diff --git a/NEWS.md b/NEWS.md
index f353103c..e3a09451 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,5 +1,24 @@
 # NEWS
 
+4.8.6 - 2026-10-24
+------------------
+
+### Fixed
+
+- Large HTTP/2 downloads over slow links no longer fail with
+  `{error, {stream_error, internal_error}}`. hackney let only 64 KB of a
+  response travel per round trip, so over a 120 ms link a 40 MB body took
+  longer than the server allowed and the server cancelled it. HTTP/2
+  downloads now run about as fast as HTTP/1.1 (#976).
+- Closing a pooled TLS connection no longer logs a supervisor report with
+  reason `killed`. The connection waited for the server to close its side,
+  which took longer than the pool allows, and was killed (#976).
+
+### Changed
+
+- Update `h2` to 0.12.5 and `certifi` to 2.18.0. The new `certifi` removes
+  the compromised eMudhra certificates from the CA bundle (#975).
+
 4.8.5 - 2026-10-04
 ------------------
 
diff --git a/src/hackney.app.src b/src/hackney.app.src
index 9ce7b9df..8786fd02 100644
--- a/src/hackney.app.src
+++ b/src/hackney.app.src
@@ -4,7 +4,7 @@
 {application, hackney,
   [
     {description, "Simple HTTP client with HTTP/1.1, HTTP/2, and HTTP/3 support"},
-    {vsn, "4.8.5"},
+    {vsn, "4.8.6"},
     {registered, [hackney_pool]},
     {applications, [kernel,
       stdlib,