diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd2b242..fde3127 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.1.16] - 2026-09-02
+
+- `security-bundle` authenticates its exact called-workflow source fetch with
+  the job token, so a shared fleet egress address cannot exhaust GitHub's
+  anonymous allowance and stop the gate before any scanner runs.
+
 ## [0.1.15] - 2026-08-31
 
 - `docker-build.yml`: reusable BuildKit image build whose layer cache
diff --git a/VERSION b/VERSION
index 71d6a66..e8e277f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.1.14
+0.1.16