diff --git a/Cargo.lock b/Cargo.lock
index 4a78e2b88..1e7476857 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -392,9 +392,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "375989decec1a0fa424442bed520fa12ede43a48475ce8c7417d2c69b32b5f6b"
+checksum = "4ff2a8126fff0f8c839080d619675a585e61720bb12d2baceae45769fd66f155"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -1352,9 +1352,9 @@ checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
 [[package]]
 name = "graviola"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0b1b23c921e2b08241ad0d705659d3bfe942c6aac90bd94008652198f650def"
+checksum = "a1a15622a211648cbf64f485e0369791466d133eb6578fd99e4a61230c88a6aa"
 dependencies = [
  "cfg-if",
  "getrandom 0.4.3",
@@ -3012,7 +3012,7 @@ dependencies = [
 
 [[package]]
 name = "rind"
-version = "0.1.13"
+version = "0.2.0"
 dependencies = [
  "aws-lc-rs",
  "aws-lc-sys",
@@ -3094,7 +3094,7 @@ dependencies = [
 
 [[package]]
 name = "rind-dimpl"
-version = "0.1.13"
+version = "0.2.0"
 dependencies = [
  "aws-lc-rs",
  "crabgrind 0.4.0",
@@ -3134,7 +3134,7 @@ dependencies = [
 
 [[package]]
 name = "rind-jsonwebtoken"
-version = "0.1.13"
+version = "0.2.0"
 dependencies = [
  "aws-lc-rs",
  "crabgrind 0.4.0",
@@ -3146,7 +3146,7 @@ dependencies = [
 
 [[package]]
 name = "rind-object-store"
-version = "0.1.13"
+version = "0.2.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -3160,7 +3160,7 @@ dependencies = [
 
 [[package]]
 name = "rind-rcgen"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
  "crabgrind 0.4.0",
  "rcgen",
@@ -3173,7 +3173,7 @@ dependencies = [
 
 [[package]]
 name = "rind-ring"
-version = "0.1.12"
+version = "0.2.0"
 dependencies = [
  "aws-lc-rs",
  "crabgrind 0.4.0",
@@ -3187,7 +3187,7 @@ dependencies = [
 
 [[package]]
 name = "rind-rustls"
-version = "0.1.13"
+version = "0.2.0"
 dependencies = [
  "aws-lc-rs",
  "crabgrind 0.4.0",
@@ -3639,9 +3639,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.16.4"
+version = "1.16.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+checksum = "149309498a5f7334b12ddae0cad8aba81ce785fe91755068867e017cf98fee46"
 
 [[package]]
 name = "socket2"
@@ -3908,18 +3908,18 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+checksum = "173f25c883cd2176a2d8212155638c0a60d484a9d84546d270866f40f56b6e49"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.25.18+spec-1.1.0"
+version = "0.25.19+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ec6e78bd70db9420d8d212fa9dc97f116448a1ceff5d00eabb991d407e21396"
+checksum = "dd43688c4858d7264ae1cf9a9f874a67c3feb74a883b1cd7bebd6a4ea8307218"
 dependencies = [
  "indexmap",
  "toml_datetime",
diff --git a/rind-dimpl/CHANGELOG.md b/rind-dimpl/CHANGELOG.md
index 1322d622e..7f83bf20b 100644
--- a/rind-dimpl/CHANGELOG.md
+++ b/rind-dimpl/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/moq-dev/rind/compare/rind-dimpl-v0.1.13...rind-dimpl-v0.2.0) - 2026-11-06
+
+### Fixed
+
+- *(adapters)* [**breaking**] return each adapter's own MissingFeature, not rind's ([#420](https://github.com/moq-dev/rind/pull/420))
+
 ## [0.1.13](https://github.com/moq-dev/rind/compare/rind-dimpl-v0.1.12...rind-dimpl-v0.1.13) - 2026-11-05
 
 ### Other
diff --git a/rind-dimpl/Cargo.toml b/rind-dimpl/Cargo.toml
index d8e592f75..eac1cc9e3 100644
--- a/rind-dimpl/Cargo.toml
+++ b/rind-dimpl/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-dimpl"
-version = "0.1.13"
+version = "0.2.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -15,7 +15,7 @@ readme = "README.md"
 # Without it a custom provider cannot enforce that, and it adds only the DER
 # parsers this crate already needs to read certificates.
 dimpl = { version = "0.9", default-features = false, features = ["_crypto-common"] }
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 x509-cert = { version = "0.3", default-features = false }
 
