diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d38c09d..28fec3c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,6 +39,6 @@ jobs:
         uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/HISTORY.rst b/HISTORY.rst
index 3965aaf..e0364a1 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -1,4 +1,4 @@
-8.0.1 / Unreleased
+8.0.1 / 2026-10-16
 ==================
 
   * security: require ``urllib3>=2.8.0`` to exclude versions affected by CVE-2026-97687, CVE-2026-97688, and CVE-2026-97689 (PR #456)
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 22a2a51..d85a264 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,6 +1,6 @@
 # json2xml 8.0.1
 
-Unreleased — publication date will be recorded when the release is scheduled.
+Release date: 2026-10-16. Publication is pending final validation.
 
 ## Security fixes
 
@@ -32,13 +32,19 @@ Downstream projects that maintain their own lockfiles should regenerate them and
 
 The security fix in [PR #456](https://github.com/vinitkumar/json2xml/pull/456) passed all 37 reported GitHub checks and the Snyk and Read the Docs commit statuses. Hosted tests covered CPython 3.11–3.15, free-threaded 3.14, and PyPy 3.11 across Linux, macOS, Windows, and Linux ARM64 where configured.
 
-Local validation of that fix passed Ruff, ty, 509 Python tests with 149 optional Rust tests skipped, and 100% statement coverage. The locked dependency audit and wheel/source builds passed. Native Rust tests were not run locally because Cargo was unavailable; no Rust sources changed.
+Previously recorded validation of PR #456 (not rerun in this release environment) passed Ruff, ty, 509 Python tests with 149 optional Rust tests skipped, and 100% statement coverage. The locked dependency audit and wheel/source builds passed. Native Rust tests were not run locally because Cargo was unavailable; no Rust sources changed.
 
-The 8.0.1 release preparation also passed local Ruff, ty, 509 tests with 149 optional Rust tests skipped, 100% statement coverage, lockfile validation, the dependency audit, and architecture documentation checks. Both built distributions passed Twine metadata checks and declare version 8.0.1, Python >=3.11, and urllib3>=2.8.0. The release commit's hosted CI must pass before publication; record those results and the publication date before publishing.
+Previously recorded PR #457 preparation validation (not verification of the final release commit) passed local Ruff, ty, 509 tests with 149 optional Rust tests skipped, 100% statement coverage, lockfile validation, the dependency audit, and architecture documentation checks. Both built distributions passed Twine metadata checks and declare version 8.0.1, Python >=3.11, and urllib3>=2.8.0. Final release validation remains pending. On 2026-10-16, remote master `a8f5d5ed0fa802f47a25583f7538243c51bcb5bd` passed hosted Python tests and lint, but CodeQL failed because its analysis action used 4.38.2 with configuration generated by 4.38.3. This preparation aligns all CodeQL actions to 4.38.3; hosted checks must pass on the exact final commit before publication.
+
+In the saved release environment, `uv lock --check` passed. `make check-all` could not install its locked dependencies because package downloads were blocked; Cargo and `lat` were unavailable. No new passing local tests, Rust tests, build, Twine, or architecture checks are claimed. Publication must remain blocked until the required final checks and package verification are completed.
 
 ## Changelog
 
 - [#456](https://github.com/vinitkumar/json2xml/pull/456): require urllib3 2.8.0 for security fixes.
+- [#457](https://github.com/vinitkumar/json2xml/pull/457): prepare version metadata and security release documentation.
+- [#458](https://github.com/vinitkumar/json2xml/pull/458): update documentation type hints dependency.
+- [#459](https://github.com/vinitkumar/json2xml/pull/459), [#460](https://github.com/vinitkumar/json2xml/pull/460), and [#463](https://github.com/vinitkumar/json2xml/pull/463): update setup-uv and artifact actions.
+- [#461](https://github.com/vinitkumar/json2xml/pull/461) and [#462](https://github.com/vinitkumar/json2xml/pull/462): update CodeQL initialization and autobuild; align analysis to the same 4.38.3 commit before release.
 - [Full changelog from v8.0.0 to v8.0.1](https://github.com/vinitkumar/json2xml/compare/v8.0.0...v8.0.1) (available after the release tag is created).
 
 Generate the GitHub release changelog from the previous **Python** tag, `v8.0.0`, and combine it with this release's curated security notes. Do not use a `rust-v*` tag as the comparison baseline.