diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6983462..3a0bc45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,32 @@ All notable changes to `credentials-dotnet` are documented here. The format is b
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v1.1.0 - 7/14/2026
+
+### Changed
+
+- **Foundation dependency bump — `NetDid.*` 2.0.1 → 2.3.0, `NetCrypto` 1.1.0 → 1.2.0**
+  ([#16](https://github.com/moisesja/credentials-dotnet/issues/16)). Downstream convergence for
+  **net-wallet-sdk 0.2.0**: its identity document-update / key-rotation integrity contract (FR-ID-10)
+  depends on net-did's `DidUpdateResult` evidence, and a wallet consumer that also references
+  `Credentials.*` pulls this library's net-did pins into the transitive graph — the resolved graph
+  converges on net-did 2.3.0 / NetCrypto 1.2.0 only once every foundation library moves up. Bumping
+  `NetCrypto` to 1.2.0 is required by (not merely compatible with) the net-did bump: `NetDid.Core 2.3.0`
+  itself depends on `NetCrypto 1.2.0`, so leaving it at 1.1.0 would be an `NU1605` downgrade. `NetCid`
+  stays 1.6.0. This is a **dependency-only change with no public API delta** — the resolved graph is
+  Newtonsoft-free as before, and all three published packages pass ApiCompat against the 1.0.0 baseline
+  with no breaking changes. Credentials uses net-did only for DID resolution / `did:key`; the net-did
+  2.1→2.3 changes tightened the did:webvh update/deactivate driver, which this library does not exercise.
+  (The issue was filed against net-did 2.2.0; 2.3.0 supersedes it as the latest on the line.)
+
+### Fixed
+
+- **`tools/check-api-compat.sh` — corrected the ApiCompat CLI invocation.** The
+  `Microsoft.DotNet.ApiCompat.Tool` (10.0.301) takes the package-to-validate as a positional argument;
+  the script passed it as `--package <path>`, which the tool rejects. This path had never executed
+  (1.0.0 was the first release, so there was no baseline to compare and the check SKIP-ed); it now runs
+  for real against the published 1.0.0 baseline.
+
 ## v1.0.0 - 6/26/2026
 
 ### Changed
diff --git a/Directory.Build.props b/Directory.Build.props
index acbdf02..c4bbfd3 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <LangVersion>latest</LangVersion>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <CredentialsVersion>1.0.0</CredentialsVersion>
+    <CredentialsVersion>1.1.0</CredentialsVersion>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <Deterministic>true</Deterministic>
     <EmbedUntrackedSources>true</EmbedUntrackedSources>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index e228dc8..13dd7d0 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -5,7 +5,8 @@
   <ItemGroup>
     <!-- ============================================================================
          Stack libraries (the credentials-dotnet substrate). Versions verified against
-         the local NuGet cache on 2026-06-18. Not every entry is referenced yet: the
+         the local NuGet cache on 2026-07-13 (NetDid/NetCrypto bump, issue #16). Not
+         every entry is referenced yet: the
          later milestones (M1+) add NetDid resolution, the DataProofs JOSE/COSE/RDFC
          securing packages, and JSON Schema validation. Declared centrally so a
          milestone only adds a <PackageReference> with no version.
