diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9eed0e4d..127bab16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 Note: For changes to the API, see https://shopify.dev/changelog?filter=api
 ## Unreleased
+
+## 16.3.1 (2026-10-22)
 - [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Auth.embedded_app_url` now raises `ShopifyAPI::Errors::InvalidShopError` unless the decoded `host` is a trusted Shopify Admin host (see `ShopifyAPI::Utils::ShopValidator`). URLs for supported Admin hosts are unchanged.
 - [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Auth::Oauth.begin_auth` now validates and normalizes `shop` with `ShopifyAPI::Utils::ShopValidator.sanitize!`, and raises `ShopifyAPI::Errors::InvalidShopError` for untrusted domains.
 - [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Utils::ShopValidator` now rejects hosts with non-hostname characters and reads the store handle from the segment after `/store/` in Admin URLs (`admin.shopify.com/store/<handle>`), rejecting a missing or invalid handle.
diff --git a/Gemfile.lock b/Gemfile.lock
index 101e9cb2..624ccafe 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_api (16.3.0)
+    shopify_api (16.3.1)
       activesupport
       addressable (~> 2.7)
       concurrent-ruby
diff --git a/lib/shopify_api/version.rb b/lib/shopify_api/version.rb
index 8b3a2327..9ef92ad2 100644
--- a/lib/shopify_api/version.rb
+++ b/lib/shopify_api/version.rb
@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module ShopifyAPI
-  VERSION = "16.3.0"
+  VERSION = "16.3.1"
 end