diff --git a/CMakeLists.txt b/CMakeLists.txt
index e085a2cda..dd3155511 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -21,7 +21,7 @@
 
 cmake_minimum_required(VERSION 3.16)
 
-project(wolfMQTT VERSION 2.0.0 LANGUAGES C)
+project(wolfMQTT VERSION 2.1.0 LANGUAGES C)
 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)
 
 include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/functions.cmake)
diff --git a/ChangeLog.md b/ChangeLog.md
index 6678e634a..2397ece21 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,6 +1,22 @@
 ## Release Notes
 
-### v2.0.1 (Pending)
+### v2.1.0 (07/02/2026)
+Release 2.1.0 has been developed according to wolfSSL's development and QA
+process (see link below) and successfully passed the quality criteria.
+https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
+
+* New Features
+    - wolfMQTT Broker session persistence: pluggable persistence hooks via
+      `MqttBroker_SetPersistHooks` with a POSIX backend
+      (`MqttBrokerNet_PersistPosix_Init` / `MqttBrokerNet_PersistPosix_Free`),
+      message ordering, an offline message queue, and AES-GCM encryption of
+      persisted state at rest (#538)
+    - New packet-validation helpers: `MqttPacket_TopicNameValid`,
+      `MqttPacket_TopicFilterValid`, `MqttPacket_TopicFilterIsWildcard`,
+      `MqttPacket_FixedHeaderFlagsValid`, and `MqttPacket_SubAckReturnCodeValid`
+      (#552)
+    - `WOLFMQTT_MAX_QOS` build cap to compile out the QoS 2 state machine and
+      advertise v5 `MAX_QOS` in CONNACK (#537)
 
 * Security Hardening
     - Reject ill-formed UTF-8 in MQTT UTF-8 string fields per [MQTT-1.5.3-1].
@@ -85,6 +101,31 @@
       `cmd_timeout_ms`. The registration now matches `SN_Client_Subscribe`,
       `SN_Client_Register`, and `SN_Client_Publish`.
 
+* What's Changed
+    - Fix BrokerHandle_Connect null check (#477)
+    - Fenrir fixes (#478)
+    - Add testing validation and fixes for wolfMQTT (#480)
+    - Replace deprecated VeriSign CA with Amazon Root CA 1 + Starfield G2 (#481)
+    - Update testing with a more flexible framework (#482)
+    - Fix new Fenrir reports (#483)
+    - Always check MqttDecode_Num's return code (#479)
+    - Add Fenrir suggested test cases (#484)
+    - Reject null chars in strings (#503)
+    - Fix various spec compliance gaps (#504)
+    - Fix MQTTv5 QoS 2 CONNACK interop and add WOLFMQTT_MAX_QOS build cap (#537)
+    - Fix Coverity nightly: inline action, drop broken md5 hash lookup (#547)
+    - Harden param checks in MqttDecode_FixedHeader and MqttDecode_ConnectAck (#546)
+    - Harden Coverity tool download: curl -L --fail + gzip sanity check (#549)
+    - Fix broker disconnect to better handle SIGPIPE (#548)
+    - wolfMQTT broker: ordering, persistence, offline queue, AES-GCM at rest (#538)
+    - Speed up CI and stabilize aws-ca-regression (#551)
+    - MQTT-SN fixes (#550)
+    - Broker, client, and MQTT v5 packet validation and reliability fixes (#552)
+    - Fenrir fixes (#554)
+
+* New Contributors
+    - @night1rider made their first contribution (#481)
+
 ### v2.0.0 (03/20/2026)
 Release 2.0.0 has been developed according to wolfSSL's development and QA
 process (see link below) and successfully passed the quality criteria.
diff --git a/Makefile.am b/Makefile.am
index 001ded2cf..dce54740d 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -53,12 +53,38 @@ TESTS += $(check_PROGRAMS)
 check_SCRIPTS+= $(dist_noinst_SCRIPTS)
 TESTS += $(check_SCRIPTS)
 
