diff --git a/.claude/skills/release/SKILL.md b/.claude/skills/release/SKILL.md
index 4b82da9..47c7574 100644
--- a/.claude/skills/release/SKILL.md
+++ b/.claude/skills/release/SKILL.md
@@ -40,7 +40,7 @@ Once confirmed:
    - Move everything under `## [Unreleased]` into a new `## [X.Y.Z] - YYYY-MM-DD` section (use today's date), placed immediately below `## [Unreleased]` (i.e., at the top of the released versions list).
    - Leave `## [Unreleased]` empty (with just the heading).
    - Each released version must have its own section with its changes — never merge entries across versions.
-5. Search all documentation files (`docs/`, `README.md`, `examples/`) for references to the previous version (e.g. image tags like `initium:1.3.1`, version strings) and update them to the new version. Exclude `CHANGELOG.md` (historical entries should keep their original versions).
+5. Search all documentation files (`docs/`, `README.md`, `examples/`) and the `Makefile` for references to the previous version (e.g. image tags like `initium:1.3.1`, version strings, cosign `--certificate-identity` tag refs in `docs/security.md`) and update them to the new version. Exclude `CHANGELOG.md` (historical entries should keep their original versions).
 6. Run `cargo test` to verify nothing is broken.
 7. Run `cargo clippy -- -D warnings` and `cargo fmt -- --check`.
 8. Commit all changed files (`Cargo.toml`, `Cargo.lock`, `CHANGELOG.md`, docs): `release: vX.Y.Z`
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fbea3ad..d9aceab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.0] - 2026-03-14
+
 ### Added
 
 - `database.default_database` field for structured config: specifies which database to connect to during `create_if_missing` bootstrap. Defaults to `postgres` for PostgreSQL; MySQL connects without selecting a database. Useful when the user does not have access to the default `postgres` database.
diff --git a/Cargo.toml b/Cargo.toml
index 1a75a7c..5d1ffca 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "initium"
-version = "2.0.1"
+version = "2.1.0"
 authors = ["Kitstream <opensource@kitstream.io>"]
 categories = ["command-line-utilities", "development-tools"]
 documentation = "https://docs.rs/initium"
diff --git a/docs/security.md b/docs/security.md
index 75a839f..09f49d0 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -86,11 +86,11 @@ Release images are signed with [cosign](https://github.com/sigstore/cosign) usin
 # Verify signature (requires cosign)
 cosign verify \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-  --certificate-identity 'https://github.com/KitStream/initium/.github/workflows/release.yml@refs/tags/v2.0.1' \
-  ghcr.io/kitstream/initium:2.0.1
+  --certificate-identity 'https://github.com/KitStream/initium/.github/workflows/release.yml@refs/tags/v2.1.0' \
+  ghcr.io/kitstream/initium:2.1.0
 
 # Or use the Makefile target (also supports IMAGE=ghcr.io/kitstream/initium-jyq)
-make verify-image VERSION=2.0.1
+make verify-image VERSION=2.1.0
 ```
 
 ### Verify SBOM attestation
@@ -99,8 +99,8 @@ make verify-image VERSION=2.0.1
 cosign verify-attestation \
   --type spdx \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-  --certificate-identity 'https://github.com/KitStream/initium/.github/workflows/release.yml@refs/tags/v2.0.1' \
-  ghcr.io/kitstream/initium:2.0.1
+  --certificate-identity 'https://github.com/KitStream/initium/.github/workflows/release.yml@refs/tags/v2.1.0' \
+  ghcr.io/kitstream/initium:2.1.0
 ```
 
 ### View provenance and SBOM
@@ -109,8 +109,8 @@ Provenance and SBOM attestations are generated by Docker BuildKit during the ima
 
 ```bash
 # View provenance
-docker buildx imagetools inspect ghcr.io/kitstream/initium:2.0.1 --format '{{json .Provenance}}'
+docker buildx imagetools inspect ghcr.io/kitstream/initium:2.1.0 --format '{{json .Provenance}}'
 
 # View SBOM
-docker buildx imagetools inspect ghcr.io/kitstream/initium:2.0.1 --format '{{json .SBOM}}'
+docker buildx imagetools inspect ghcr.io/kitstream/initium:2.1.0 --format '{{json .SBOM}}'
 ```