diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c84a4a..36b51eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,16 @@ the canonical names; short forms are listed in `cmd/kensa/flags.go`.
 
 ## Unreleased
 
+(no changes yet)
+
+## v0.4.3 — 2026-06-14
+
+Public rule read model for catalog consumers — tranche 1 of the
+OpenWatch read-model ask, scoped by the Kensa/OpenWatch ownership test
+(publish the normalization Kensa owns; carry facts, not policy). PATCH
+bump: the addition lives on `pkg/kensa`; the frozen `api/` surface is
+untouched.
+
 ### Added
 
 - **Public rule read model on `pkg/kensa`** — the normalized catalog
diff --git a/VERSION b/VERSION
index 2b7c5ae..17b2ccd 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.4.2
+0.4.3