+# Some test data is distributed under $(srcdir) but referenced by the test
+# scripts (and by mosquitto.conf) via paths relative to the build directory:
+# the broker test data (mosquitto.conf and its certificates) and the firmware
+# example payload (examples/publish.dat). In an out-of-tree build -- notably
+# "make distcheck" -- $(srcdir) != $(builddir), so stage a copy into the build
+# tree before the tests run. In-tree builds are a no-op.
+AM_TESTS_ENVIRONMENT = \
+	if test "$(abs_srcdir)" != "$(abs_builddir)"; then \
+		$(MKDIR_P) scripts/broker_test examples; \
+		cp -f $(srcdir)/scripts/broker_test/mosquitto.conf \
+			$(srcdir)/scripts/broker_test/ca-cert.pem \
+			$(srcdir)/scripts/broker_test/server-cert.pem \
+			$(srcdir)/scripts/broker_test/server-key.pem \
+			scripts/broker_test/; \
+		cp -f $(srcdir)/examples/publish.dat examples/; \
+	fi;
+
 test: check
 
 DISTCLEANFILES+= wolfmqtt-config
 
 clean-local:
 	-rm -rf tests/fuzz/corpus
+	@if test "$(abs_srcdir)" != "$(abs_builddir)"; then \
+		rm -f scripts/broker_test/mosquitto.conf \
+			scripts/broker_test/ca-cert.pem \
+			scripts/broker_test/server-cert.pem \
+			scripts/broker_test/server-key.pem \
+			examples/publish.dat; \
+		rmdir scripts/broker_test 2>/dev/null || true; \
+		rmdir scripts 2>/dev/null || true; \
+	fi
 
 maintainer-clean-local:
 	-rm Makefile.in
diff --git a/configure.ac b/configure.ac
index 1052f3bf9..5eff2f53c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3,7 +3,7 @@
 # All rights reserved.
 
 AC_COPYRIGHT([Copyright (C) 2014-2026 wolfSSL Inc.])
-AC_INIT([wolfmqtt],[2.0.0],[https://github.com/wolfssl/wolfMQTT/issues],[wolfmqtt],[http://www.wolfssl.com])
+AC_INIT([wolfmqtt],[2.1.0],[https://github.com/wolfssl/wolfMQTT/issues],[wolfmqtt],[http://www.wolfssl.com])
 
 AC_PREREQ([2.63])
 AC_CONFIG_AUX_DIR([build-aux])
@@ -27,7 +27,7 @@ AC_ARG_PROGRAM
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_HEADERS([src/config.h])
 
-WOLFMQTT_LIBRARY_VERSION=19:0:0
+WOLFMQTT_LIBRARY_VERSION=20:0:0
 #                        | | |
 #                 +------+ | +---+
 #                 |        |     |
diff --git a/examples/firmware/fwpush.c b/examples/firmware/fwpush.c
index 65fa31c00..31c09b26b 100644
--- a/examples/firmware/fwpush.c
+++ b/examples/firmware/fwpush.c
@@ -150,7 +150,20 @@ static int fw_message_build(MQTTCtx *mqttCtx, const char* fwFile,
     ecc_key eccKey;
     WC_RNG rng;
 
-    wc_InitRng(&rng);
+    /* Initialize the RNG and ECC key up front so the cleanup path at exit can
+     * always free them safely, even when an early error (such as a firmware
+     * file load failure) jumps to exit before the key is generated. */
+    rc = wc_InitRng(&rng);
+    if (rc != 0) {
+        PRINTF("Init RNG Failed! %d", rc);
+        return rc;
+    }
+    rc = wc_ecc_init(&eccKey);
+    if (rc != 0) {
+        PRINTF("Init ECC Key Failed! %d", rc);
+        wc_FreeRng(&rng);
+        return rc;
+    }
 #endif
 
