diff --git a/cmd/probod/CHANGELOG.md b/cmd/probod/CHANGELOG.md
index ea138eb44..d969b092f 100644
--- a/cmd/probod/CHANGELOG.md
+++ b/cmd/probod/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso
 
 ## Unreleased
 
+## [0.223.1] - 2026-07-03
+
+### Fixed
+
+- Fixed a cross-tenant IDOR where a Finding's linked Risk or a Processing Activity's Data Protection Officer could disclose another organization's data (GHSA-c74x-79w6-63jh): affected resolvers now authorize the referenced object itself instead of its parent, and the write paths validate the reference against the caller's organization
+
 ## [0.223.0] - 2026-07-02
 
 ### Added
diff --git a/cmd/probod/VERSION b/cmd/probod/VERSION
index 0c71b262a..7beca673f 100644
--- a/cmd/probod/VERSION
+++ b/cmd/probod/VERSION
@@ -1 +1 @@
-0.223.0
+0.223.1