 [dev-dependencies]
diff --git a/rind-instant-acme/Cargo.toml b/rind-instant-acme/Cargo.toml
index 4873317d5..60c9108ec 100644
--- a/rind-instant-acme/Cargo.toml
+++ b/rind-instant-acme/Cargo.toml
@@ -14,7 +14,7 @@ publish = false
 
 [dependencies]
 instant-acme = { git = "https://github.com/djc/instant-acme", rev = "1cbc35cca446e6d6813b3c13ac843d50948facd0", default-features = false }
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 rustls-pki-types = "1"
 
 [dev-dependencies]
diff --git a/rind-jsonwebtoken/CHANGELOG.md b/rind-jsonwebtoken/CHANGELOG.md
index af2f34cde..498673fb3 100644
--- a/rind-jsonwebtoken/CHANGELOG.md
+++ b/rind-jsonwebtoken/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/moq-dev/rind/compare/rind-jsonwebtoken-v0.1.13...rind-jsonwebtoken-v0.2.0) - 2026-11-06
+
+### Added
+
+- [**breaking**] audit rind's public API, and apply its decisions, before 0.2.0 ([#383](https://github.com/moq-dev/rind/pull/383))
+
 ## [0.1.13](https://github.com/moq-dev/rind/compare/rind-jsonwebtoken-v0.1.12...rind-jsonwebtoken-v0.1.13) - 2026-11-05
 
 ### Other
diff --git a/rind-jsonwebtoken/Cargo.toml b/rind-jsonwebtoken/Cargo.toml
index 2499c6a77..47bb8d7c7 100644
--- a/rind-jsonwebtoken/Cargo.toml
+++ b/rind-jsonwebtoken/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-jsonwebtoken"
-version = "0.1.13"
+version = "0.2.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -10,7 +10,7 @@ rust-version.workspace = true
 readme = "README.md"
 
 [dependencies]
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 jsonwebtoken = { version = "11.1", default-features = false }
 pkcs1 = { version = "0.7.5", default-features = false, features = ["alloc"] }
 
diff --git a/rind-object-store/CHANGELOG.md b/rind-object-store/CHANGELOG.md
index 3d5325c29..7e0f10e88 100644
--- a/rind-object-store/CHANGELOG.md
+++ b/rind-object-store/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/moq-dev/rind/compare/rind-object-store-v0.1.13...rind-object-store-v0.2.0) - 2026-11-06
+
+### Fixed
+
+- *(adapters)* [**breaking**] return each adapter's own MissingFeature, not rind's ([#420](https://github.com/moq-dev/rind/pull/420))
+
 ## [0.1.13](https://github.com/moq-dev/rind/compare/rind-object-store-v0.1.12...rind-object-store-v0.1.13) - 2026-11-05
 
 ### Other
diff --git a/rind-object-store/Cargo.toml b/rind-object-store/Cargo.toml
index aff187658..ef394ee7f 100644
--- a/rind-object-store/Cargo.toml
+++ b/rind-object-store/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-object-store"
-version = "0.1.13"
+version = "0.2.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -13,7 +13,7 @@ readme = "README.md"
 # object_store exposes its CryptoProvider only with a cloud backend enabled;
 # gcp-base is the one that adds no dependencies beyond the shared cloud-base.
 object_store = { version = "0.14", default-features = false, features = ["gcp-base"] }
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 rustls-pki-types = { version = "1.9", default-features = false, features = ["std"] }
 
 [dev-dependencies]
diff --git a/rind-rcgen/CHANGELOG.md b/rind-rcgen/CHANGELOG.md
index 6fb424fcd..7c422293c 100644
--- a/rind-rcgen/CHANGELOG.md
+++ b/rind-rcgen/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.14](https://github.com/moq-dev/rind/compare/rind-rcgen-v0.1.13...rind-rcgen-v0.1.14) - 2026-11-06
+
+### Other
+
+- updated the following local packages: rind
+
 ## [0.1.13](https://github.com/moq-dev/rind/compare/rind-rcgen-v0.1.12...rind-rcgen-v0.1.13) - 2026-11-05
 
 ### Other
diff --git a/rind-rcgen/Cargo.toml b/rind-rcgen/Cargo.toml
index 1b9596a6a..6431456df 100644
--- a/rind-rcgen/Cargo.toml
+++ b/rind-rcgen/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-rcgen"
-version = "0.1.13"
+version = "0.1.14"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -11,7 +11,7 @@ readme = "README.md"
 
