diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8586395..2adcea0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ versioning: [SemVer](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.0] - 2026-10-27
+
 ### Added
 - **otf-pdf-syntax:** Object model (`Object`, `Dict`, `Name`, `PdfString`, `Stream`, `ObjId`)
   with names and strings kept as bytes, and a deterministic serializer.
diff --git a/crates/otf-pdf-syntax/tests/corpus.rs b/crates/otf-pdf-syntax/tests/corpus.rs
index 19b24c4..5d4daf8 100644
--- a/crates/otf-pdf-syntax/tests/corpus.rs
+++ b/crates/otf-pdf-syntax/tests/corpus.rs
@@ -95,10 +95,15 @@ fn external_corpus_opens() {
     use otf_pdf_syntax::{File, OpenOptions};
     use std::sync::Arc;
     let passwords = passwords();
-    assert!(
-        passwords.is_empty() || passwords.len() >= 5,
-        "pdf.js manifest passwords not found"
-    );
+    // When pdf.js's files are fetched, its manifest's passwords must load
+    // (corpus/passwords.tsv alone is always present).
+    if corpus().join("external/pdfjs").exists() {
+        let from_manifest = passwords
+            .keys()
+            .filter(|k| k.starts_with("external/pdfjs/"))
+            .count();
+        assert!(from_manifest >= 5, "pdf.js manifest passwords not found");
+    }
     against_baseline("open", |key, bytes| {
         let options = OpenOptions {
             password: passwords