@@ -20,11 +21,16 @@
     <!-- Engine crypto operations the engine performs itself: hashing/digests (NetCrypto.Hash),
          ISigner abstraction, JWK conversion. NetCrypto exposes no RNG abstraction; the engine's
          RNG seam wraps the BCL RandomNumberGenerator (see Credentials.Cryptography). -->
-    <PackageVersion Include="NetCrypto" Version="1.1.0" />
-    <!-- DID resolution + key store (M1+). -->
-    <PackageVersion Include="NetDid.Core" Version="2.0.1" />
-    <PackageVersion Include="NetDid.Method.Key" Version="2.0.1" />
-    <PackageVersion Include="NetDid.Extensions.DependencyInjection" Version="2.0.1" />
+    <!-- Bumped 1.1.0 -> 1.2.0 (issue #16): NetDid.Core 2.3.0 requires NetCrypto 1.2.0, so this pin
+         is the convergence, not an option — 1.1.0 would be an NU1605 downgrade. -->
+    <PackageVersion Include="NetCrypto" Version="1.2.0" />
+    <!-- DID resolution + key store (M1+). Bumped 2.0.1 -> 2.3.0 (issue #16, net-wallet-sdk 0.2.0
+         downstream convergence). Additive for the surfaces Credentials uses (resolution, did:key);
+         the 2.1->2.3 line tightened the did:webvh update/deactivate driver, which this library does
+         not exercise. NetCrypto 1.2.0 / NetCid 1.6.0 required transitively. -->
+    <PackageVersion Include="NetDid.Core" Version="2.3.0" />
+    <PackageVersion Include="NetDid.Method.Key" Version="2.3.0" />
+    <PackageVersion Include="NetDid.Extensions.DependencyInjection" Version="2.3.0" />
     <!-- Multibase/multihash for the Bitstring Status List codec (M2). -->
     <PackageVersion Include="NetCid" Version="1.6.0" />
     <!-- JSON Schema 2020-12 validation (M2). STJ-native; no Newtonsoft. Latest published is 7.3.2
diff --git a/tasks/todo-2026-07-13-v1.1.0-dependency-bump.md b/tasks/todo-2026-07-13-v1.1.0-dependency-bump.md
new file mode 100644
index 0000000..930022b
--- /dev/null
+++ b/tasks/todo-2026-07-13-v1.1.0-dependency-bump.md
@@ -0,0 +1,67 @@
+# v1.1.0 — Foundation dependency bump (issue #16)
+
+**Goal:** Bump `NetDid.*` 2.0.1 → **2.3.0** and `NetCrypto` 1.1.0 → 1.2.0 (downstream convergence for
+net-wallet-sdk 0.2.0), then release as **v1.1.0**. Ref: [issue #16](https://github.com/moisesja/credentials-dotnet/issues/16).
+
+> **Update (user):** target NetDid **2.3.0**, not the 2.2.0 the issue was filed against — net-did has since
+> advanced to 2.3.0 and we converge on the latest. Verified: `NetDid.Core 2.3.0` still requires exactly
+> `NetCrypto 1.2.0` / `NetCid 1.6.0` (same convergence, no NU1605); the 2.3.0 DI package pulls
+> `NetDid.Method.{Key,Peer,WebVh} 2.3.0` transitively (unchanged from 2.2.0), all present in the local cache.
+
+## Context established during recon
+
+- **Central package management** — all versions live in `Directory.Packages.props`; the library version
+  (`CredentialsVersion`) lives in `Directory.Build.props`.
+- **The two bumps converge cleanly, no NU1605.** `NetDid.Core 2.3.0` transitively depends on
+  `NetCrypto 1.2.0`; `DataProofsDotnet.* 1.1.0` depends on `NetCrypto 1.1.0` and `NetCid 1.6.0`. Pinning
+  NetCrypto to 1.2.0 (an *upgrade*, ≥ every requirement) is in fact *required* by the NetDid 2.3.0 bump —
+  leaving NetCrypto at 1.1.0 would be the downgrade (NU1605). `NetCid` stays 1.6.0 (agreed by all three).
+- **All target packages are already in the local NuGet cache** (netdid.* 2.3.0 incl. Method.Peer/WebVh,
+  netcrypto 1.2.0) — restore works offline.
+- **No `packages.lock.json` in this repo (0 found), no `RestorePackagesWithLockFile`.** The issue's
+  `--locked-mode` / "regenerate packages.lock.json" acceptance line does **not** apply here — this repo has
+  never used lock files. Not introducing them (out of scope).
+- **Behavioral surface is unaffected.** Credentials uses NetDid only for DID *resolution* / `did:key`; the
+  2.1→2.2 changes tightened the did:webvh **update/deactivate** driver, which this library does not exercise.
+  The new `DidUpdateResult` members are nullable/additive. → dependency-only change, **no public API delta**.
