diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b98309..bae893c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,20 @@
+## [0.13.3](https://github.com/sendbird/stave/compare/v0.13.2...v0.13.3) (2026-07-31)
+
+### Features
+
+* Bind vault secrets to tasks by environment-variable name and inject them only into agent shell processes, preserving overrides across Claude and Codex launches and thread resumes while keeping plaintext out of runtime options, prompts, transcripts, diagnostics, and logs.
+* Add a `Fetch & checkout origin/main` action that fetches the remote default branch, guards dirty trees, detaches HEAD safely, and renders detached checkouts clearly across workspace surfaces.
+
+### Bug Fixes
+
+* Redesign the pending Ask User Question experience with accessible radio and checkbox controls, custom answers, explicit Continue and Decline actions, responsive spacing, and compact settled-state summaries.
+* Scope unattended automation approvals to each run, isolating provider, Stave Local MCP, and Lens access and revoking the run's authorization when it ends.
+* Keep active turns alive when the selected model changes during a conversation.
+* Prevent Lens resize sash borders from overlapping adjacent surfaces.
+
+### References
+
+* [#275](https://github.com/sendbird/stave/pull/275), [#276](https://github.com/sendbird/stave/pull/276), [#278](https://github.com/sendbird/stave/pull/278), [#279](https://github.com/sendbird/stave/pull/279), [#280](https://github.com/sendbird/stave/pull/280), [#281](https://github.com/sendbird/stave/pull/281)
 ## [0.13.2](https://github.com/sendbird/stave/compare/v0.13.1...v0.13.2) (2026-07-29)
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index a4b7835..903fd55 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "stave",
   "private": true,
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Stave: AI coding workspace for Claude and Codex.",
   "author": {
     "name": "Sendbird, Inc.",