diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 04e2c73..93f3795 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -43,3 +43,8 @@ jobs:
 
       - name: Build and validate all targets
         run: npm test
+
+      # The build syncs CHANGELOG.md into each shared plugin. publish.yml ships
+      # the committed copies, so a diff here means they're stale.
+      - name: Check committed plugin changelogs
+        run: git diff --exit-code -- shared/glean/CHANGELOG.md shared/glean-dev-docs/CHANGELOG.md
diff --git a/.release-it.json b/.release-it.json
index 256b922..7b2f072 100644
--- a/.release-it.json
+++ b/.release-it.json
@@ -11,7 +11,7 @@
     "publish": false
   },
   "hooks": {
-    "before:git:release": "npm run build"
+    "before:git:beforeRelease": "npm run build"
   },
   "plugins": {
     "@release-it/bumper": {
diff --git a/RELEASE.md b/RELEASE.md
index 3ed4aec..2ad3648 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -59,12 +59,14 @@ release is what triggers the actual plugin distribution (below).
      minor, `fix` → patch, a `BREAKING CHANGE` footer → major).
   2. Bump both the root `package.json` and
      `shared/glean/mcp/package.json` to the same version. Regenerate
-     `CHANGELOG.md`. Its `before:git:release` hook then runs `npm run build`,
-     after the changelog plugin has written the new entry and before release-it
-     commits and tags. The build syncs that changelog into `shared/glean` and
-     `shared/glean-dev-docs`, rebuilds the generated plugin output, and checks
-     that every shipped changelog matches the root — all of which is included
-     in the release commit.
+     `CHANGELOG.md`. Its `before:git:beforeRelease` hook then runs
+     `npm run build`, after the changelog plugin has written the new entry and
+     before release-it stages the release commit. The build syncs that
+     changelog into `shared/glean` and `shared/glean-dev-docs`, rebuilds the
+     generated plugin output, and checks that every shipped changelog matches
+     the root, so the synced changelogs are staged with the rest of the
+     release. A later hook such as `before:git:release` runs after staging, and
+     the synced changelogs would be left out of the commit.
   3. Commit as `chore: release v${version}`, tag `v${version}`, and push both
      to `main`.
   4. Create a GitHub Release from that tag.
diff --git a/shared/glean-dev-docs/CHANGELOG.md b/shared/glean-dev-docs/CHANGELOG.md
index d90de81..42f1d45 100644
--- a/shared/glean-dev-docs/CHANGELOG.md
+++ b/shared/glean-dev-docs/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## [3.6.0](https://github.com/gleanwork/agent-plugins/compare/v3.5.1...v3.6.0) (2026-10-28)
+
+### Features
+
+* **mcp:** promote meeting_lookup to a first-class plugin tool ([bcad1ae](https://github.com/gleanwork/agent-plugins/commit/bcad1ae61254a434e0936374f91be3db0607244a))
+
+### Bug Fixes
+
+* **mcp:** promote enterprise_search under the search name ([1024d08](https://github.com/gleanwork/agent-plugins/commit/1024d08d4dfefd6d0ebf4ea073e14332fefbb95d))
+* stop sending Glean internal-service headers from the plugin ([b5fa4af](https://github.com/gleanwork/agent-plugins/commit/b5fa4af9f37590dd0111c2ae737be6c9fe1267eb))
+
+## [3.5.1](https://github.com/gleanwork/agent-plugins/compare/v3.5.0...v3.5.1) (2026-09-29)
+
+### Bug Fixes
+
+* honor HITL opt-outs without persisting approvals ([9543dfa](https://github.com/gleanwork/agent-plugins/commit/9543dfad4b89baff66579d6ebcae09ee7e07f75a))
+* narrow HITL change to the shared approval guard ([cdd86ff](https://github.com/gleanwork/agent-plugins/commit/cdd86fffcd574401af552df73b8f173f4ff59305))
+
 ## [3.5.0](https://github.com/gleanwork/agent-plugins/compare/v3.4.2...v3.5.0) (2026-09-25)
 
 ### Features
diff --git a/shared/glean/CHANGELOG.md b/shared/glean/CHANGELOG.md
index d90de81..42f1d45 100644
--- a/shared/glean/CHANGELOG.md
+++ b/shared/glean/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## [3.6.0](https://github.com/gleanwork/agent-plugins/compare/v3.5.1...v3.6.0) (2026-10-28)
+
+### Features
+
+* **mcp:** promote meeting_lookup to a first-class plugin tool ([bcad1ae](https://github.com/gleanwork/agent-plugins/commit/bcad1ae61254a434e0936374f91be3db0607244a))
+
+### Bug Fixes
+
+* **mcp:** promote enterprise_search under the search name ([1024d08](https://github.com/gleanwork/agent-plugins/commit/1024d08d4dfefd6d0ebf4ea073e14332fefbb95d))
+* stop sending Glean internal-service headers from the plugin ([b5fa4af](https://github.com/gleanwork/agent-plugins/commit/b5fa4af9f37590dd0111c2ae737be6c9fe1267eb))
+
+## [3.5.1](https://github.com/gleanwork/agent-plugins/compare/v3.5.0...v3.5.1) (2026-09-29)
+
+### Bug Fixes
+
+* honor HITL opt-outs without persisting approvals ([9543dfa](https://github.com/gleanwork/agent-plugins/commit/9543dfad4b89baff66579d6ebcae09ee7e07f75a))
+* narrow HITL change to the shared approval guard ([cdd86ff](https://github.com/gleanwork/agent-plugins/commit/cdd86fffcd574401af552df73b8f173f4ff59305))
+
 ## [3.5.0](https://github.com/gleanwork/agent-plugins/compare/v3.4.2...v3.5.0) (2026-09-25)
 
 ### Features