diff --git a/AGENTS.md b/AGENTS.md
index 41f6101..6d34ffd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,6 +30,13 @@ that's all it takes — no extra wiring.
 
 - `costPerKWH` is **US dollars per kWh** (0.18 = 18¢), feeding
   `econet_energy_cost_dollars`.
+- `econetTLSInsecure` (env `ECONET_TLS_INSECURE`) skips TLS certificate
+  verification when connecting to the EcoNet cloud API. It exists because the
+  upstream host (cloudblade) serves a
+  DigiCert Global Root G1 chain, which is no longer trusted by default in
+  current root stores. **Evaluate removing this later** — prefer fixing the
+  trust chain (e.g. bundling the needed intermediate/root CA) over disabling
+  verification outright.
 
 ## Metrics conventions
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5299870..d8b100a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,18 +1,53 @@
-# v0.7.0
-* feat: Add HTTP log exclusion regex paths to configuration schema.
-* chore: Update Go version to 1.25.
-* chore: Update module dependencies.
+# Changelog
 
-# v0.6.0
-*   feat: Introduce Model Context Protocol (MCP) server with a demo random fact tool.
-*   feat: Add MCP server configuration file (`contrib/mcpinspector.json`).
-*   deps: Update Go module dependencies, including `bufbuild/protovalidate`, `go-app`, `grpc-gateway`, `googleapis/api`, `grpc`, `protobuf`, `golang.org/x/exp`, and `googleapis/rpc`.
-*   deps: Add new Go module dependencies: `modelcontextprotocol/go-sdk` and `k8s.io/utils`.
+All notable changes to econet-exporter are documented here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-# v0.5.0
+## [v0.2.0] - 2026-07-05
 
-*   Added OpenTelemetry tracing for application startup.
-*   Updated Go module dependencies, including `protovalidate`, `go-app`, `grpc`, and OpenTelemetry related packages.
-*   Enhanced `Makefile` `rename` target to update the application name constant in `main.go`.
-*   Configured `air` live-reloading to exclude the `proto` directory.
-*   Refactored application initialization logic for improved modularity and OpenTelemetry integration.
+### Added
+
+* `econetTLSInsecure` config option (env `ECONET_TLS_INSECURE`) to skip TLS
+  certificate verification when
+  connecting to the Rheem/EcoNet cloud API. The upstream host (cloudblade)
+  serves an old/untrusted certificate chain; this is a stopgap and should be
+  removed once the upstream certificate is fixed. See AGENTS.md.
+* `TODO.md` tracking outstanding work (CA cert bundle, mutating proto RPCs,
+  additional tracing spans).
+
+## [v0.1.2] - 2026-07-04
+
+### Added
+
+* CA certificate bundle baked into the container image so the exporter can
+  establish TLS connections to the EcoNet API.
+
+### Changed
+
+* Bumped Helm chart versions.
+
+## [v0.1.1] - 2026-07-04
+
+### Fixed
+
+* Corrected the Helm chart `appVersion`.
+
+## [v0.1.0] - 2026-07-04
+
+Initial release of the EcoNet exporter for Rheem / Rheemcloud water heaters,
+built on the `go-app` framework.
+
+### Added
+
+* `EconetService` owning a single shared `*rheemcloud.Client` across the gRPC,
+  MCP, and metrics sub-servers (fail-fast on missing credentials).
+* gRPC API (`ListDevices`, `GetDevice`) with proto definitions and
+  grpc-gateway REST bindings.
+* MCP server at `/api/mcp` exposing a `list_water_heaters` tool.
+* OpenTelemetry observable gauges for device state (temperature, mode, energy
+  and water usage, cost) with a background usage poller, exported to
+  Prometheus. Units are encoded in metric names (`_fahrenheit`, `_kwh`,
+  `_gallons`, `_dollars`).
+* `costPerKWH` config (US dollars per kWh) feeding `econet_energy_cost_dollars`.
+* Helm chart for Kubernetes deployment.