diff --git a/catalog_changelog.md b/catalog_changelog.md
index 451557e..fff373e 100644
--- a/catalog_changelog.md
+++ b/catalog_changelog.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## v0.4.3
+
+- Added a clean-room FIDO 2.0 authenticator with CTAPHID, CTAP2, and ES256.
+- Added non-resident WebAuthn credentials with physical Approve or Deny user presence.
+- Added a separate AES-GCM encrypted FIDO credential store with persistence, allow-list matching, signature counters, and cancellation.
+- Restores the previous USB configuration when FIDO2 mode exits.
+- Improved new-entry navigation so saved entries open on Inject and return there after typing.
+- Verified Chromium registration and authentication, restart persistence, ES256 signatures, and physical USB lifecycle behavior.
+
 ## v0.4
 
 - Added master PIN setup/unlock gate before vault access.
diff --git a/catalog_description.md b/catalog_description.md
index 1b0f6a5..91480b4 100644
--- a/catalog_description.md
+++ b/catalog_description.md
@@ -1,13 +1,19 @@
 # CK42X PassVault
 
-CK42X PassVault is a Flipper Zero app for storing, generating, and typing passwords from the device.
+CK42X PassVault is a Flipper Zero app for storing, generating, and typing passwords from the device. Version 0.4.3 also adds experimental FIDO2 WebAuthn registration and authentication.
 
 It lets you save a small list of account entries, generate passwords from readable presets, and type a selected password over USB HID after explicit confirmation on the Flipper.
 
 Generated passwords use the Flipper RNG. Before saving a generated password, the app checks it against the passwords already saved in the vault and changes it if needed so the generated password is unique within the current vault.
 
+## FIDO2 security key
+
+The experimental FIDO2 runtime supports FIDO 2.0, ES256, non-resident credentials, allow lists, and physical user presence. Every registration and authentication ceremony requires an explicit Approve or Deny decision on the Flipper. Exiting FIDO2 mode restores the previous USB configuration.
+
+FIDO credentials use a separate AES-GCM encrypted store and do not change the password vault. Keep another authenticator and account recovery method for every account.
+
 ## Security note
 
-v0.4 stores the active vault as AES-GCM encrypted app data and requires a master PIN to unlock. On first setup it migrates legacy plaintext vault.tsv once, then removes it after the encrypted save succeeds.
+PassVault stores the active password vault and FIDO credentials in separate AES-GCM encrypted app-data files and requires a master PIN to unlock. On first setup it migrates legacy plaintext vault.tsv once, then removes it after the encrypted save succeeds.
 
-This is a small Flipper utility, not a hardened audited password manager: device compromise, weak PINs, shoulder surfing, or modified firmware can still expose vault contents.
+This is an experimental, unaudited Flipper utility. Flipper Zero has no secure element, and this build is not FIDO certified. Device compromise, weak PINs, shoulder surfing, debug access, or modified firmware can expose protected material. Client PIN, resident credentials, and user verification are unsupported.