diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e983e9..9ad86d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ All notable changes to bootintel-cli are documented here. Format follows [Keep a
 
 ## [Unreleased]
 
+## [0.6.0] — 2026-09-27 — applicability without sending the log
+
+New flag, no breaking change, so MINOR per the policy above.
+
 ### Added
 - **`scan --applicability`** — ask which advisories APPLY without sending the
   boot log. The detectors run locally, exactly as for a plain `scan`, and only
@@ -512,7 +516,8 @@ Initial release. All six subcommands live; five branch-based milestones (M1-M5)
 - PDF report download subcommand — server-side endpoint exists but no client-side wrapper yet.
 - Windows support — the Rust code compiles for Windows and the release workflow builds it, but install.sh doesn't handle Windows yet (`.ps1` installer is a follow-up).
 
-[Unreleased]: https://github.com/bootintel/cli/compare/cli-v0.5.0...HEAD
+[Unreleased]: https://github.com/bootintel/cli/compare/cli-v0.6.0...HEAD
+[0.6.0]: https://github.com/bootintel/cli/releases/tag/cli-v0.6.0
 [0.5.0]: https://github.com/bootintel/cli/releases/tag/cli-v0.5.0
 [0.4.2]: https://github.com/bootintel/cli/releases/tag/cli-v0.4.2
 [0.4.1]: https://github.com/bootintel/cli/releases/tag/cli-v0.4.1
diff --git a/Cargo.lock b/Cargo.lock
index 582cb6c..4483efd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -131,7 +131,7 @@ checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "bootintel"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "arboard",
@@ -154,7 +154,7 @@ dependencies = [
 
 [[package]]
 name = "bootintel-detectors"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "regex",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index c56a5fc..1a33644 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,7 +19,7 @@ members = ["crates/detectors", "crates/cli"]
 resolver = "2"
 
 [workspace.package]
-version = "0.5.0"
+version = "0.6.0"
 edition = "2021"
 rust-version = "1.90"
 license = "Apache-2.0"
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 5cd1131..2aef007 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -24,7 +24,7 @@ path = "src/main.rs"
 # version when packaging for crates.io, which rejects a bare path dep.
 # This is what publish = false was working around; publishing
 # bootintel-detectors first makes the workaround unnecessary.
-bootintel-detectors = { path = "../detectors", version = "0.5.0" }
+bootintel-detectors = { path = "../detectors", version = "0.6.0" }
 clap = { version = "4.5", features = ["derive", "wrap_help", "env"] }
 # Shell-completion emitters for `bootintel completions <shell>`. Version
 # tracks the clap major/minor (4.5). No default features — we only use