diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2aefc421e..a8dde9dad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,26 +7,54 @@ Versioning once public release tags are established.
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-06-13
+
+First stable public release.
+
+### Security
+
+- The bundled Kanata engine is compiled without the `cmd` feature: the root
+  daemon physically cannot execute shell commands regardless of config
+  contents — a stronger guarantee than the previous opt-in toggle. Hand-written
+  `(cmd …)` actions now fail validation with a clear message; use the
+  consent-gated **Script Execution** actions (which run as the user, not root)
+  instead.
+
 ### Added
 
-- Release-governance docs: `SECURITY.md`, `CODE_OF_CONDUCT.md`, and this
-  changelog.
-- CI/release-readiness tracking issues labeled as `release-blocker` in GitHub.
+- 22 ready-to-use rule packs (Home Row Mods, Caps Lock remapping, Vim & Neovim
+  navigation, Quick Launcher, Window Snapping, Auto Shift, Numpad/Symbol/Function
+  layers, and more), each installable in one click from the Gallery with a live
+  preview.
+- Live keyboard overlay showing per-layer key behavior in real time, including
+  tap-hold and chord behavior.
+- The Mapper: visual remap builder for tap/hold/shift/combo behaviors, multi-tap,
+  app-specific overrides, system actions, app launches, and layer jumps.
+- QMK (`keymap.c`) and Karabiner (`karabiner.json`) import. QMK import is
+  comprehensive; Karabiner import covers simple key-to-key remaps.
 - Mapper/overlay support for optional per-key shifted output customization:
-  `Shift + key` can now send a separate output from tap/default output for
+  `Shift + key` can send a separate output from the tap/default output for
   global keystroke mappings.
+- Release-governance docs: `SECURITY.md`, `CODE_OF_CONDUCT.md`, and this
+  changelog.
 
 ### Changed
 
-- Documentation and CI policy are being aligned for open source release quality
-gates.
-- CI now enforces coverage non-regression for the narrow baseline lane:
-  `KeyPathErrorTests` + `PermissionOracleTests` with an initial floor of
-  `0.29%` TOTAL line coverage.
 - Shifted-output editing is intentionally constrained to global keystroke
   mappings and is disabled for app-specific mappings, system actions, URLs, and
   advanced hold/combo/tap-dance behaviors.
 
+### Known limitations
+
+- Home Row Layer Toggles in "Toggle" mode assume the layers they point at are
+  also enabled; if not, those keys no-op on hold (the rest of the keyboard is
+  unaffected).
+- Karabiner import covers simple remaps only — tap-hold, layer/variable, and
+  device/app-conditional rules are not translated yet and are skipped with a
+  summary.
+- Changing the Leader key is done in the Rules tab; the CLI and hand-edited
+  config files don't yet propagate Leader-key changes.
+
 ## [0.0.0-internal]
 
 ### Notes
diff --git a/Scripts/release.sh b/Scripts/release.sh
index 813f5a244..43037b188 100755
--- a/Scripts/release.sh
+++ b/Scripts/release.sh
@@ -226,11 +226,21 @@ fi
 git tag "v${VERSION}"
 
 echo "📤 Creating GitHub Release..."
+# Mark as pre-release only for versions carrying a semver pre-release suffix
+# (e.g. 1.0.0-beta4). Stable versions (1.0.0) publish as "Latest release".
+# Scalar + ${x:+...} keeps this safe under `set -u` on bash 3.2 (macOS).
+PRERELEASE_FLAG=""
+if [[ "$VERSION" == *-* ]]; then
+    PRERELEASE_FLAG="--prerelease"
+    echo "   $VERSION is a pre-release → marking GitHub Release as pre-release"
+else
+    echo "   $VERSION is stable → publishing as Latest release"
+fi
 gh release create "v${VERSION}" \
     "$SPARKLE_ZIP" \
     "$SPARKLE_DMG" \
     --title "KeyPath ${VERSION}" \
-    --prerelease \
+    ${PRERELEASE_FLAG:+"$PRERELEASE_FLAG"} \
     --notes "See [release notes](https://github.com/malpern/KeyPath/releases/tag/v${VERSION}) for details."
 
 echo "📝 Updating appcast.xml..."
diff --git a/Sources/KeyPathApp/Info.plist b/Sources/KeyPathApp/Info.plist
index 815309910..9c3b0d121 100644
--- a/Sources/KeyPathApp/Info.plist
+++ b/Sources/KeyPathApp/Info.plist
@@ -11,9 +11,9 @@
 	<key>CFBundleDisplayName</key>
 	<string>KeyPath</string>
 	<key>CFBundleVersion</key>
-	<string>3</string>
+	<string>4</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0.0-beta3</string>
+	<string>1.0.0</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleIconFile</key>
diff --git a/appcast.xml b/appcast.xml
index 8f928a4f1..c557311f4 100644
--- a/appcast.xml
+++ b/appcast.xml
@@ -107,21 +107,5 @@
             ]]></description>
         </item>
 
-        <item>
-            <title>Version 1.0.0</title>
-            <sparkle:version>1</sparkle:version>
-            <sparkle:shortVersionString>1.0.0</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
-            <pubDate>Mon, 15 Dec 2025 22:07:37 -0800</pubDate>
-            <enclosure
-                url="https://github.com/malpern/KeyPath/releases/download/v1.0.0/KeyPath-1.0.0.zip"
-                sparkle:edSignature="qpxvopkbyBN1caU+d+gtcBG3xwYKduAkwcoEFLrNrBYzf6YPDb2lFHtFgv9SE2MT+u0907r4p5Fl/AJ+mcD+DQ=="
-                length="9078173"
-                type="application/octet-stream"/>
-            <sparkle:releaseNotesLink>
-                https://github.com/malpern/KeyPath/releases/tag/v1.0.0
-            </sparkle:releaseNotesLink>
-        </item>
-        
     </channel>
 </rss>