diff --git a/.kit/cli-lock.json b/.kit/cli-lock.json
index b2b70150..6e721adf 100644
--- a/.kit/cli-lock.json
+++ b/.kit/cli-lock.json
@@ -2,52 +2,52 @@
   "version": 1,
   "tools": {
     "node": {
-      "version": "22.23.2",
+      "version": "22.23.3",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "aqua:aquasecurity/trivy": {
       "version": "0.72.0",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "aqua:trufflesecurity/trufflehog": {
-      "version": "3.95.9",
+      "version": "3.99.1",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "npm:license-checker": {
       "version": "25.0.1",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "pipx:lizard": {
       "version": "1.24.0",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "npm:jscpd": {
       "version": "5.1.2",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "aqua:boyter/scc": {
       "version": "4.0.0",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     },
     "aqua:hadolint/hadolint": {
       "version": "2.15.1",
       "source": "mise",
       "sourceDetail": "mise",
-      "installedAt": "2026-09-04T15:16:40.580Z"
+      "installedAt": "2026-10-19T13:16:45.335Z"
     }
   }
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6208a4a..baa42c80 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 ## [Unreleased]
 
+## [7.0.1] - 2026-10-19
+
+### Fixed
+
+- **A release rerun died before it reached the GitHub release.** `npm publish --dry-run`
+  fails for a version that is already on npm, so rerunning the publish workflow after a
+  partial release stopped in "Show what will be published". The step now skips the dry run
+  when the version is already published, like the publish steps after it.
+- **The Docker image failed to build when Alpine updated a package.** The runtime stage pinned
+  six apk packages to exact versions. When Alpine replaced `libexpat` 2.8.5 with 2.9.0, every
+  build stopped with "unable to select packages", which failed the Trivy stage, the security
+  gate and the Docker build, and the recurring Full App Scan failures. The packages now use a
+  `>=` floor, so the security minimum stays and the build survives index updates.
+- **A Windows test failed on a locked file.** The dotenvx secrets test could not delete
+  `dotenvx.exe` while Windows still held it (`EBUSY`). The cleanup now retries.
+
 ## [7.0.0] - 2026-10-14
 
 ### Breaking
diff --git a/README.md b/README.md
index 4367e520..70104545 100644
--- a/README.md
+++ b/README.md
@@ -77,6 +77,9 @@ recall — with zero manual steps. See [docs/ENV_FUELING.md](docs/ENV_FUELING.md
 
 The 7.x line starts with one breaking change to the skill fingerprint.
 
+- **7.0.1: release and image build fixes.** A rerun of the publish workflow no longer stops
+  in the npm dry run when the version is already published. The Docker image no longer
+  fails to build when Alpine updates a package. No change to the CLI.
 - **7.0.0: skill fingerprints that cover the body, and desktop apps in the Monkey test.**
   The skill fingerprint now hashes the whole `SKILL.md` as a full SHA-256, so a changed
   payload under a pinned name no longer reports "matches committed snapshot". Re-pin each
diff --git a/contracts/kit.opencli.json b/contracts/kit.opencli.json
index 5068b25e..c71eefa5 100644
--- a/contracts/kit.opencli.json
+++ b/contracts/kit.opencli.json
@@ -4896,7 +4896,7 @@
     "binary": "kit",
     "summary": "Deterministic, local-first developer-environment manager and fail-closed governance layer for AI agents and humans.",
     "title": "kit",
-    "version": "7.0.0"
+    "version": "7.0.1"
   },
   "opencliVersion": "1.0.0-alpha.12"
 }
diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md
index b9aa260d..2e2306d9 100644
--- a/docs/COMMANDS.md
+++ b/docs/COMMANDS.md
@@ -1,6 +1,6 @@
 # kit commands
 
-> Complete reference for every `kit <subcommand>`. Last updated 2026-10-14 (kit 7.0.0).
+> Complete reference for every `kit <subcommand>`. Last updated 2026-10-19 (kit 7.0.1).
 > Pair this with `docs/THREAT_MODEL.md` (what data flows where) and
 > `docs/DATA_FLOW.md` (exact reads/writes per op).
 
diff --git a/package-lock.json b/package-lock.json
index 28a9d810..9387734e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "sandstream-kit",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sandstream-kit",
-      "version": "7.0.0",
+      "version": "7.0.1",
       "license": "MIT",
       "workspaces": [
         "packages/*"
diff --git a/package.json b/package.json
index 7b0c4b03..baa58bfc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sandstream-kit",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "developer kit. zero LLM, local-first, multi-vault. one command from git clone to working dev environment.",
   "license": "MIT",
   "funding": "https://buymeacoffee.com/sandstream",