diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ec51be5..ab6da95 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,14 +7,36 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write        # required to mint the crates.io OIDC token
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0     # merge-base needs real history
+
+      # A GitHub release can be cut from any commit, including one that never
+      # landed on main. Publishing is restricted to release tags that are
+      # actually contained in main.
+      - name: Refuse releases not contained in main
+        run: |
+          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+          git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main \
+            || { echo "::error::release commit $GITHUB_SHA is not contained in main"; exit 1; }
+
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo test
+
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
       - run: cargo publish
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bd0a840..0c8acec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,23 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.3] - 2026-08-09
+
+### Fixed
+
+- `repository` pointed at `github.com/BinFlip/inno-rs`, which does not exist. Every
+  published version so far has carried a dead repository link on crates.io. It now points
+  at the real repository, `github.com/ATRAPSLLC/innospect`.
+
+### Changed
+
+- Recorded ATRAPS LLC as copyright holder and added a `NOTICE` file. No functional change.
+- Dropped the deprecated `authors` field.
+- Raised the `pascalscript` minimum to 0.1.2. `Container` is re-exported publicly, so that
+  release's backward-branch resolution fix is part of this crate's effective API surface.
+- Refreshed remaining dependencies (`cargo update`); `bitflags` moved to 2.13.1.
+- Publishing now uses crates.io trusted publishing instead of a stored registry token.
+
 ## [0.1.2] - 2026-07-06
 
 ### Fixed
@@ -15,7 +32,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   added since 6.3.0 (`CloseApplicationsFilterExcludes`, `SevenZipLibraryName`,
   `UsePrevious*`) are now read ahead of the `AnsiString` tail, matching
   `TSetupHeader`'s all-strings-then-all-ansistrings serialization
-  (GitHub [#1](https://github.com/BinFlip/inno/issues/1)).
+  (GitHub [#1](https://github.com/ATRAPSLLC/innospect/issues/1)).
 
 ### Added
 
@@ -41,5 +58,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial published release.
 
-[0.1.2]: https://github.com/BinFlip/inno-rs/compare/v0.1.1...v0.1.2
-[0.1.1]: https://github.com/BinFlip/inno-rs/releases/tag/v0.1.1
+[0.1.3]: https://github.com/ATRAPSLLC/innospect/compare/v0.1.2...v0.1.3
+[0.1.2]: https://github.com/ATRAPSLLC/innospect/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/ATRAPSLLC/innospect/releases/tag/v0.1.1
diff --git a/Cargo.toml b/Cargo.toml
index 48ceb24..a82e7d9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,12 +1,11 @@
 [package]
 name = "innospect"
-version = "0.1.2"
+version = "0.1.3"
 edition = "2024"
-authors = ["Johann Kempter <admin@binflip.rs>"]
 rust-version = "1.88"
 description = "Parse and inspect Inno Setup installer binaries"
 license = "Apache-2.0"
-repository = "https://github.com/BinFlip/inno-rs"
+repository = "https://github.com/ATRAPSLLC/innospect"
 readme = "README.md"
 keywords = ["inno-setup", "installer", "parser", "reverse-engineering", "binary-analysis"]
 categories = ["parser-implementations"]
@@ -42,6 +41,6 @@ md-5 = "0.11.0"
 pbkdf2 = { version = "0.13.0", default-features = false }
 hmac = "0.13.0"
 chacha20 = { version = "0.10.1", features = ["xchacha"] }
-pascalscript = "0.1.1"
+pascalscript = "0.1.2"
 
 [dev-dependencies]
diff --git a/LICENSE b/LICENSE
index 84389ce..c60b058 100644
--- a/LICENSE
+++ b/LICENSE
@@ -175,7 +175,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2025 Johann Kempter
+   Copyright 2026 ATRAPS LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..87a8951
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,24 @@
+innospect
+Copyright 2026 ATRAPS LLC
+
+This product includes software developed by ATRAPS LLC.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+----
+
+This project includes the following third-party software:
+
+Third-party dependencies are listed in Cargo.toml and their licenses
+can be found in their respective repositories. All dependencies are
+compatible with the Apache 2.0 license.
diff --git a/README.md b/README.md
index e1485de..0747fc9 100644
--- a/README.md
+++ b/README.md
@@ -118,4 +118,5 @@ exercises both `1.88` and `stable`.
 
 ## License
 
-Apache-2.0. See [`LICENSE`](LICENSE).
+Copyright 2026 ATRAPS LLC. Licensed under the Apache License,
+Version 2.0. See [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE).
diff --git a/src/lib.rs b/src/lib.rs
index 3c3bf13..a2ee579 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -114,7 +114,7 @@ pub mod version;
 /// Re-export of the `pascalscript` crate so existing
 /// `innospect::pascalscript::*` paths resolve through `innospect`. The
 /// parser itself is the standalone
-/// [`pascalscript`](https://github.com/BinFlip/pascalscript-rs)
+/// [`pascalscript`](https://github.com/ATRAPSLLC/pascalscript-rs)
 /// crate; this re-export is for caller convenience.
 pub use ::pascalscript;