diff --git a/CHANGELOG.md b/CHANGELOG.md
index 70e87ec..bf6ae4f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## v0.21.1 (2026-10-22)
+
+* Fix `hex_tarball:create/2,3` and `hex_tarball:create_docs/1,2` crashing with a `function_clause` error when a file name resolves to the root of the tarball, such as `"."`. A directory with such a name is skipped, as in v0.19.0, and a regular file or symlink returns `{error, {tarball, {unsafe_path, Name}}}`.
+
 ## v0.21.0 (2026-10-21)
 
 * Request the CI job's OIDC token only for the audience in the new `workload_identity_audience` config option, `hexpm` by default, and return `{error, {oidc_audience_not_allowed, Audience}}` when the API advertises a different one, so a configured API can't get a token that another service accepts.
diff --git a/README.md b/README.md
index 4419c12..d4c2f8d 100644
--- a/README.md
+++ b/README.md
@@ -222,7 +222,7 @@ Add to `rebar.config`:
 
 ```erlang
 {deps, [
-  {hex_core, "0.21.0"}
+  {hex_core, "0.21.1"}
 ]}
 ```
 
@@ -233,7 +233,7 @@ Add to `mix.exs`:
 ```elixir
 defp deps do
   [
-    {:hex_core, "~> 0.21.0"}
+    {:hex_core, "~> 0.21.1"}
   ]
 end
 ```
diff --git a/src/hex_core.app.src b/src/hex_core.app.src
index 92b3259..d33541a 100644
--- a/src/hex_core.app.src
+++ b/src/hex_core.app.src
@@ -1,6 +1,6 @@
 {application, hex_core, [
     {description, "Reference implementation of Hex specifications"},
-    {vsn, "0.21.0"},
+    {vsn, "0.21.1"},
     {registered, []},
     {applications, [kernel, stdlib, inets, ssl, ssh]},
     {licenses, ["Apache-2.0"]},
diff --git a/src/hex_core.hrl b/src/hex_core.hrl
index f5cefd5..1d4e85d 100644
--- a/src/hex_core.hrl
+++ b/src/hex_core.hrl
@@ -1 +1 @@
--define(HEX_CORE_VERSION, "0.21.0").
+-define(HEX_CORE_VERSION, "0.21.1").