diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ae6282..e4d8e14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -74,9 +74,8 @@ The v2.0.0-rc.1 candidate was published and verified before this GA release.
 
 ### Changed
 
-- Unlocked guarded v2 prerelease publication after the deterministic artifact,
-  checksum, SBOM, and provenance contract landed; GA publication remains locked
-  until the #214 and #240 release-candidate gates pass.
+- Promoted the guarded v2.0.0 GA after the deterministic artifact, checksum,
+  SBOM, provenance, and #240 first-party cutover gates passed.
 - Made `base_require_version` compare the supported v2 prerelease identifiers
   (`alpha.N`, `beta.N`, and `rc.N`) correctly against GA and older releases.
 - Established the v2 API charter in `docs/v2-api-contract.md`: public
diff --git a/SECURITY.md b/SECURITY.md
index 30f22b8..f8bcf3f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,9 +6,8 @@ every vendored copy as executable supply-chain input.
 
 ## Supported releases
 
-The supported release line begins at `v2.0.0` GA. Until that release exists,
-the repository's current stable line is `v1.4.0`; it is maintained only as a
-historical reference while the v2 train is completed. After v2 GA, only the
+The supported release line begins at the published `v2.0.0` GA. The former
+`v1.4.0` line is now maintained only as a historical reference. Only the
 latest supported v2 security release receives fixes. All 0.x releases and
 pre-v2 1.x releases are historical and unsupported; the withdrawn July 2026
 v2 tag/formula event was not a supported release. See
diff --git a/docs/versioning-policy.md b/docs/versioning-policy.md
index 64417c3..deae426 100644
--- a/docs/versioning-policy.md
+++ b/docs/versioning-policy.md
@@ -2,10 +2,10 @@
 
 ## Current Release Line
 
-`v1.4.0` remains the last stable Base Bash release until the verified
-`v2.0.0` GA asset is published. The release-preparation candidate is now
-`v2.0.0`; the 5/5 initiative has one stable target and will not create a
-stable `v1.5.0` or reset the version to 0.x.
+`v2.0.0` is the current stable Base Bash release, backed by its verified
+canonical GA asset. `v1.4.0` and earlier releases are historical references;
+the 5/5 initiative has one stable target and will not create a stable `v1.5.0`
+or reset the version to 0.x.
 
 Those choices would either hide breaking changes inside the current 1.x
 compatibility range or move version precedence backward.
@@ -38,11 +38,11 @@ and dry runs to Base's guarded release command.
 
 Prerelease publication became available because #233 and the follow-up
 release-artifact contract landed. The reviewed `v2.0.0-rc.1` artifact and the
-pre-GA work in #240 then validated and rehearsed the exact release candidate
-across Base, Base Demo, Homebrew, vendored, and bundled paths. The guard now
-permits `v2.0.0` GA publication; maintainers must still build and verify the
-canonical archive, checksum manifest, SBOM, and provenance from the reviewed
-GA commit before publishing and completing the remaining first-party handoff.
+pre-GA work in #240 validated and rehearsed the exact release candidate across
+Base, Base Demo, Homebrew, vendored, and bundled paths. The canonical
+`v2.0.0` archive, checksum manifest, SBOM, and provenance are now published and
+the first-party handoff is complete; future releases must preserve the same
+verified-asset contract.
 
 The GA lock is code-reviewed policy, not an environment-variable or
 sentinel-file override. The PR that satisfies each gate must update the guard
diff --git a/examples/reference-apps/README.md b/examples/reference-apps/README.md
index dbcf2ad..83f12f8 100644
--- a/examples/reference-apps/README.md
+++ b/examples/reference-apps/README.md
@@ -34,6 +34,6 @@ examples/reference-apps/release-rehearsal.sh \
 ```
 
 The required evidence schema and platform matrix live in
-[`release-evidence.yaml`](release-evidence.yaml). Placeholders remain marked
-`pending-ga-asset` until the canonical v2 asset, checksum, and provenance are
-published; the repository never treats a moving checkout as release evidence.
+[`release-evidence.yaml`](release-evidence.yaml). It records the verified
+canonical `v2.0.0` asset, checksum, and provenance; the repository never treats
+a moving checkout as release evidence.
diff --git a/examples/reference-apps/release-evidence.yaml b/examples/reference-apps/release-evidence.yaml
index 21fda2f..42dc705 100644
--- a/examples/reference-apps/release-evidence.yaml
+++ b/examples/reference-apps/release-evidence.yaml
@@ -1,13 +1,13 @@
 schema_version: 1
 release_line: v2.0.0
-status: pending-ga-asset
+status: verified
 
-# Fill these fields only from the canonical release asset and its independently
-# verified checksum. A local checkout or a moving branch is not acceptable.
+# These identities come from the canonical release asset and its independently
+# verified provenance. A local checkout or a moving branch is not acceptable.
 candidate:
-  ref: pending-v2.0.0-rc-or-ga
-  commit: pending
-  sha256: pending
+  ref: v2.0.0
+  commit: b4243765726c133499feeabdc50154f99c0fec12
+  sha256: 73d6f92fab8f1a8ded7f3b4312ebbe51aa8ec0c16eacf18c2d8fa23fb5664333
 rollback:
   ref: v1.4.0
   commit: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff