diff --git a/.changeset/tidy-jars-arrive.md b/.changeset/tidy-jars-arrive.md
deleted file mode 100644
index a2e4620..0000000
--- a/.changeset/tidy-jars-arrive.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-'@seamless-auth/types': minor
----
-
-Add `magic_link_redirect_uris` to the system config.
-
-An exact-match allowlist of destinations a magic link may be sent to, empty by
-default. `seamless-auth-api` validates a requested destination against `origins`
-today, which covers a target whose host is already a WebAuthn origin and cannot
-express the two cases that need this: a custom application scheme such as
-`myapp://auth`, and a universal link on a host that should not also be a WebAuthn
-origin.
-
-Exact match rather than origin comparison, because neither of those has an origin
-worth comparing. Empty by default, so a deployment that sets nothing keeps comparing
-against `origins` exactly as it does now.
-
-Also exports `RedirectTargetSchema`, which is what entries are validated with, and
-which is stricter than `z.url()` on purpose. `z.url()` accepts anything the URL parser
-does, including `javascript:alert(1)` and `data:text/html,...`. A magic link
-destination is rendered as an href in an email, so one of those stored in config would
-be a script-execution sink reachable through the admin system-config API. The
-`javascript:`, `data:`, `vbscript:`, `file:`, `blob:` and `about:` schemes are refused,
-and everything else including arbitrary application schemes is allowed, since an
-allowlist of known-good schemes could not express the case this exists for.
-
-`SystemConfigPatchSchema` takes the field too, so the guard applies to the admin write
-path and not only to what a server seeds at boot.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c244a1..d0d34e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,34 @@
 # @seamless-auth/types
 
+## 0.18.0
+
+### Minor Changes
+
+- 40eb9c5: Add `magic_link_redirect_uris` to the system config.
+
+  An exact-match allowlist of destinations a magic link may be sent to, empty by
+  default. `seamless-auth-api` validates a requested destination against `origins`
+  today, which covers a target whose host is already a WebAuthn origin and cannot
+  express the two cases that need this: a custom application scheme such as
+  `myapp://auth`, and a universal link on a host that should not also be a WebAuthn
+  origin.
+
+  Exact match rather than origin comparison, because neither of those has an origin
+  worth comparing. Empty by default, so a deployment that sets nothing keeps comparing
+  against `origins` exactly as it does now.
+
+  Also exports `RedirectTargetSchema`, which is what entries are validated with, and
+  which is stricter than `z.url()` on purpose. `z.url()` accepts anything the URL parser
+  does, including `javascript:alert(1)` and `data:text/html,...`. A magic link
+  destination is rendered as an href in an email, so one of those stored in config would
+  be a script-execution sink reachable through the admin system-config API. The
+  `javascript:`, `data:`, `vbscript:`, `file:`, `blob:` and `about:` schemes are refused,
+  and everything else including arbitrary application schemes is allowed, since an
+  allowlist of known-good schemes could not express the case this exists for.
+
+  `SystemConfigPatchSchema` takes the field too, so the guard applies to the admin write
+  path and not only to what a server seeds at boot.
+
 ## 0.17.0
 
 ### Minor Changes
diff --git a/package.json b/package.json
index de3cec6..2737209 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "AGPL-3.0-only",