diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4842d11..bdb6802 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [0.16.2] - Unreleased
+
+### Security
+
+- Fixed a theft vector in `FundsMover` self-payments: the returning
+  HTLC was settled by matching only payment hash and payment secret,
+  without checking the amount. The last-hop peer relays our onion
+  (and thus the secret) intact but chooses the offered amount, so it
+  could settle a reduced amount, learn the preimage, and claim the
+  full amount upstream. The claim now requires the exact constructed
+  amount before the preimage is released. ([#322])
+
 ## [0.16.1] - 2026-08-06: "The Types That Bind"
 
 ### Fixed
diff --git a/configure.ac b/configure.ac
index 027c725..8e41081 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.69])
-AC_INIT([clboss], [0.16.1], [ken@bonsai.com])
+AC_INIT([clboss], [0.16.2], [ken@bonsai.com])
 AC_CONFIG_AUX_DIR([auxdir])
 AM_INIT_AUTOMAKE([subdir-objects tar-ustar])
 AC_CONFIG_SRCDIR([main.cpp])