diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e32fa20..cfd5225 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -128,10 +128,19 @@ jobs:
       with:
         go-version-file: go.mod
         cache-dependency-path: go.sum
-    - name: Build devcloud binary
-      # Same build configuration as .goreleaser.yaml, so the 775 tests below
-      # exercise the artifact this tag is about to publish.
-      run: CGO_ENABLED=0 go build -o dist/devcloud ./cmd/devcloud
+    - name: Build devcloud binary with GoReleaser
+      # GoReleaser, not `go build`. This step used to run `go build ./cmd/devcloud`
+      # and claim it matched .goreleaser.yaml; it matched only CGO_ENABLED. The
+      # config built `cmd/devcloud/main.go` — a single file, which drops
+      # imports.go and with it every service registration — so v1.0.0 published
+      # six archives, a Homebrew formula and four container tags whose binary
+      # exited at startup, while these 775 tests passed against a different
+      # binary that was never shipped. The gate now compiles what ships.
+      uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # goreleaser-action v7
+      with:
+        distribution: goreleaser
+        version: "~> v2"
+        args: build --single-target --snapshot --clean --id devcloud --output dist/devcloud
     - name: Set up Python
       uses: actions/setup-python@v7
       with:
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index eebb6f3..15ec391 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -13,7 +13,11 @@ before:
 builds:
 - id: devcloud
   binary: devcloud
-  main: cmd/devcloud/main.go
+  # The package, not main.go. Building the single file drops imports.go — the
+  # only place the 104 services blank-import themselves into the registry — and
+  # main.go references nothing from it, so the build succeeds and the binary
+  # exits at startup with "unknown service: s3".
+  main: ./cmd/devcloud
   goos:
   - darwin
   - linux
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f343ff0..5370c47 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,9 +35,11 @@
 * Service selection now matches what the docs promise. An empty `services` block is still a block, so it starts nothing rather than every registered service; and `DEVCLOUD_SERVICES` names the running set outright rather than intersecting with the `services` block, so it starts a service the block omits and overrides a block entry the file disabled. Previously `DEVCLOUD_SERVICES=sqs` alongside a block listing only `s3` started nothing at all ([#129](https://github.com/skyoo2003/devcloud/issues/129))
 * CloudFront no longer fabricates a success for operations it does not implement. Its dispatch fallback answered HTTP 200 with an empty XML document, which boto3 parses as a successful empty result, on all 122 CloudFront operations the fidelity manifest classifies as `unimplemented` — including `GetPublicKey`. It now returns `NotImplemented` (HTTP 501), matching the other 32 providers that decline from their own dispatch default. It was the only provider in the tree that answered an unimplemented call with a success ([#129](https://github.com/skyoo2003/devcloud/issues/129))
 * Generated routers now honour route patterns that constrain the query string, so operations distinguished only by a query parameter are reachable. `matchURI` split the whole pattern into path segments, which made `/2020-05-31/tagging?Operation=Tag` unable to match the path segment `tagging` — CloudFront `TagResource` and `UntagResource` were implemented but unroutable, and answered as unimplemented. A pattern's constraint must now be satisfied by the request query, and query-constrained routes are tried ahead of unconstrained ones so a bare path cannot shadow a more specific route ([#129](https://github.com/skyoo2003/devcloud/issues/129))
+* Released binaries now register their services. GoReleaser built `cmd/devcloud/main.go` rather than the package, which drops `imports.go` — the only place the 104 services blank-import themselves into the registry. `main.go` references nothing from it, so the build succeeded and the binary exited at startup with `unknown service: s3`. Every archive, the Homebrew formula and the container images were affected; the boto3 suite missed it because the release gate compiled the package instead of what GoReleaser ships, and that gate now builds with GoReleaser ([#131](https://github.com/skyoo2003/devcloud/issues/131))
