diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2154471..ec43587 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,15 @@ cut and that this clone does not carry.
 
 ## [Unreleased]
 
+## [0.0.84] - 2026-09-30
+
+A routine pin refresh: six of the seven vendors published newer
+builds than the baselines carried, so the artifact tables were
+re-measured end to end — every digest computed from bytes this release
+read, npm artifacts additionally checked against the registry's own
+sha512. Codex CLI now pins what its vendor publishes today.
+Protocol, ownership and the kit are unchanged.
+
 ## [0.0.83] - 2026-09-29
 
 A second audit of the seven rendered trees, run against the shipped
diff --git a/Cargo.lock b/Cargo.lock
index f9f6b76..ddd57cc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -25,7 +25,7 @@ checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "codex-setup-system"
-version = "0.0.83"
+version = "0.0.84"
 dependencies = [
  "harness-runtime",
  "provider-v3",
@@ -76,7 +76,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "harness-runtime"
-version = "0.0.83"
+version = "0.0.84"
 dependencies = [
  "provider-v3",
  "serde",
@@ -147,7 +147,7 @@ dependencies = [
 
 [[package]]
 name = "provider-v3"
-version = "0.0.83"
+version = "0.0.84"
 dependencies = [
  "serde",
  "serde_json",
@@ -209,7 +209,7 @@ dependencies = [
 
 [[package]]
 name = "setup-core"
-version = "0.0.83"
+version = "0.0.84"
 dependencies = [
  "miniz_oxide",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 9f4a2eb..48f713b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.83"
+version = "0.0.84"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.83" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.83" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.83" }
+setup-core = { path = "crates/setup-core", version = "0.0.84" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.84" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.84" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
diff --git a/README.md b/README.md
index 3807e08..85e2293 100644
--- a/README.md
+++ b/README.md
@@ -180,7 +180,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/codex-setup-system:0.0.83 \
+  ghcr.io/nddev-opennetwork/codex-setup-system:0.0.84 \
   status --target /config/<dir> --json
 ```
 
diff --git a/install.ps1 b/install.ps1
index 876eeb1..504ef8e 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.83",
+  [string]$Version = "0.0.84",
   [string]$InstallDir = $(if ($env:CODEX_INSTALL_DIR) { $env:CODEX_INSTALL_DIR } else { "$env:LOCALAPPDATA\Programs\codex-setup-system" })
 )
 $ErrorActionPreference = "Stop"
diff --git a/install.sh b/install.sh
index aab6994..5b85f2f 100644
--- a/install.sh
+++ b/install.sh
@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/codex-setup-system"
 BINARY="codex-setup-system"
-VERSION="${1:-0.0.83}"
+VERSION="${1:-0.0.84}"
 PREFIX="${CODEX_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in