diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4dd0ad3..83a0a59 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -14,10 +14,10 @@
 cmake_minimum_required(VERSION 3.27)
 
 # This is the current version of this C++ project
-project(c2pa-c VERSION 0.26.16)
+project(c2pa-c VERSION 0.26.17)
 
 # Set the version of the c2pa_rs library used
-set(C2PA_VERSION "0.91.6")
+set(C2PA_VERSION "0.91.7")
 
 set(CMAKE_POLICY_DEFAULT_CMP0135 NEW)
 set(CMAKE_C_STANDARD 17)
diff --git a/Makefile b/Makefile
index cf1f4fd..3697a4d 100644
--- a/Makefile
+++ b/Makefile
@@ -149,7 +149,7 @@ training: release
 # Downloads prebuilt wasm library from c2pa-rs releases.
 C2PA_VERSION := $(shell grep 'set.C2PA_VERSION' CMakeLists.txt | sed 's/[^"]*"//;s/".*//')
 EMSCRIPTEN_PREBUILT_URL = https://github.com/contentauth/c2pa-rs/releases/download/c2pa-v$(C2PA_VERSION)/c2pa-v$(C2PA_VERSION)-wasm32-unknown-emscripten.zip
-EMSCRIPTEN_PREBUILT_DIR = $(BUILD_DIR)/emscripten-prebuilt
+EMSCRIPTEN_PREBUILT_DIR = $(BUILD_DIR)/emscripten-prebuilt/$(C2PA_VERSION)
 EMSCRIPTEN_OUTPUT_DIR = $(BUILD_DIR)/emscripten-example
 
 emscripten-example:
diff --git a/docs/release-notes.md b/docs/release-notes.md
index fbb7b42..7522f95 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -1,5 +1,26 @@
 # Release notes
 
+## 26 Oct 2026
+
+The selected native SDK release is c2pa-rs **0.91.7**, including its eMudhra
+TLS distrust updates. CMake downloads and the Emscripten example's `curl`
+download use the build host's TLS implementation and trust store, not the
+SDK's roots. Keep those tools and their CA stores updated separately (including
+`ca-certificates` in container builds).
+
+Applications that supply `ContextBuilder::with_http_resolver` are responsible
+for their resolver's TLS verification and trust-store updates. In particular,
+the Emscripten example delegates HTTP to `emscripten_fetch`, so its HTTPS trust
+is controlled by the browser or JavaScript host, not the Rust SDK. Updating the
+SDK alone does not update those stores. See the
+[eMudhra incident guidance](https://emudhra.we-have-a-problem.com/) for affected
+certificate chains and patched trust-store versions.
+
+Use the `c2pa-v0.91.7` tag for the matching native release. Local-source builds
+use the checkout supplied through `C2PA_RS_PATH`; they do not select or update
+that checkout automatically. Likewise, consumers using `C2PA_C_LIB_OVERRIDE`
+must update their replacement native library themselves.
+
 ## 3 Mar 2026
 
 This release includes changes relating to trust validation and handling (made in the Rust library [v0.68.0](https://github.com/contentauth/c2pa-rs/releases/tag/c2pa-v0.68.0), see also [trust lists](https://opensource.contentauthenticity.org/docs/conformance/trust-lists) for more details on trust lists).