diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 2537c1f..f1c1e58 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.4.0"
+  ".": "0.5.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0cd8541..4fead60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0](https://github.com/bedrock-python/touchmark/compare/v0.4.0...v0.5.0) (2026-10-09)
+
+
+### Features
+
+* **azuredevops:** run a hub on Azure Pipelines ([#25](https://github.com/bedrock-python/touchmark/issues/25)) ([f66aeb4](https://github.com/bedrock-python/touchmark/commit/f66aeb413cdef95b70fb70206c61340b6f66a18c))
+* **gitlab:** a hub inside the group of its targets (security.writer_on_hub: guard) ([#27](https://github.com/bedrock-python/touchmark/issues/27)) ([2e4805f](https://github.com/bedrock-python/touchmark/commit/2e4805f4dd1a4cd81603e8e68831de87429e3e88))
+
 ## [0.4.0](https://github.com/bedrock-python/touchmark/compare/v0.3.0...v0.4.0) (2026-10-09)
 
 
diff --git a/README.md b/README.md
index 486dcae..3616255 100644
--- a/README.md
+++ b/README.md
@@ -23,8 +23,8 @@ Three ways in, one version number:
 
 | | | |
 |---|---|---|
-| **GitHub Action** | `uses: bedrock-python/touchmark@<commit> # v0.4.0` | The hub's workflows on GitHub. Runs the release's image by digest, after checking its build provenance. [The Action](https://bedrock-python.github.io/touchmark/reference/action/) |
-| **Container image** | `ghcr.io/bedrock-python/touchmark:0.4.0` | GitLab CI, Gitea and Forgejo Actions, `docker run`: touchmark and git on Alpine, as a non-root user. [Run it in CI](https://bedrock-python.github.io/touchmark/guide/ci/) |
+| **GitHub Action** | `uses: bedrock-python/touchmark@<commit> # v0.5.0` | The hub's workflows on GitHub. Runs the release's image by digest, after checking its build provenance. [The Action](https://bedrock-python.github.io/touchmark/reference/action/) |
+| **Container image** | `ghcr.io/bedrock-python/touchmark:0.5.0` | GitLab CI, Gitea and Forgejo Actions, `docker run`: touchmark and git on Alpine, as a non-root user. [Run it in CI](https://bedrock-python.github.io/touchmark/guide/ci/) |
 | **Binary** | [Releases](https://github.com/bedrock-python/touchmark/releases) | Linux, macOS and Windows on amd64 and arm64, one static binary; or `go install github.com/bedrock-python/touchmark/cmd/touchmark@latest` with Go 1.26 or newer. [Installation](https://bedrock-python.github.io/touchmark/getting-started/installation/) |
 
 <!-- x-release-please-end -->
@@ -77,7 +77,7 @@ Three ways in, one version number:
 <!-- x-release-please-start-version -->
 ```bash
 # The binary for your platform, from the release
-v=0.4.0
+v=0.5.0
 curl -fsSLO "https://github.com/bedrock-python/touchmark/releases/download/v$v/touchmark_${v}_linux_amd64.tar.gz"
 tar -xzf "touchmark_${v}_linux_amd64.tar.gz" touchmark
 
@@ -85,7 +85,7 @@ tar -xzf "touchmark_${v}_linux_amd64.tar.gz" touchmark
 go install github.com/bedrock-python/touchmark/cmd/touchmark@latest
 
 # The image
-docker pull ghcr.io/bedrock-python/touchmark:0.4.0
+docker pull ghcr.io/bedrock-python/touchmark:0.5.0
 ```
 <!-- x-release-please-end -->
 
@@ -166,7 +166,7 @@ runs the Action; its plan step on a hub pull request:
 
 <!-- x-release-please-start-version -->
 ```yaml
-- uses: bedrock-python/touchmark@<commit> # v0.4.0
+- uses: bedrock-python/touchmark@<commit> # v0.5.0
   with:
     command: plan
     strict: true
diff --git a/action.yml b/action.yml
index 408c0f0..6a97056 100644
--- a/action.yml
+++ b/action.yml
@@ -90,7 +90,7 @@ runs:
         # the latest release's version, or 0.0.0 before the first one, which
         # run.sh refuses. The step's own env: a workflow cannot override them.
         TM_IMAGE: ghcr.io/bedrock-python/touchmark
-        TM_VERSION: "0.4.0" # x-release-please-version
+        TM_VERSION: "0.5.0" # x-release-please-version
         # gh needs a token to start; with --bundle-from-oci it reads the
         # attestation from the registry, not from the GitHub API. The
         # container never gets it (run.sh passes CI, GITHUB_* and