     /* Verify file can be loaded */
@@ -165,7 +178,6 @@ static int fw_message_build(MQTTCtx *mqttCtx, const char* fwFile,
 #ifdef ENABLE_FIRMWARE_SIG
     /* Generate Key */
     /* Note: Real implementation would use previously exchanged/signed key */
-    wc_ecc_init(&eccKey);
     rc = wc_ecc_make_key(&rng, 32, &eccKey);
     if (rc != 0) {
         PRINTF("Make ECC Key Failed! %d", rc);
diff --git a/scripts/client.test b/scripts/client.test
index 9a440772b..5e14d11dc 100755
--- a/scripts/client.test
+++ b/scripts/client.test
@@ -34,7 +34,10 @@ then
         generate_port
         broker_args="-p $port"
     fi
-    mosquitto $broker_args &
+    # Close the descriptors make passes to recipe commands (notably the
+    # "make -j" jobserver pipe) so a broker that outlives the test cannot stall
+    # a parallel make that is waiting on them.
+    mosquitto $broker_args 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- &
     broker_pid=$!
     echo "Broker PID is $broker_pid"
 
diff --git a/scripts/firmware.test b/scripts/firmware.test
index 8064898be..44f3bda79 100755
--- a/scripts/firmware.test
+++ b/scripts/firmware.test
@@ -80,7 +80,10 @@ then
         generate_port
         broker_args="-p $port"
     fi
-    mosquitto $broker_args &
+    # Close the descriptors make passes to recipe commands (notably the
+    # "make -j" jobserver pipe) so a broker that outlives the test cannot stall
+    # a parallel make that is waiting on them.
+    mosquitto $broker_args 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- &
     broker_pid=$!
     echo "Broker PID is $broker_pid"
 
diff --git a/scripts/multithread.test b/scripts/multithread.test
index 7a3b3f377..663f21284 100755
--- a/scripts/multithread.test
+++ b/scripts/multithread.test
@@ -34,7 +34,10 @@ then
         generate_port
         broker_args="-p $port"
     fi
-    mosquitto $broker_args &
+    # Close the descriptors make passes to recipe commands (notably the
+    # "make -j" jobserver pipe) so a broker that outlives the test cannot stall
+    # a parallel make that is waiting on them.
+    mosquitto $broker_args 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- &
     broker_pid=$!
     echo "Broker PID is $broker_pid"
     sleep 0.1
diff --git a/scripts/nbclient.test b/scripts/nbclient.test
index 5e947eafd..1dd35ae27 100755
--- a/scripts/nbclient.test
+++ b/scripts/nbclient.test
@@ -34,7 +34,10 @@ then
         generate_port
         broker_args="-p $port"
     fi
-    mosquitto $broker_args &
+    # Close the descriptors make passes to recipe commands (notably the
+    # "make -j" jobserver pipe) so a broker that outlives the test cannot stall
+    # a parallel make that is waiting on them.
+    mosquitto $broker_args 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- &
     broker_pid=$!
     echo "Broker PID is $broker_pid"
 
diff --git a/scripts/stress.test b/scripts/stress.test
index f076216a3..b9f1892c5 100755
--- a/scripts/stress.test
+++ b/scripts/stress.test
@@ -41,7 +41,10 @@ else
     generate_port
     broker_args="-p $port"
 fi
-mosquitto $broker_args &
+# Close the descriptors make passes to recipe commands (notably the "make -j"
+# jobserver pipe) so a broker that outlives the test cannot stall a parallel
+# make that is waiting on them.
+mosquitto $broker_args 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- &
 broker_pid=$!
 echo "Broker PID is $broker_pid"
 sleep 0.1
diff --git a/wolfmqtt/version.h b/wolfmqtt/version.h
index d14164ac1..f9b8d750b 100644
--- a/wolfmqtt/version.h
+++ b/wolfmqtt/version.h
@@ -34,8 +34,8 @@
 extern "C" {
 #endif
 
-#define LIBWOLFMQTT_VERSION_STRING "2.0.0"
-#define LIBWOLFMQTT_VERSION_HEX 0x02000000
+#define LIBWOLFMQTT_VERSION_STRING "2.1.0"
+#define LIBWOLFMQTT_VERSION_HEX 0x02001000
 
 #ifdef __cplusplus
 }