diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..a43de266
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog
+
+## v5.3.1 — 2026-09-15
+
+Maintenance release following `v5.3.0-gs.1`, and the first owned-library release with a plain semver tag under the [versioning decision](docs/adr/2026-08-20-plain-semver-tags.md).
+
+### Fixes and maintenance
+
+- Require a live permission before `turntest` delivers peer datagrams, including when a channel binding is still live. Consumer tests that relied on delivery after permission expiry must renew permission or expect the packet to be dropped.
+- Update dependencies and the validation toolchain to Go 1.27.1. The consumer Go floor remains 1.27.
+- Strengthen test synchronization, bounded delivery, cleanup ownership, and protocol assertions; expose shared test helpers and named scenarios.
+- Clarify existing socket ownership, allocation closure, queued-read, and client transaction-abort behavior in API comments.
+- Consolidate CI range handling and validation policy ownership.
+
+### Compatibility and platforms
+
+No public API additions or removals, and no direct production TURN-client logic changes. Dependency updates are included. This remains an owned UDP TURN client library under `github.com/the-sarge/turn/v5`; the plain tag does not restore upstream Pion API compatibility. `turntest` remains a test-only fixture with an example-level guarantee.
+
+Source-only release; no binary artifacts. Release validation exercises Linux/amd64 in GitHub Actions and Darwin/arm64 locally. Darwin/amd64 and Windows/amd64 are cross-build-only targets, without runtime validation in the release gate.
+
+Earlier versions are recorded in the [development journal](docs/DEV-JOURNAL.md).
diff --git a/README.md b/README.md
index d177358f..3027ca3b 100644
--- a/README.md
+++ b/README.md
@@ -9,11 +9,13 @@ The public API is one idiom: callers provide a `net.PacketConn` and a canonical
 Pin an explicit version:
 
 ```sh
-go get github.com/the-sarge/turn/v5@v5.3.0-gs.1
+go get github.com/the-sarge/turn/v5@v5.3.1
 ```
 
 `v5.3.0-gs.1` is the last tag carrying the `-gs` pre-release suffix; later releases are plain semver tags (see [the plain-semver tags ADR](docs/adr/2026-08-20-plain-semver-tags.md)). Consumer upgrades stay deliberate because Go's minimal version selection never moves a pinned requirement on its own. This repository is an owned library rather than an upstream-compatible fork; API removal and divergence are expected between milestone versions.
 
+See the [changelog](CHANGELOG.md) for release notes and the [release runbook](docs/release.md) for publication steps.
+
 ## Test fixture
 
 The exported `turntest` package is a fork-owned, in-process scripted TURN responder covering exactly the request subset this client emits, with the knobs both this repository's and wiremux's integration tests need. It is a maintained verification aid with an example-level guarantee: it parses with `pion/stun` and `internal/proto`, hand-parses nothing, and claims no RFC conformance, relay quality, or interoperability. It must never be imported by non-test code.
diff --git a/docs/release.md b/docs/release.md
new file mode 100644
index 00000000..943fa82f
--- /dev/null
+++ b/docs/release.md
@@ -0,0 +1,11 @@
+# Releasing turn
+
+This is a source-only Go library release. Version choices follow the [plain-semver decision](adr/2026-08-20-plain-semver-tags.md); use an annotated, immutable tag on a commit reachable from `main`. Never move or reuse a published tag.
+
+1. Choose the version deliberately, update `CHANGELOG.md` and the README install pin on a feature branch in a dedicated worktree, and merge the preparation PR after required CI succeeds.
+2. In a clean dedicated worktree with a feature branch at the exact merged candidate commit, review the tool pins in `scripts/tool-versions.env` and run `task release-gate`, `task workflow-check`, and `task secret-scan` with the pinned validation Go version. Record the candidate SHA and successful validation. Verify that the commit is an ancestor of current `origin/main` and that the version tag and GitHub Release do not already exist.
+3. Create an annotated tag at that exact commit and push only the new tag. Wait for every job in the tag-triggered `Release checks` workflow to succeed at the tagged commit before publishing the GitHub Release.
+4. Create the GitHub Release with `gh release create --verify-tag`, using the version's changelog notes and the release-check run URL. State compatibility boundaries and tested versus build-only platforms. There are no binary assets or checksum assets for this library.
+5. Verify the published tag and Release, then verify the explicit version and `@latest` through `proxy.golang.org`. Append the tag SHA, workflow URL, Release URL, and proxy evidence to `docs/DEV-JOURNAL.md` through a separate PR.
+
+If validation fails, diagnose the failure before publication. A tag already pushed remains immutable; code corrections require a new version. A transient workflow failure may be retried at the same unchanged tag. The tag workflow validates releases; creating the GitHub Release is a separate deliberate step.