diff --git a/.changeset/decoy-external-delivery.md b/.changeset/decoy-external-delivery.md
deleted file mode 100644
index aec93d5..0000000
--- a/.changeset/decoy-external-delivery.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-'seamless-auth-api': patch
----
-
-A decoy continuation under external delivery no longer hands the SDK a message to send.
-
-When an adopter runs external delivery, the decoy responders for an OTP send and a magic
-link request answered with a `delivery` block like a real account's, addressed to the
-decoy's synthetic `@example.invalid` email. The SDK mailed it, the domain never resolves,
-and the adopter's mail provider retried for hours and then bounced it against the
-adopter's sending identity. Every sign-in attempt for an unknown address was a guaranteed
-bounce, fourteen hours later, on traffic the adopter does not control (#321).
-
-The responders now omit the block. It is only readable by a caller holding a service
-token, so a stranger sees the same answer as before, and the SDK's `deliverAuthMessage`
-already sends nothing when the block is absent. `decoyOtpFor` had no other reason to
-exist and is removed. `docs/security-posture.md` says why parity at the SDK's edge was
-not worth a bounce per probe.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 810e2a4..7a296df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # seamless-auth-api
 
+## 0.14.1
+
+### Patch Changes
+
+- b092487: A decoy continuation under external delivery no longer hands the SDK a message to send.
+
+  When an adopter runs external delivery, the decoy responders for an OTP send and a magic
+  link request answered with a `delivery` block like a real account's, addressed to the
+  decoy's synthetic `@example.invalid` email. The SDK mailed it, the domain never resolves,
+  and the adopter's mail provider retried for hours and then bounced it against the
+  adopter's sending identity. Every sign-in attempt for an unknown address was a guaranteed
+  bounce, fourteen hours later, on traffic the adopter does not control (#321).
+
+  The responders now omit the block. It is only readable by a caller holding a service
+  token, so a stranger sees the same answer as before, and the SDK's `deliverAuthMessage`
+  already sends nothing when the block is absent. `decoyOtpFor` had no other reason to
+  exist and is removed. `docs/security-posture.md` says why parity at the SDK's edge was
+  not worth a bounce per probe.
+
 ## 0.14.0
 
 ### Minor Changes
diff --git a/package.json b/package.json
index 486c4d4..398ddf6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "seamless-auth-api",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Seamless Auth API - A web application server for supporting a Seamless Auth server instance.",
   "main": "index.js",
   "type": "module",