+- **Release is tag-driven** (`.github/workflows/release.yml`, on `push: tags: ['v*']`): pushing `v1.1.0`
+  builds (warnings-as-errors) → tests (`Category!=Conformance`) → no-Newtonsoft closure → ApiCompat vs the
+  published 1.0.0 baseline → packs the 3 libs → publishes via OIDC trusted publishing.
+- **ApiCompat gate stays green**: a pure dependency bump leaves the public surface identical to shipped 1.0.0.
+- No docs pin the old versions (grep clean), so no doc edits required.
+
+## Plan
+
+### 1. Version bumps (source of truth only)
+- [ ] `Directory.Packages.props`: `NetDid.Core`, `NetDid.Method.Key`,
+      `NetDid.Extensions.DependencyInjection` → **2.3.0**; `NetCrypto` → **1.2.0**. Refresh the
+      "verified against the local NuGet cache on 2026-06-18" note to 2026-07-13 and add a one-line pointer
+      to issue #16 / the convergence rationale.
+- [ ] `Directory.Build.props`: `CredentialsVersion` **1.0.0 → 1.1.0**.
+
+### 2. Verify (local, mirrors the release gate)
+- [ ] `dotnet restore Credentials.sln` — clean, converges on NetCrypto 1.2.0 / NetCid 1.6.0, no NU1605.
+- [ ] `dotnet build Credentials.sln -c Release` — warnings-as-errors clean (proves no source break from the
+      NetDid/NetCrypto surface change).
+- [ ] `dotnet test Credentials.sln -c Release --no-build --filter "Category!=Conformance"` — full suite green
+      (matches what the release workflow runs).
+- [ ] `./tools/check-no-newtonsoft-closure.sh` — runtime closure still Newtonsoft-free.
+- [ ] `./tools/check-api-compat.sh` — packed libs vs published 1.0.0: **no** breaking change (needs network
+      to fetch the baseline; if offline, note as deferred-to-CI).
+
+### 3. Docs / changelog
+- [ ] `CHANGELOG.md`: add a **v1.1.0** section (Keep-a-Changelog format) under **Changed** — the foundation
+      pin bump, the convergence rationale (net-wallet-sdk 0.2.0 / FR-ID-10), and "no public API change".
+
+### 4. Land + release
+- [ ] Branch `chore/v1.1.0-foundation-bump`, commit, push, open a PR that closes #16.
+- [ ] After the PR is merged to `main` (and CI green), push tag **`v1.1.0`** to trigger `release.yml` →
+      publishes `Credentials.Core` / `Credentials.Extensions.DependencyInjection` / `Credentials.Rdfc` 1.1.0.
+
+## Notes / decisions for the user
+- I will **stop after step 3** (branch + PR opened) and let you review before the release tag is pushed,
+  unless you tell me to tag-and-release in one go. Tagging is the irreversible, outward-facing step.
+- `packages.lock.json` regeneration from the issue's acceptance list is **N/A** here (no lock files in repo).
+
+## Review
+_(to be filled in after execution)_
diff --git a/tools/check-api-compat.sh b/tools/check-api-compat.sh
index 4e251e0..334d642 100755
--- a/tools/check-api-compat.sh
+++ b/tools/check-api-compat.sh
@@ -50,7 +50,9 @@ except Exception:
     "https://api.nuget.org/v3-flatcontainer/$idl/$latest/$idl.$latest.nupkg"
   newpkg="$(ls "$NEW/$id."*.nupkg | head -1)"
   echo ">> ApiCompat $id: $latest (baseline) vs freshly packed"
-  dotnet apicompat package --package "$newpkg" --baseline-package "$BASE/$id.$latest.nupkg" --run-api-compat
+  # The package-to-validate is a positional argument (the tool names it "--package" in --help, but it
+  # takes its value positionally; passing `--package <path>` is rejected as an unrecognized argument).
+  dotnet apicompat package "$newpkg" --baseline-package "$BASE/$id.$latest.nupkg" --run-api-compat
   checked+=("$id")
 done