diff --git a/CHANGELOG-MOQ.md b/CHANGELOG-MOQ.md
index f97f455b8..873aa8e06 100644
--- a/CHANGELOG-MOQ.md
+++ b/CHANGELOG-MOQ.md
@@ -6,6 +6,20 @@ covers the parent. Each entry names the parent commit it carries and every
 change the fork carries on top, with its upstream status, so an advisory
 against the parent can be checked against a release.
 
+## 2.0.1
+
+Parent: n0-computer/noq [`1a26a8b0`](https://github.com/n0-computer/noq/commit/1a26a8b064d21e316fe6769f068617975bd8a27b), unchanged since 1.3.0.
+
+- [#25](https://github.com/moq-dev/noq/pull/25) bound the stream and CRYPTO reassembly buffers at 1024 chunks after compaction, closing the connection with `INTERNAL_ERROR` past it ([RUSTSEC-2026-0185](https://rustsec.org/advisories/RUSTSEC-2026-0185.html)). Carries [quinn-rs/quinn#2694](https://github.com/quinn-rs/quinn/pull/2694), [#2789](https://github.com/quinn-rs/quinn/pull/2789), and [#2814](https://github.com/quinn-rs/quinn/pull/2814), matching quinn-proto 0.11.18, plus a fix so compacting an unordered stream keeps its unread data (upstream noq starts compaction at `bytes_read`, which the new count trigger made reachable). Also in 1.3.3 ([#26](https://github.com/moq-dev/noq/pull/26)). Upstream: [n0-computer/noq#828](https://github.com/n0-computer/noq/pull/828) (open).
+- [#19](https://github.com/moq-dev/noq/pull/19) report a stream reset before its WebTransport header as the reset (`WebTransportError::ReadError`), logged at debug, instead of `UnknownSession` at WARN. `UnknownSession` now means only a missing or mismatched session ID. Also in 1.3.3 ([#20](https://github.com/moq-dev/noq/pull/20)). Fork-only.
+- [#23](https://github.com/moq-dev/noq/pull/23) keep a `web-transport-moq` session's HTTP/3 control and QPACK streams open until its close capsule is delivered, so browsers see the close code and reason instead of "Connection lost.". Also in 1.3.3 ([#24](https://github.com/moq-dev/noq/pull/24)). Fork-only.
+- [#27](https://github.com/moq-dev/noq/pull/27) send a raw QUIC session's (`Session::raw`) stream reset and stop codes as is, instead of mapping them into the HTTP/3 WebTransport range, and read a peer's code as is. Not in 1.3.3. Fork-only.
+
+No API change. Wire:
+
+- A peer that exceeds the reassembly cap is now closed.
+- Raw QUIC stream codes are compatible in one direction only: 2.0.1 still reads an older raw peer's mapped codes, but an older raw peer reads 2.0.1's codes as `InvalidReset` / `InvalidStopped`. HTTP/3 sessions are unchanged.
+
 ## 2.0.0
 
 Parent: n0-computer/noq [`1a26a8b0`](https://github.com/n0-computer/noq/commit/1a26a8b064d21e316fe6769f068617975bd8a27b), unchanged since 1.3.0.
diff --git a/Cargo.lock b/Cargo.lock
index b5a05714b..94c343e6c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1876,7 +1876,7 @@ dependencies = [
 
 [[package]]
 name = "moq-noq"
-version = "2.0.0"
+version = "2.0.1"
 dependencies = [
  "anyhow",
  "async-executor",
@@ -1919,7 +1919,7 @@ dependencies = [
 
 [[package]]
 name = "moq-noq-proto"
-version = "2.0.0"
+version = "2.0.1"
 dependencies = [
  "aes-gcm",
  "arbitrary",
@@ -1959,7 +1959,7 @@ dependencies = [
 
 [[package]]
 name = "moq-noq-udp"
-version = "2.0.0"
+version = "2.0.1"
 dependencies = [
  "cfg_aliases",
  "criterion",
@@ -3531,7 +3531,7 @@ dependencies = [
 
 [[package]]
 name = "web-transport-moq"
-version = "2.0.0"
+version = "2.0.1"
 dependencies = [
  "anyhow",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index f775102cb..3d0401fed 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ default-members = ["noq", "noq-proto", "noq-udp", "web-transport-moq", "bench",
 resolver = "2"
 
 [workspace.package]
-version = "2.0.0"
+version = "2.0.1"
 rust-version = "1.88"
 edition = "2024"
 license = "MIT OR Apache-2.0"
diff --git a/noq/Cargo.toml b/noq/Cargo.toml
index ff3b0af2b..5b91ff11a 100644
--- a/noq/Cargo.toml
+++ b/noq/Cargo.toml
@@ -67,13 +67,13 @@ derive_more = { workspace = true }
 futures-io = { workspace = true, optional = true }
 rustc-hash = { workspace = true }
 pin-project-lite = { workspace = true }
-proto = { package = "moq-noq-proto", path = "../noq-proto", version = "2.0.0", default-features = false }
+proto = { package = "moq-noq-proto", path = "../noq-proto", version = "2.0.1", default-features = false }
 rustls = { workspace = true, optional = true }
 smol = { workspace = true, optional = true }
 thiserror = { workspace = true }
 tracing =  { workspace = true }
 tokio = { workspace = true }
-udp = { package = "moq-noq-udp", path = "../noq-udp", version = "2.0.0", default-features = false, features = ["tracing"] }
+udp = { package = "moq-noq-udp", path = "../noq-udp", version = "2.0.1", default-features = false, features = ["tracing"] }
 
 # Fix minimal dependencies for indirect deps
 async-global-executor = { workspace = true, optional = true }
diff --git a/web-transport-moq/Cargo.toml b/web-transport-moq/Cargo.toml
index 4143fb556..ada0b5cb9 100644
--- a/web-transport-moq/Cargo.toml
+++ b/web-transport-moq/Cargo.toml
@@ -28,7 +28,7 @@ bytes = "1"
 futures = "0.3"
 http = "1"
 kio = "0.5.4"
-noq = { package = "moq-noq", path = "../noq", version = "2.0.0", default-features = false, features = [
+noq = { package = "moq-noq", path = "../noq", version = "2.0.1", default-features = false, features = [
     "tracing-log",
     "platform-verifier",
     "runtime-tokio",