diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 1e7d5c1..9b2129b 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -3,14 +3,14 @@
   "owner": { "name": "vannt-dev", "url": "https://github.com/vannt-dev" },
   "metadata": {
     "description": "junto - an evidence-based workflow engine for Claude Code.",
-    "version": "0.6.1"
+    "version": "0.6.2"
   },
   "plugins": [
     {
       "name": "junto",
       "source": ".",
       "description": "Durable state, real quality gates, and no binaries. Install it, then run /junto:start.",
-      "version": "0.6.1",
+      "version": "0.6.2",
       "category": "workflow"
     }
   ]
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index ac22762..0d8dfa6 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "junto",
   "description": "Workflow engine for Claude Code with durable state and evidence-based quality gates. No binaries, no runtime downloads, and writes only under the project's .junto directory.",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "author": { "name": "vannt-dev", "url": "https://github.com/vannt-dev" },
   "homepage": "https://github.com/vannt-dev/junto",
   "repository": "https://github.com/vannt-dev/junto",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9bbc11..51cc841 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,17 @@
 
 All notable changes to junto are documented in this file. The project follows Semantic Versioning.
 
+## [0.6.2] - 2026-10-15
+
+### Security
+
+- Update `@modelcontextprotocol/sdk` to 1.32.1, which fixes GHSA-6qxp-vccf-f47h in the SDK's OAuth client. The junto MCP server does not use that client.
+
+### Changed
+
+- Update `execa` to 10.1, Vitest to 5.0.3 and `@types/node` to 22.20.5.
+- Dependabot now proposes dependency and GitHub Actions updates. It leaves out `zod` majors: `zod` stays on 3.x, as in 0.6.1.
+
 ## [0.6.1] - 2026-09-25
 
 ### Changed
diff --git a/README.md b/README.md
index e27e41b..11636fd 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ claude plugin details junto@junto
 claude plugin update junto@junto
 ```
 
-This release is **0.6.1** and requires Node.js 22.12 or newer on `PATH`. After updating, restart
+This release is **0.6.2** and requires Node.js 22.12 or newer on `PATH`. After updating, restart
 Claude Code and confirm the version with `claude plugin details junto@junto`. Since 0.6.0, command
 gate verdicts in a Git repository root are bound to source contents; when upgrading from 0.5.x or
 earlier, rerun required gates before finishing a task. See [release notes](CHANGELOG.md).
diff --git a/packages/core/package.json b/packages/core/package.json
index c81afbe..5f9066e 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@junto/core",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "type": "module",
   "main": "./src/index.ts",
   "exports": {
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index b95416f..f3a685e 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@junto/mcp",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "type": "module",
   "main": "./src/server.ts",
   "dependencies": {
diff --git a/packages/mcp/src/version.ts b/packages/mcp/src/version.ts
index 051b616..a8f71bf 100644
--- a/packages/mcp/src/version.ts
+++ b/packages/mcp/src/version.ts
@@ -1 +1 @@
-export const VERSION = "0.6.1"
+export const VERSION = "0.6.2"
diff --git a/plugin/mcp/server.js b/plugin/mcp/server.js
index afb5dd8..8452580 100644
--- a/plugin/mcp/server.js
+++ b/plugin/mcp/server.js
@@ -27758,7 +27758,7 @@ function captureSourceFingerprint(root, config2, spec) {
 }
 
 // packages/mcp/src/version.ts
-var VERSION = "0.6.1";
+var VERSION = "0.6.2";
 
 // packages/mcp/src/context.ts
 var RUNNER = `@junto/mcp@${VERSION}`;
diff --git a/site/index.html b/site/index.html
index fedef57..8d54fa1 100644
--- a/site/index.html
+++ b/site/index.html
@@ -25,7 +25,7 @@
       <a href="#principles">Principles</a>
       <a href="https://github.com/vannt-dev/junto">GitHub</a>
     </nav>
-    <span class="version" data-version>v0.6.1</span>
+    <span class="version" data-version>v0.6.2</span>
   </header>
 
   <main id="main">