diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9401251..8270e71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,10 @@ Versions are `<stock CSS version>-<n>`: a new stock release starts at `-1`, a
 new overlay on the same stock adds one. A tag `v<version>` publishes both
 images (`.github/workflows/build.yml`).
 
-## Unreleased
+## 7.3.0-2 — 2026-11-03
+
+Overlay only, on stock CSS 7.3.0. An instance updates the image; nothing to
+change in `.env` but the version.
 
 - **Consent keeps the account's agents apart** (#25). A WebID that another
   WebID of the account declares as its agent (`acl:delegates` in its public
diff --git a/README.md b/README.md
index efb6790..189740a 100644
--- a/README.md
+++ b/README.md
@@ -265,7 +265,7 @@ included, and no app could read a pod's root. Checked against the image,
 One command on the VPS, from 7.2.0-11:
 
 ```sh
-/srv/<instance>/instance-template/update.sh 7.2.0-13
+/srv/<instance>/instance-template/update.sh 7.3.0-2
 ```
 
 `instance-template/update.sh` checks first and changes nothing if a check
diff --git a/docs/handoff-mapsofmaking.md b/docs/handoff-mapsofmaking.md
index 72f1207..5c407e6 100644
--- a/docs/handoff-mapsofmaking.md
+++ b/docs/handoff-mapsofmaking.md
@@ -14,7 +14,7 @@ particular to Maps of Making.
 | Connector (`MCP_PUBLIC_BASE`) | `https://mcp.pod.mapsofmaking.org/` |
 | `MCP_ALLOWED_HOSTS` | `mcp.pod.mapsofmaking.org,pod.mapsofmaking.org` (the second is for `/onboard/`) |
 | `INSTANCE_NAME` | `mom-pods`: containers `mom-pods-css` and `mom-pods-mcp-connector`, volume `mom-pods_css-data`. One checkout per function, prefix `mom-` |
-| `CSS_OVERLAY_VERSION` | `7.2.0-13`, the same as the tag checked out (`update.sh` keeps them so) |
+| `CSS_OVERLAY_VERSION` | `7.3.0-2`, the same as the tag checked out (`update.sh` keeps them so) |
 | `GATEWAY_NETWORK` | `proxy` |
 | DNS | OVH, zone `mapsofmaking.org`. The site on `mapsofmaking.org` lives on another server (Hetzner) and is not touched |
 | VPS | Debian 13, Docker 29.7.2, Compose v5.5.0; 3.7 GiB RAM, 2 GiB swap (2026-10-25); IPv4 `92.222.71.103`, IPv6 `2001:41d0:404:200::94de` |
diff --git a/instance-template/.env.example b/instance-template/.env.example
index a7f00b7..8139810 100644
--- a/instance-template/.env.example
+++ b/instance-template/.env.example
@@ -7,7 +7,7 @@ INSTANCE_NAME=mom-pods
 
 # The image tag, for both images: the same version as the tag this checkout is
 # at (git describe --tags). CHANGELOG.md lists them.
-CSS_OVERLAY_VERSION=7.2.0-13
+CSS_OVERLAY_VERSION=7.3.0-2
 
 # The server, trailing slash included. Pods are <name>.<this host>, so the
 # gateway needs this host AND *.<this host> (wildcard certificate, README).