diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40a1dd4..0a3b265 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,14 @@ cut and that this clone does not carry.
 
 ## [Unreleased]
 
+## [0.0.87] - 2026-09-30
+
+A small pin refresh: codex moved to 0.159.2 and antigravity to
+1.2.14 in the hours after 0.0.86 was measured, so the artifact tables
+were re-measured for both — every digest computed from bytes this
+release read. The other five products pin what their vendors published
+at the same check. Protocol, ownership and the kit are unchanged.
+
 ## [0.0.86] - 2026-09-30
 
 The rendered workflows move `setup-rust-toolchain` from 1.17.0 to
diff --git a/Cargo.lock b/Cargo.lock
index bccc30a..592620a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -66,7 +66,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "harness-runtime"
-version = "0.0.86"
+version = "0.0.87"
 dependencies = [
  "provider-v3",
  "serde",
@@ -128,7 +128,7 @@ dependencies = [
 
 [[package]]
 name = "opencode-setup-system"
-version = "0.0.86"
+version = "0.0.87"
 dependencies = [
  "harness-runtime",
  "provider-v3",
@@ -147,7 +147,7 @@ dependencies = [
 
 [[package]]
 name = "provider-v3"
-version = "0.0.86"
+version = "0.0.87"
 dependencies = [
  "serde",
  "serde_json",
@@ -209,7 +209,7 @@ dependencies = [
 
 [[package]]
 name = "setup-core"
-version = "0.0.86"
+version = "0.0.87"
 dependencies = [
  "miniz_oxide",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index cde79bd..e40322a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.86"
+version = "0.0.87"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.86" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.86" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.86" }
+setup-core = { path = "crates/setup-core", version = "0.0.87" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.87" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.87" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
diff --git a/README.md b/README.md
index 5d149b8..d6bd005 100644
--- a/README.md
+++ b/README.md
@@ -180,7 +180,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.86 \
+  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.87 \
   status --target /config/<dir> --json
 ```
 
diff --git a/install.ps1 b/install.ps1
index 2c9cd85..c6a8859 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.86",
+  [string]$Version = "0.0.87",
   [string]$InstallDir = $(if ($env:OPENCODE_INSTALL_DIR) { $env:OPENCODE_INSTALL_DIR } else { "$env:LOCALAPPDATA\Programs\opencode-setup-system" })
 )
 $ErrorActionPreference = "Stop"
diff --git a/install.sh b/install.sh
index a1c2668..2deb51e 100644
--- a/install.sh
+++ b/install.sh
@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/opencode-setup-system"
 BINARY="opencode-setup-system"
-VERSION="${1:-0.0.86}"
+VERSION="${1:-0.0.87}"
 PREFIX="${OPENCODE_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in