diff --git a/.github/rulesets/tags.json b/.github/rulesets/tags.json
new file mode 100644
index 0000000..6baf8fc
--- /dev/null
+++ b/.github/rulesets/tags.json
@@ -0,0 +1,19 @@
+{
+  "name": "release-tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/v*.*.*"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    { "type": "update" }
+  ],
+  "bypass_actors": [
+    { "actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "always" }
+  ]
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d81800d..3f796d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.5.5] - 2026-05-12
+
+### Added
+
+- Tag protection ruleset (`release-tags`) on the repository. Any tag matching `refs/tags/v*.*.*` now blocks deletion, force-push (`non_fast_forward`), and tag-update operations, so a published release tag cannot be silently rewritten to point at a different commit. Configured via the GitHub API; the canonical definition lives at `.github/rulesets/tags.json` for review and re-apply (`.github/rulesets/tags.json`)
+- README now displays two additional badges alongside the existing CI / Codecov / CodeQL set: a Libraries.io dependency status badge for `@hiprax/errors` and an npm-provenance badge linking to npm's provenance docs (the release workflow already publishes with `--provenance`) (`README.md`)
+
+### Changed
+
+- Repository settings: `delete_branch_on_merge` and `allow_update_branch` are now enabled at the repo level. Merged PR branches are auto-deleted from the remote, and contributors can update a PR branch from the GitHub UI without dropping to the CLI when `main` has moved ahead
+
+### Docs
+
+- `CLAUDE.md` "CI / Workflow Conventions" section now documents the tag-protection ruleset alongside the existing branch-protection guidance, so a future contributor can re-create the ruleset from the checked-in `.github/rulesets/tags.json` without reverse-engineering the GitHub UI (`CLAUDE.md`)
+
 ## [0.5.4] - 2026-05-12
 
 ### Removed
diff --git a/README.md b/README.md
index 50e4924..f9dafe6 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@
 [![CI](https://github.com/Hiprax/errors/actions/workflows/ci.yml/badge.svg)](https://github.com/Hiprax/errors/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/Hiprax/errors/branch/main/graph/badge.svg)](https://codecov.io/gh/Hiprax/errors)
 [![CodeQL](https://github.com/Hiprax/errors/actions/workflows/codeql.yml/badge.svg)](https://github.com/Hiprax/errors/actions/workflows/codeql.yml)
+[![Dependencies](https://img.shields.io/librariesio/release/npm/@hiprax/errors)](https://libraries.io/npm/@hiprax%2Ferrors)
+[![npm provenance](https://img.shields.io/badge/npm-provenance-blue?logo=npm&logoColor=white)](https://docs.npmjs.com/generating-provenance-statements)
 
 A small, typed error toolkit for Express.js apps. Zero runtime dependencies.
 
diff --git a/package-lock.json b/package-lock.json
index 06bc8b5..1fbb27f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@hiprax/errors",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@hiprax/errors",
-      "version": "0.5.4",
+      "version": "0.5.5",
       "license": "MIT",
       "devDependencies": {
         "@arethetypeswrong/cli": "^0.18.2",
diff --git a/package.json b/package.json
index e591b6d..c2d9aa9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hiprax/errors",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "A modular error handling solution for Express.js applications.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",