diff --git a/.changeset/peering-on-demand.md b/.changeset/peering-on-demand.md
deleted file mode 100644
index 7e4e56d35..000000000
--- a/.changeset/peering-on-demand.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"nostream": minor
----
-
-feat(peering): rate-limit on-demand requests from authenticated peers
-
-Authenticated peers can request events outside their standing feed with a
-normal `REQ`, `COUNT`, or ad-hoc `NEG-OPEN` session. Those requests continue to
-use peer subscription and NIP-77 limits instead of client limits, and are now
-bounded per peer pubkey by `limits.peer.request.rateLimits` (default 300
-requests/minute across `REQ`, `COUNT`, and `NEG-OPEN`).
-
-Refused `REQ`/`COUNT` calls receive `CLOSED` with a `rate-limited:` reason and
-retry hint; refused `NEG-OPEN` sessions receive `NEG-ERR`. The limiter fails
-closed when its store is unavailable, and unidentified clients are unaffected.
-Per-peer request/event accounting and admin-console visibility are left to the
-dedicated admin-console follow-up.
diff --git a/.changeset/setup-reject-placeholder-secret.md b/.changeset/setup-reject-placeholder-secret.md
deleted file mode 100644
index 995a3b48e..000000000
--- a/.changeset/setup-reject-placeholder-secret.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"nostream": patch
----
-
-fix(cli): reject placeholder secret inherited from env or prompt in setup (#1018)
-
-Setup now rejects the default placeholder secret (`change_me_to_something_long_and_random`) when read from inherited environment variables or interactive prompt input, and validates the resolved secret before persisting to `.env`. If a placeholder is detected, setup automatically generates a fresh cryptographically secure 64-byte random hex secret.
diff --git a/.changeset/site-deploy-on-relay-release.md b/.changeset/site-deploy-on-relay-release.md
deleted file mode 100644
index 6894477a7..000000000
--- a/.changeset/site-deploy-on-relay-release.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
----
-
-fix(ci): redeploy the site when a relay release publishes
-
-No published package changes: this touches `.github/workflows/deploy-website.yml`
-only, and the site is redeployed rather than reversioned.
-
-The site's version badge and changelog page are read from the repo at build
-time, so both went stale between site releases: on 2026-11-05 nostream.dev
-still served `v3.9.0` six relay releases later. A relay release now starts the
-deploy through the `Release` workflow's completion, which runs on `main` — the
-only ref the `website` environment admits for that purpose.
diff --git a/.changeset/website-types-processor.md b/.changeset/website-types-processor.md
deleted file mode 100644
index cf9b80709..000000000
--- a/.changeset/website-types-processor.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
----
-
-fix(website): configure unified processor, add ambient types, and align engines
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 75f17b793..f3c477525 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,29 @@
 # nostream
 
+## 3.13.0
+
+### Minor Changes
+
+- [#1053](https://github.com/cameri/nostream/pull/1053) [`e37b284`](https://github.com/cameri/nostream/commit/e37b284b9174968134e5fe3d7290e398b6781715) Thanks [@Ferryx349](https://github.com/Ferryx349)! - feat(peering): rate-limit on-demand requests from authenticated peers
+
+  Authenticated peers can request events outside their standing feed with a
+  normal `REQ`, `COUNT`, or ad-hoc `NEG-OPEN` session. Those requests continue to
+  use peer subscription and NIP-77 limits instead of client limits, and are now
+  bounded per peer pubkey by `limits.peer.request.rateLimits` (default 300
+  requests/minute across `REQ`, `COUNT`, and `NEG-OPEN`).
+
+  Refused `REQ`/`COUNT` calls receive `CLOSED` with a `rate-limited:` reason and
+  retry hint; refused `NEG-OPEN` sessions receive `NEG-ERR`. The limiter fails
+  closed when its store is unavailable, and unidentified clients are unaffected.
+  Per-peer request/event accounting and admin-console visibility are left to the
+  dedicated admin-console follow-up.
+
+### Patch Changes
+
+- [#1058](https://github.com/cameri/nostream/pull/1058) [`ba8691a`](https://github.com/cameri/nostream/commit/ba8691ac9232303ff7938406b6a48da989cc0504) Thanks [@avantikonde](https://github.com/avantikonde)! - fix(cli): reject placeholder secret inherited from env or prompt in setup ([#1018](https://github.com/cameri/nostream/issues/1018))
+
+  Setup now rejects the default placeholder secret (`change_me_to_something_long_and_random`) when read from inherited environment variables or interactive prompt input, and validates the resolved secret before persisting to `.env`. If a placeholder is detected, setup automatically generates a fresh cryptographically secure 64-byte random hex secret.
+
 ## 3.12.1
 
 ### Patch Changes
diff --git a/package.json b/package.json
index 18ff68ff5..d4c0b0eea 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nostream",
-  "version": "3.12.1",
+  "version": "3.13.0",
   "packageManager": "pnpm@10.33.0",
   "private": true,
   "description": "A Nostr relay written in Typescript.",