diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8ccd5f..2e9070d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
 
 ## [Unreleased]
 
+## [3.5.0] - 2026-09-18
+
 ### Added
 
 - **`docker-build.yml` gained an `upload-sarif` input** (boolean, default
@@ -33,6 +35,8 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
   cross-build — `scraper-proxy-router` (always) and `store-s3` (on `main`) —
   request `linux/arm64` and still get QEMU.
 
+## [3.4.0] - 2026-09-11
+
 ### Changed
 
 - **`claude-code-review.yml` now defaults to a GitHub-hosted runner**