duckdb-acl, tresor and acl-otel in, so the four move the same
+day:
+
+| submodule | from | to | why |
+| --- | --- | --- | --- |
+| duckdb | f8f3f4d | d54cbbe | the v2.0.0 tag (duckdb-acl spec 141, #250) |
+| duckdb-acl | 8d0c1d9 | 41ec046 | spec 141: the tag; quack f96420e, ducklake 417a911 - the release's own pins |
+| tresor | d7f2a1e | 036180c | its spec 038 (#67), `ACL_COMMIT` 41ec046 |
+| acl-otel | 8542cad | 3916552 | its spec 027 (#56), `ACL_BASE` 41ec046 |
+| extension-ci-tools | 39ffc46 | fe955ed | main's head, as duckdb-acl's |
+
+- **The node is v2.0.0, not a commit.** duckdb 2.0 no longer reads `git describe`. A build is `v2.0.0-dev<commits>`
+  and names its extensions' folder by the commit, unless the version is given (duckdb-acl spec 141). The Makefile
+  gives it: `DUCKDB_VERSION ?= v2.0.0`, bumped with the pin.
+  - The node's duckdb, its release's extensions and the image label `dev.hugr.duckdb.version` are then v2.0.0.
+  - A node installs from a repository that serves v2.0.0. kista can mirror DuckDB's own repositories for it, which
+    publish nothing for a development build.
+  - Locally, CI and in the release build alike: the release used `make` without it and shipped `f8f3f4dcd9`.
+- **`scripts/publish_to_kista.sh` takes a release.** A `vX.Y.Z` version is kista's `release` kind, a commit's its
+  `dev` kind. It used to refuse a release ("register it with its C API version by hand"). A CPP build is served under
+  its exact version, so it needs no C API maximum.
+- **The distribution builds the tag**: `duckdb_version: v2.0.0`.
+- **The hugr type's copy of quack's client** (spec 011) follows duckdb-acl's quack, f96420e. duckdb applies no patches
+  to quack since v2.0.0, so `src/hugr_type/sync.py` copies it as it is (with ours), as duckdb-acl's sync does. It
+  refused a pin without duckdb patches before - found by this PR's CI. The copied files are unchanged but their
+  banner.
+- **The release's extensions** follow duckdb-acl's pins (spec 008): postgres_scanner c0f5a3c, ducklake 417a911, mssql
+  7e1bb1c (until its own re-pin, #511, merges).
+- **Nothing in `src/` changes.**
+
+## Testing
+
+On the new pins (macOS), `HUGR_NODE_E2E=1 HUGR_NODE_RELEASE=1`:
+
+- the build, and the version it names;
+- `test/sql/*`, `make test-cpp`;
+- `make test-e2e`: tresor in the cluster, acl_otel in hugr_node, a node bootstraps itself, the federation.
+
+Run on macOS, all green:
+
+- the build: `library_version` v2.0.0 at d54cbbe3df; the release's extensions' footers name v2.0.0 (postgres_scanner
+  c0f5a3c, CPP);
+- `test/sql/*`: 982 assertions in 13 files; test-cpp: 4;
+- test-e2e, all PASS: tresor in the cluster, acl_otel in hugr_node, a node bootstraps itself (its postgres_scanner
+  published to kista as `v2.0.0`, the release kind), the hugr type across processes and its identity through tresor.
+
+On the PR: CI, the release's dry run (the image's e2e, now with a v2.0.0 channel) and the distribution build.
diff --git a/src/hugr_type/hugr_client.cpp b/src/hugr_type/hugr_client.cpp
index d13eae1..68958e3 100644
--- a/src/hugr_type/hugr_client.cpp
+++ b/src/hugr_type/hugr_client.cpp
@@ -1,4 +1,4 @@
-// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (e7a9be3) - do not edit.
+// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (f96420e) - do not edit.
 // The `hugr` type's copy of quack's client transport (spec 011): names *Quack* -> Hugr*, the settings it
 // reads quack_* -> hugr_*; every other string as quack wrote it.
 #include "duckdb/catalog/catalog_transaction.hpp"
diff --git a/src/hugr_type/hugr_client_affinity.cpp b/src/hugr_type/hugr_client_affinity.cpp
index 901b709..164e816 100644
--- a/src/hugr_type/hugr_client_affinity.cpp
+++ b/src/hugr_type/hugr_client_affinity.cpp
@@ -1,4 +1,4 @@
-// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (e7a9be3) - do not edit.
+// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (f96420e) - do not edit.
 // The `hugr` type's copy of quack's client transport (spec 011): names *Quack* -> Hugr*, the settings it
 // reads quack_* -> hugr_*; every other string as quack wrote it.
 #include "hugr_client_affinity.hpp"
diff --git a/src/hugr_type/hugr_client_fetch_ahead.cpp b/src/hugr_type/hugr_client_fetch_ahead.cpp
index c7e4736..947d570 100644
--- a/src/hugr_type/hugr_client_fetch_ahead.cpp
+++ b/src/hugr_type/hugr_client_fetch_ahead.cpp
@@ -1,4 +1,4 @@
-// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (e7a9be3) - do not edit.
+// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (f96420e) - do not edit.
 // The `hugr` type's copy of quack's client transport (spec 011): names *Quack* -> Hugr*, the settings it
 // reads quack_* -> hugr_*; every other string as quack wrote it.
 #include "hugr_client_fetch_ahead.hpp"
diff --git a/src/hugr_type/include/hugr_client.hpp b/src/hugr_type/include/hugr_client.hpp
index b4ce9ac..f5d6d3f 100644
--- a/src/hugr_type/include/hugr_client.hpp
+++ b/src/hugr_type/include/hugr_client.hpp
@@ -1,4 +1,4 @@
-// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (e7a9be3) - do not edit.
+// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (f96420e) - do not edit.
 // The `hugr` type's copy of quack's client transport (spec 011): names *Quack* -> Hugr*, the settings it
 // reads quack_* -> hugr_*; every other string as quack wrote it.
 #pragma once
diff --git a/src/hugr_type/include/hugr_client_affinity.hpp b/src/hugr_type/include/hugr_client_affinity.hpp
index d93513d..cac6a7c 100644
--- a/src/hugr_type/include/hugr_client_affinity.hpp
+++ b/src/hugr_type/include/hugr_client_affinity.hpp
@@ -1,4 +1,4 @@
-// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (e7a9be3) - do not edit.
+// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (f96420e) - do not edit.
 // The `hugr` type's copy of quack's client transport (spec 011): names *Quack* -> Hugr*, the settings it
 // reads quack_* -> hugr_*; every other string as quack wrote it.
 //===----------------------------------------------------------------------===//
diff --git a/src/hugr_type/include/hugr_client_fetch_ahead.hpp b/src/hugr_type/include/hugr_client_fetch_ahead.hpp
index 659602e..dd79f34 100644
--- a/src/hugr_type/include/hugr_client_fetch_ahead.hpp
+++ b/src/hugr_type/include/hugr_client_fetch_ahead.hpp
@@ -1,4 +1,4 @@
-// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (e7a9be3) - do not edit.
+// GENERATED by src/hugr_type/sync.py from duckdb-acl's third_party/quack (f96420e) - do not edit.
 // The `hugr` type's copy of quack's client transport (spec 011): names *Quack* -> Hugr*, the settings it
 // reads quack_* -> hugr_*; every other string as quack wrote it.
 #pragma once
diff --git a/src/hugr_type/sync.py b/src/hugr_type/sync.py
index 9725a69..5812443 100644
--- a/src/hugr_type/sync.py
+++ b/src/hugr_type/sync.py
@@ -37,8 +37,10 @@
 ROOT = pathlib.Path(__file__).resolve().parents[2]
 ACL = ROOT / "duckdb-acl"
 QUACK = ACL / "third_party" / "quack"
-# duckdb's patches for quack: hugr-node's duckdb's, which must be duckdb-acl's pin (checked in main())
+# duckdb's patches for quack: hugr-node's duckdb's, which must be duckdb-acl's pin (checked in main()); applied only
+# when duckdb's own quack.cmake applies them (v2.0.0's carries none, as duckdb-acl's sync reads it, its spec 141)
 DUCKDB_PATCHES = ROOT / "duckdb" / ".github" / "patches" / "extensions" / "quack"
+DUCKDB_QUACK_CONFIG = ROOT / "duckdb" / ".github" / "config" / "extensions" / "quack.cmake"
 OUR_PATCHES = ROOT / "src" / "hugr_type" / "patches"
 OUT = ROOT / "src" / "hugr_type"
 
@@ -202,9 +204,17 @@ def patched_source(commit):
     scratch = pathlib.Path(tempfile.mkdtemp(prefix="hugr-type-sync-"))
     shutil.copytree(QUACK / "src", scratch / "src")
     duckdb_patches = sorted(DUCKDB_PATCHES.glob("*.patch"))
-    if not duckdb_patches:
-        # a copy made without them would compile against the wrong duckdb and pass the sync
-        sys.exit(f"sync: no quack patches under {DUCKDB_PATCHES} - is duckdb-acl's duckdb checked out?")
+    if not DUCKDB_QUACK_CONFIG.exists():
+        sys.exit(f"sync: no {DUCKDB_QUACK_CONFIG} - is hugr-node's duckdb checked out?")
+    if "APPLY_PATCHES" in DUCKDB_QUACK_CONFIG.read_text():
+        if not duckdb_patches:
+            # a copy made without them would compile against the wrong duckdb and pass the sync
+            sys.exit(f"sync: duckdb's quack.cmake applies patches, and none are under {DUCKDB_PATCHES}")
+    else:
+        # duckdb builds this quack as it is: so do the copies, and a patch left in duckdb's tree is not applied
+        if duckdb_patches:
+            sys.exit(f"sync: duckdb's quack.cmake applies no patches, yet {DUCKDB_PATCHES} holds some")
+        print("duckdb carries no patches for this quack: its src as it is, with ours")
     for patch in duckdb_patches + sorted(OUR_PATCHES.glob("*.patch")):
         targets = re.findall(r"^\+\+\+ b/(\S+)", patch.read_text(), flags=re.M)
         if targets and not any(t.startswith("src/") for t in targets):
diff --git a/tresor b/tresor
index d7f2a1e..036180c 160000
--- a/tresor
+++ b/tresor
@@ -1 +1 @@
-Subproject commit d7f2a1e24a16b3bcc69ddfc56f572c21678ab815
+Subproject commit 036180c6d21b8ebdc7776fbd121b7f7509fa4b24