diff --git a/CHANGELOG.md b/CHANGELOG.md
index 43246bd0..967e8da9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,51 @@
 # Changelog
 
+## v0.3.0
+
+Three enterprise Linux guests, common developer recipes, and read-only
+capability discovery for agents. The JSON contract version stays **3**.
+
+### Features
+
+- Create VMs from AlmaLinux 9, Rocky 9, and openSUSE Leap 16.0 cloud images.
+  Stoat checks the host CPU against the `x86-64-v2` baseline these guests
+  require and reports a missing feature before it starts QEMU. These three
+  guests carry no recipes and skip the 9p mount.
+- Apply the `devtools` and `python-dev` recipes on Alpine, Arch, Debian,
+  Fedora, and Ubuntu. `devtools` installs git, curl, a compiler, vim, tmux,
+  less, and bash. `python-dev` installs Python and pip, then creates a virtual
+  environment for a named user.
+- Inspect agent-visible state with `stoat capabilities [VM] [--json]` and the
+  MCP `capabilities` tool. Discovery reads configuration only. It creates no
+  data root, generates no keys, and removes no stale PID files.
+- MCP tools return machine-readable errors with stable codes.
+
+### Fixes
+
+- Cloud VMs wait for cloud-init to finish before provisioning starts. A
+  recoverable cloud-init warning no longer blocks the wait; a hard error still
+  fails it.
+- Native VM operations that the host cannot support now fail with a named
+  reason instead of an unqualified QEMU error.
+- File locks work on every supported host.
+- A seed that holds one cloud-config document is sent as plain
+  `#cloud-config`. cloud-init 24.4 on AlmaLinux and Rocky fails its init-local
+  stage on the archive's top-level list, which left `cloud-init status` in
+  error for the life of the VM.
+- The `python-dev` recipe tests each privilege-escalation tool before it uses
+  one. Alpine's sudoers grants root nothing, and busybox `su` takes options
+  from the trailing arguments. Both broke the recipe on Alpine.
+- The guides state the runtime and interface behavior that stoat implements.
+
+### Known limitations
+
+- A cloud VM with recipes on AlmaLinux or Rocky still fails, because the seed
+  keeps more than one document. See #93.
+- The `devtools` and `python-dev` recipes do not cover AlmaLinux, Rocky, or
+  openSUSE. See #85.
+- `docs/specs` describes VM forks and runtime continuation. Neither is
+  implemented.
+
 ## v0.2.0
 
 First published release, for single-user Linux systems. This is a regular
diff --git a/flake.nix b/flake.nix
index 9d86ede2..5cd2ce30 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,7 +28,7 @@
           # `git describe` isn't available in the nix build sandbox, so pin a
           # version string here; bump on release the same way release.yml's
           # ${GITHUB_REF_NAME} does for the tarball builds.
-          version = "0.2.0";
+          version = "0.3.0";
         in
         {
           default = pkgs.buildGoModule {