diff --git a/.github/workflows/m1-verify.yml b/.github/workflows/m1-verify.yml
index ae1d3188..3345dc49 100644
--- a/.github/workflows/m1-verify.yml
+++ b/.github/workflows/m1-verify.yml
@@ -31,6 +31,19 @@ jobs:
       - name: Provision isolated ephemeral runner
         timeout-minutes: 5
         run: |
+          # The runner's Azure apt mirror is sometimes unresolvable; use the Ubuntu archive then.
+          if ! getent hosts azure.archive.ubuntu.com >/dev/null; then
+            sudo grep -rl 'mirror+file:/etc/apt/apt-mirrors.txt' /etc/apt/sources.list /etc/apt/sources.list.d \
+              | xargs -r sudo sed -i 's#mirror+file:/etc/apt/apt-mirrors.txt#http://archive.ubuntu.com/ubuntu/#'
+            if ! getent hosts archive.ubuntu.com >/dev/null; then
+              # The runner's resolver fails for Ubuntu hosts only; resolve the archive over HTTPS.
+              ip=$(curl -fsS --max-time 20 -H 'accept: application/dns-json' \
+                'https://cloudflare-dns.com/dns-query?name=archive.ubuntu.com&type=A' \
+                | jq -r '[.Answer[]? | select(.type == 1) | .data][0] // empty')
+              test -n "$ip"
+              echo "$ip archive.ubuntu.com" | sudo tee -a /etc/hosts >/dev/null
+            fi
+          fi
           sudo apt-get update -qq
           sudo apt-get install -y bubblewrap dbus-user-session
           # Permit namespaces only for bwrap on this disposable VM; keep AppArmor enabled.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad3cb849..04f23b07 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,9 @@ match the GitHub releases.
 
 ## [Unreleased]
 
-Upgrading: schema 15, run `mypi db init` once after the update (back up the database
+## [0.12.0] - 2026-11-11
+
+Upgrading from v0.11.0: `git pull --ff-only`, install the locked dependencies and build; schema 15, run `mypi db init` once after the update (back up the database
 first); reload or restart Claude Code and Pi sessions so the new roles and the Pi
 extension take effect. Run `mypi archive import` once to fill the conversation archive
 from existing transcripts. MEMORY.md is no longer read; move facts into INDEX.md (MP-106) before updating.
diff --git a/README.md b/README.md
index 5e8f9298..6edaf2b3 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@ The former instruction-driven workflow has been withdrawn; stored data is retain
 Flow is part of the product direction; automated execution/visibility isolation are
 not implemented. See [PLAN](PLAN.md) for milestones without speculative infrastructure.
 
-**Readiness:** v0.11.0 is a prerelease of the v2 session model (scoped Claude Code
+**Readiness:** v0.12.0 is a prerelease of the v2 session model (scoped Claude Code
 and Pi sessions, `/open`, events); it is not production-ready, and final M1 acceptance
 remains open. CI now runs ordinary bounded PR verification, not the historical
 trusted-base/App-issuer scheme. The earlier
diff --git a/package.json b/package.json
index 1b2bdafd..4fe0bca0 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mypi",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "private": true,
   "type": "module",
   "engines": {
diff --git a/src/mcp/server.ts b/src/mcp/server.ts
index e173b716..e0088c00 100644
--- a/src/mcp/server.ts
+++ b/src/mcp/server.ts
@@ -15,7 +15,7 @@ type CallExtra = { signal: AbortSignal; _meta?: { progressToken?: string | numbe
 
 export function createServer(filename: string, root?: string, env: Readonly<Record<string, string | undefined>> = {},
   transports: EventTransports = {}) {
-  const server = new McpServer({ name: 'mypi', version: '0.11.0' });
+  const server = new McpServer({ name: 'mypi', version: '0.12.0' });
   const calls = serialCalls();
   const shutdown = new AbortController();
   async function invoke(name: string, args: unknown, extra: CallExtra) {