diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index bac4ebcf..6103afc2 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.28.0"
+  ".": "1.29.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92960926..87e305eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## [1.29.0](https://github.com/mitos-run/mitos/compare/v1.28.0...v1.29.0) (2026-07-07)
+
+
+### Features
+
+* **husk:** live copy-on-write fork sharing parent memory (default-off, KVM-tested) ([#820](https://github.com/mitos-run/mitos/issues/820)) ([96efe00](https://github.com/mitos-run/mitos/commit/96efe0084754be468af40ff92dd266ce9e986f33))
+
+
+### Bug Fixes
+
+* **console:** serve /internal M2M endpoints on a cluster-internal listener (GHSA-rcf5-cfv3-jxvv) ([#742](https://github.com/mitos-run/mitos/issues/742)) ([6e22227](https://github.com/mitos-run/mitos/commit/6e22227362285625468af8a974f240edb451d836))
+* **hosted:** defense-in-depth hardening for the front door ([#733](https://github.com/mitos-run/mitos/issues/733)) ([#743](https://github.com/mitos-run/mitos/issues/743)) ([b8154cd](https://github.com/mitos-run/mitos/commit/b8154cd2d0240aa0c1a2c3653d878b995a81d99f))
+
 ## [1.28.0](https://github.com/mitos-run/mitos/compare/v1.27.0...v1.28.0) (2026-07-07)
 
 
diff --git a/deploy/charts/mitos/Chart.yaml b/deploy/charts/mitos/Chart.yaml
index 8e4c1e0e..0faeb0a3 100644
--- a/deploy/charts/mitos/Chart.yaml
+++ b/deploy/charts/mitos/Chart.yaml
@@ -5,8 +5,8 @@ name: mitos
 # lifecycle through the mitos.run CRDs.
 description: Snapshot-fork sandboxes for AI agents on Kubernetes.
 type: application
-version: 1.28.0 # x-release-please-version
-appVersion: "v1.28.0" # x-release-please-version
+version: 1.29.0 # x-release-please-version
+appVersion: "v1.29.0" # x-release-please-version
 kubeVersion: ">=1.29.0-0"
 keywords:
   - sandbox
@@ -43,19 +43,19 @@ annotations:
       url: https://github.com/mitos-run/mitos/issues
   artifacthub.io/images: |
     - name: controller
-      image: ghcr.io/mitos-run/mitos-controller:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-controller:v1.29.0 # x-release-please-version
     - name: forkd
-      image: ghcr.io/mitos-run/mitos-forkd:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-forkd:v1.29.0 # x-release-please-version
     - name: husk-stub
-      image: ghcr.io/mitos-run/mitos-husk-stub:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-husk-stub:v1.29.0 # x-release-please-version
     - name: kvm-device-plugin
-      image: ghcr.io/mitos-run/mitos-kvm-device-plugin:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-kvm-device-plugin:v1.29.0 # x-release-please-version
     - name: facade
-      image: ghcr.io/mitos-run/mitos-facade:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-facade:v1.29.0 # x-release-please-version
     - name: console
-      image: ghcr.io/mitos-run/mitos-console:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-console:v1.29.0 # x-release-please-version
     - name: gateway
-      image: ghcr.io/mitos-run/mitos-gateway:v1.28.0 # x-release-please-version
+      image: ghcr.io/mitos-run/mitos-gateway:v1.29.0 # x-release-please-version
   artifacthub.io/crds: |
     - kind: SandboxPool
       version: v1