diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84708563..6702a9b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.28.0](https://github.com/contentauth/c2patool/compare/v0.27.20...v0.28.0)
+_22 September 2026_
+
+### Changed
+
+* Update the c2pa-rs dependency to 0.91.0.
+
+### Breaking changes
+
+* Signing now verifies the generated manifest by default; set `verify.verify_after_sign = false` in the settings file to retain the previous behavior.
+* Trust configuration now supports multiple named trust lists under `trust.anchors`; migrate configurations using the legacy `cawg_trust` or `trust.trust_anchors`, `trust.trust_config`, `trust.user_anchors`, and `trust.allowed_list` fields.
+* Remote manifest, OCSP, timestamp, and `did:web` fetches reject redirects to non-public hosts by default.
+* Validation follows the C2PA 2.4 rules, and the SVG handler no longer accepts generic XML documents.
+
 ## [0.27.20](https://github.com/contentauth/c2pa-rs/compare/c2patool-v0.27.19...c2patool-v0.27.20)
 _04 September 2026_
 
diff --git a/Cargo.lock b/Cargo.lock
index 6e2fca1c..f1406d36 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -594,7 +594,7 @@ dependencies = [
 
 [[package]]
 name = "c2patool"
-version = "0.27.20"
+version = "0.28.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -1279,7 +1279,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1941,9 +1941,9 @@ dependencies = [
 
 [[package]]
 name = "id3"
-version = "1.17.1"
+version = "1.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24993fcabcbc07c8ac076a8e62db8593d1a5c4dbe81d57e531d2b7cb7f737380"
+checksum = "ef8be496a46468ba3d43690775aa3a79102ce4daf7d99e8072589aae1a3cd955"
 dependencies = [
  "bitflags 2.13.2",
  "byteorder",
@@ -2943,7 +2943,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3366,7 +3366,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3960,7 +3960,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 395077f0..9e1bde30 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "c2patool"
 default-run = "c2patool"
-version = "0.27.20"
+version = "0.28.0"
 description = "Tool for displaying and creating C2PA manifests."
 authors = [
     "Gavin Peacock <gpeacock@adobe.com>",