diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c6b043e..7ca520a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,6 +57,15 @@ jobs:
           fi
           echo "version=$PKG_VERSION" >> $GITHUB_OUTPUT
 
+      - name: Extract changelog entry
+        run: |
+          VERSION="${{ steps.verify.outputs.version }}"
+          awk -v v="## [$VERSION]" '$0==v{f=1;next} /^## \[/{f=0} f' CHANGELOG.md > RELEASE_NOTES.md
+          if ! grep -q '[^[:space:]]' RELEASE_NOTES.md; then
+            echo "CHANGELOG.md has no entry for ## [$VERSION]" >&2
+            exit 1
+          fi
+
       - name: Typecheck
         run: npm run typecheck
 
@@ -77,6 +86,7 @@ jobs:
         with:
           tag_name: v${{ steps.verify.outputs.version }}
           name: v${{ steps.verify.outputs.version }}
+          body_path: RELEASE_NOTES.md
           generate_release_notes: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..7a4042d
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to `toolception` are listed here. Versions follow [semver](https://semver.org/); while the major version is 0, a minor bump can contain breaking changes.
+
+Releases before 0.7.0 are described in [GitHub Releases](https://github.com/code-rabi/toolception/releases).
+
+## [0.7.0]
+
+### Breaking
+
+- In STATIC mode every client now gets its own `McpServer` and orchestrator, like DYNAMIC mode. Module loaders run once per client instead of once per process, with each client's merged session context. ([#27](https://github.com/code-rabi/toolception/pull/27))
+  - **Migration:** anything you register on the server returned by `createMcpServer` after it is created (prompts, resources, extra tools) no longer reaches STATIC clients. Register it inside your `createServer` factory instead, so every per-client server gets it.
+
+### Fixed
+
+- STATIC mode supports concurrent clients. Before, a second client's `initialize` closed the first client's connection, and its next request failed with `Session not found or expired`. ([#27](https://github.com/code-rabi/toolception/pull/27))
+- Per-session context (`?config=`) now reaches module loaders in STATIC mode. ([#27](https://github.com/code-rabi/toolception/pull/27))
+- Tools defined with a JSON Schema `inputSchema` load and receive their arguments on MCP SDK 1.28+, which rejects plain JSON Schema objects. ([#25](https://github.com/code-rabi/toolception/pull/25))
+
+### Changed
+
+- Now depends on `@modelcontextprotocol/sdk` `^1.32.1` and `fastify` `^5.12.5`. ([#25](https://github.com/code-rabi/toolception/pull/25))
+- The `zod` dependency floor is now `^3.25`, matching the MCP SDK's peer range. ([#26](https://github.com/code-rabi/toolception/pull/26))
+- Every tool, meta-tools included, registers through `McpServer.registerTool` instead of the deprecated `server.tool()` overloads. `annotations.title` is also sent as the tool's top-level `title`. ([#26](https://github.com/code-rabi/toolception/pull/26))
+- JSON Schema inputs are accepted but not advertised to clients; use Zod shapes to advertise a tool's parameters. ([#25](https://github.com/code-rabi/toolception/pull/25), [#26](https://github.com/code-rabi/toolception/pull/26))
+
+### Security
+
+- Patched vulnerable dependencies: MCP SDK (GHSA-6qxp-vccf-f47h), fastify, and transitive packages (proxy-addr, hono, path-to-regexp, qs, fast-uri, ip-address). Dev tooling moved to vitest 5. ([#25](https://github.com/code-rabi/toolception/pull/25))
diff --git a/package-lock.json b/package-lock.json
index 250a3d9..e3fe308 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "toolception",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "toolception",
-      "version": "0.6.3",
+      "version": "0.7.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@fastify/cors": "^10.0.1",
diff --git a/package.json b/package.json
index 3fb8a4f..a62f2a9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "toolception",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",
@@ -9,6 +9,7 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {