diff --git a/.bestpractices.json b/.bestpractices.json
index 78ba63a..36f7f58 100644
--- a/.bestpractices.json
+++ b/.bestpractices.json
@@ -134,8 +134,8 @@
   "implement_secure_design_justification": "The assurance case maps least privilege, economy of mechanism, complete mediation, fail-safe artifact handling, transparent host boundaries, and defence in depth to implemented controls: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md#3-secure-design-principles",
   "crypto_used_network_status": "N/A",
   "crypto_used_network_justification": "The shipped runtime intentionally makes no network request; it processes host events and local files. CI and release publication use GitHub HTTPS but are not runtime network protocols implemented by the software: https://github.com/cdeust/session-optimizer/blob/main/PRIVACY.md",
-  "signed_releases_status": "Unmet",
-  "signed_releases_justification": "The release workflow can publish Sigstore provenance attestations for the source bundle, executable manifest, and SBOM, but it has not yet produced a public tagged release. SECURITY.md explicitly keeps this criterion unmet until a new tag completes and is independently verified: https://github.com/cdeust/session-optimizer/blob/main/SECURITY.md#verifying-a-release",
+  "signed_releases_status": "Met",
+  "signed_releases_justification": "Release v2.2.0 publishes SHA-256 checksums and GitHub Sigstore build-provenance attestations for the source bundle, executable manifest, and SBOM. The release workflow completed successfully and the downloaded asset digests match their published checksum files: https://github.com/cdeust/session-optimizer/releases/tag/v2.2.0",
   "input_validation_status": "Met",
   "input_validation_justification": "Host JSON, transcript shapes, paths, checksums, archive members, and executable manifest entries are parsed or allowlisted at their boundaries. Regression tests include malformed hook events, whitespace-bearing valid JSON, unsafe archive paths, and tampered artifacts; the assurance case records the limits: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md",
   "hardening_status": "Unmet",