 [dependencies]
 rcgen = { version = "0.14", default-features = false }
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 rustls-pki-types = "1.12"
 zeroize = "1.9"
 
diff --git a/rind-ring/CHANGELOG.md b/rind-ring/CHANGELOG.md
index a8ca9a3c1..27206b984 100644
--- a/rind-ring/CHANGELOG.md
+++ b/rind-ring/CHANGELOG.md
@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/moq-dev/rind/compare/rind-ring-v0.1.12...rind-ring-v0.2.0) - 2026-11-06
+
+### Added
+
+- *(rsa)* load RSA keys named id-RSAES-OAEP or id-ea-rsa, as aws-lc-rs does ([#413](https://github.com/moq-dev/rind/pull/413))
+- [**breaking**] audit rind's public API, and apply its decisions, before 0.2.0 ([#383](https://github.com/moq-dev/rind/pull/383))
+- *(rind-ring)* re-export rind's CPU check as cpu ([#377](https://github.com/moq-dev/rind/pull/377))
+
+### Fixed
+
+- *(adapters)* [**breaking**] return each adapter's own MissingFeature, not rind's ([#420](https://github.com/moq-dev/rind/pull/420))
+
+### Other
+
+- *(readme)* show how to use rind and link the details ([#410](https://github.com/moq-dev/rind/pull/410))
+- stop wiping anything but keys, keyed state, and private-key heap scratch ([#394](https://github.com/moq-dev/rind/pull/394))
+- *(sha256)* [**breaking**] finish SHA-NI hashes in registers, and digest contexts by reference ([#352](https://github.com/moq-dev/rind/pull/352))
+
 ## [0.1.12](https://github.com/moq-dev/rind/compare/rind-ring-v0.1.11...rind-ring-v0.1.12) - 2026-11-05
 
 ### Fixed
diff --git a/rind-ring/Cargo.toml b/rind-ring/Cargo.toml
index 0fd32eb06..e9a6aa305 100644
--- a/rind-ring/Cargo.toml
+++ b/rind-ring/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-ring"
-version = "0.1.12"
+version = "0.2.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -21,7 +21,7 @@ dev_urandom_fallback = []
 std = ["alloc"]
 
 [dependencies]
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 untrusted = "0.9"
 
 [dev-dependencies]
diff --git a/rind-rustls/CHANGELOG.md b/rind-rustls/CHANGELOG.md
index a40251693..24ca4e3b7 100644
--- a/rind-rustls/CHANGELOG.md
+++ b/rind-rustls/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/moq-dev/rind/compare/rind-rustls-v0.1.13...rind-rustls-v0.2.0) - 2026-11-06
+
+### Added
+
+- [**breaking**] audit rind's public API, and apply its decisions, before 0.2.0 ([#383](https://github.com/moq-dev/rind/pull/383))
+
+### Fixed
+
+- *(adapters)* [**breaking**] return each adapter's own MissingFeature, not rind's ([#420](https://github.com/moq-dev/rind/pull/420))
+
+### Other
+
+- *(sha256)* [**breaking**] finish SHA-NI hashes in registers, and digest contexts by reference ([#352](https://github.com/moq-dev/rind/pull/352))
+
 ## [0.1.13](https://github.com/moq-dev/rind/compare/rind-rustls-v0.1.12...rind-rustls-v0.1.13) - 2026-11-05
 
 ### Added
diff --git a/rind-rustls/Cargo.toml b/rind-rustls/Cargo.toml
index 9a9382e1a..6a63ee5d2 100644
--- a/rind-rustls/Cargo.toml
+++ b/rind-rustls/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-rustls"
-version = "0.1.13"
+version = "0.2.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -10,7 +10,7 @@ rust-version.workspace = true
 readme = "README.md"
 
 [dependencies]
-rind = { version = "0.1.13", path = "../rind" }
+rind = { version = "0.2.0", path = "../rind" }
 rustls = { version = "0.23.20", default-features = false, features = ["std", "tls12"] }
 
 [dev-dependencies]
diff --git a/rind/CHANGELOG.md b/rind/CHANGELOG.md
index 80a9aec3d..09053008a 100644
--- a/rind/CHANGELOG.md
+++ b/rind/CHANGELOG.md
@@ -7,6 +7,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/moq-dev/rind/compare/rind-v0.1.13...rind-v0.2.0) - 2026-11-06
+
+### Added
+
+- *(key_wrap)* AES key wrap with padding (RFC 5649) ([#418](https://github.com/moq-dev/rind/pull/418))
+- *(rsa)* load RSA keys named id-RSAES-OAEP or id-ea-rsa, as aws-lc-rs does ([#413](https://github.com/moq-dev/rind/pull/413))
+- *(rsa)* RSA public keys export as SPKI ([#411](https://github.com/moq-dev/rind/pull/411))
+- [**breaking**] audit rind's public API, and apply its decisions, before 0.2.0 ([#383](https://github.com/moq-dev/rind/pull/383))
+- *(keys)* SPKI, SEC1, and seed key formats, and compressed ECDH peers, for Bun ([#382](https://github.com/moq-dev/rind/pull/382))
+- *(cipher)* AES-CBC with PKCS#7 padding on every backend ([#381](https://github.com/moq-dev/rind/pull/381))
+- *(agreement)* [**breaking**] store, load, and export agreement keys, agreeing by reference ([#372](https://github.com/moq-dev/rind/pull/372))
+- *(signature)* ECDSA over a precomputed digest ([#379](https://github.com/moq-dev/rind/pull/379))
+- *(signature)* RSA-PSS with any salt length ([#363](https://github.com/moq-dev/rind/pull/363))
+- *(key_wrap)* AES key wrap (RFC 3394) on AES decryption for every backend ([#359](https://github.com/moq-dev/rind/pull/359))
+- *(rsa)* RSA-OAEP encryption and decryption, and RSA SPKI public keys ([#361](https://github.com/moq-dev/rind/pull/361))
+- *(cipher)* [**breaking**] AES-CTR over a 16-byte counter block with a per-key counter width ([#360](https://github.com/moq-dev/rind/pull/360))
+- *(aead)* AES-GCM with any IV length and truncated tags ([#362](https://github.com/moq-dev/rind/pull/362))
+- *(digest)* SHA3-256, SHA3-384, and SHA3-512 ([#358](https://github.com/moq-dev/rind/pull/358))
+- *(proofs)* prove aarch64 P-256 ECDSA end to end with Aeneas and Lean ([#346](https://github.com/moq-dev/rind/pull/346))
+
+### Fixed
+
+- *(ctgrind)* green the nightly again: PBKDF2's HMAC out of line, and DIT denied under valgrind ([#406](https://github.com/moq-dev/rind/pull/406))
+- *(bench-report)* hold each host with quest gate --host, and measure macOS noise ([#399](https://github.com/moq-dev/rind/pull/399))
+- *(cpu)* run aarch64 Linux with DIT where Hyper-V hides it ([#370](https://github.com/moq-dev/rind/pull/370))
+- *(cpu)* run aarch64 Windows with DIT where the core has it ([#366](https://github.com/moq-dev/rind/pull/366))
+- *(x86_64)* build on the declared 1.90 rust-version, and gate on it ([#365](https://github.com/moq-dev/rind/pull/365))
+
+### Other
+
+- *(digest)* start and reset a Context from a constant ([#416](https://github.com/moq-dev/rind/pull/416))
+- *(readme)* show how to use rind and link the details ([#410](https://github.com/moq-dev/rind/pull/410))
+- *(aarch64)* seal and open short AES-GCM messages in one pass ([#393](https://github.com/moq-dev/rind/pull/393))
+- *(aes)* header protection reads the sample straight into AES-NI ([#392](https://github.com/moq-dev/rind/pull/392))
+- *(readme)* credit Vale's proven kernel for short AES-GCM on VAES CPUs ([#402](https://github.com/moq-dev/rind/pull/402))
+- *(aes-gcm)* run Vale's kernel for short messages on VAES CPUs ([#391](https://github.com/moq-dev/rind/pull/391))
+- stop wiping anything but keys, keyed state, and private-key heap scratch ([#394](https://github.com/moq-dev/rind/pull/394))
+- *(sha)* pad SHA-1 and SHA-256's last block in registers on the SHA extensions ([#376](https://github.com/moq-dev/rind/pull/376))
+- *(ecdsa)* build a verifying key's multiples on its first verification (P-256 keygen 1.4x) ([#374](https://github.com/moq-dev/rind/pull/374))
+- a prompt has an agent migrate a repo to rind and report the results ([#357](https://github.com/moq-dev/rind/pull/357))
+- *(sha256)* [**breaking**] finish SHA-NI hashes in registers, and digest contexts by reference ([#352](https://github.com/moq-dev/rind/pull/352))
+- *(build)* test aarch64 Windows, x86_64 macOS, and musl ([#356](https://github.com/moq-dev/rind/pull/356))
+
 ## [0.1.13](https://github.com/moq-dev/rind/compare/rind-v0.1.12...rind-v0.1.13) - 2026-11-05
 
 ### Added
diff --git a/rind/Cargo.toml b/rind/Cargo.toml
index 9662b52a5..254cdb409 100644
--- a/rind/Cargo.toml
+++ b/rind/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind"
-version = "0.1.13"
+version = "0.2.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "(Apache-2.0 OR ISC OR MIT-0) AND (Apache-2.0 OR ISC OR MIT) AND Apache-2.0 AND ISC"