 ### Documentation
 * Corrected what the fidelity manifest says an `unimplemented` operation returns. It claimed JSON and Query services answer `InvalidAction` (HTTP 400), but only the 46 providers that fall through to the CRUD engine do; 32 answer `NotImplemented` (HTTP 501) from their own dispatch default, several use their own vocabulary, and `sqs` differs by protocol. Only the failure itself is stable — the specific code and status are documented, not guaranteed ([#129](https://github.com/skyoo2003/devcloud/issues/129))
-* The roadmap, architecture and governance docs no longer describe DevCloud as pre-1.0. All three ship inside the release archive, so a v1.0 download would have carried a roadmap listing its own release as pending, an architecture overview naming Phase 1 as current, and a governance doc calling the API unstable — contradicting the compatibility policy packaged beside them ([#130](https://github.com/skyoo2003/devcloud/issues/130))## [v0.2.0](https://github.com/skyoo2003/devcloud/releases/tag/v0.2.0) - 2026-04-21
+* The roadmap, architecture and governance docs no longer describe DevCloud as pre-1.0. All three ship inside the release archive, so a v1.0 download would have carried a roadmap listing its own release as pending, an architecture overview naming Phase 1 as current, and a governance doc calling the API unstable — contradicting the compatibility policy packaged beside them ([#130](https://github.com/skyoo2003/devcloud/issues/130))
+## [v0.2.0](https://github.com/skyoo2003/devcloud/releases/tag/v0.2.0) - 2026-04-21
 ### Added
 * Add GoReleaser + Changie release pipeline ([#26](https://github.com/skyoo2003/devcloud/issues/26))
 ### Changed
diff --git a/changes/v1.0.0.md b/changes/v1.0.0.md
index 6fee719..a361b08 100644
--- a/changes/v1.0.0.md
+++ b/changes/v1.0.0.md
@@ -35,6 +35,7 @@
 * Service selection now matches what the docs promise. An empty `services` block is still a block, so it starts nothing rather than every registered service; and `DEVCLOUD_SERVICES` names the running set outright rather than intersecting with the `services` block, so it starts a service the block omits and overrides a block entry the file disabled. Previously `DEVCLOUD_SERVICES=sqs` alongside a block listing only `s3` started nothing at all ([#129](https://github.com/skyoo2003/devcloud/issues/129))
 * CloudFront no longer fabricates a success for operations it does not implement. Its dispatch fallback answered HTTP 200 with an empty XML document, which boto3 parses as a successful empty result, on all 122 CloudFront operations the fidelity manifest classifies as `unimplemented` — including `GetPublicKey`. It now returns `NotImplemented` (HTTP 501), matching the other 32 providers that decline from their own dispatch default. It was the only provider in the tree that answered an unimplemented call with a success ([#129](https://github.com/skyoo2003/devcloud/issues/129))
 * Generated routers now honour route patterns that constrain the query string, so operations distinguished only by a query parameter are reachable. `matchURI` split the whole pattern into path segments, which made `/2020-05-31/tagging?Operation=Tag` unable to match the path segment `tagging` — CloudFront `TagResource` and `UntagResource` were implemented but unroutable, and answered as unimplemented. A pattern's constraint must now be satisfied by the request query, and query-constrained routes are tried ahead of unconstrained ones so a bare path cannot shadow a more specific route ([#129](https://github.com/skyoo2003/devcloud/issues/129))
+* Released binaries now register their services. GoReleaser built `cmd/devcloud/main.go` rather than the package, which drops `imports.go` — the only place the 104 services blank-import themselves into the registry. `main.go` references nothing from it, so the build succeeded and the binary exited at startup with `unknown service: s3`. Every archive, the Homebrew formula and the container images were affected; the boto3 suite missed it because the release gate compiled the package instead of what GoReleaser ships, and that gate now builds with GoReleaser ([#131](https://github.com/skyoo2003/devcloud/issues/131))
 ### Documentation
 * Corrected what the fidelity manifest says an `unimplemented` operation returns. It claimed JSON and Query services answer `InvalidAction` (HTTP 400), but only the 46 providers that fall through to the CRUD engine do; 32 answer `NotImplemented` (HTTP 501) from their own dispatch default, several use their own vocabulary, and `sqs` differs by protocol. Only the failure itself is stable — the specific code and status are documented, not guaranteed ([#129](https://github.com/skyoo2003/devcloud/issues/129))
 * The roadmap, architecture and governance docs no longer describe DevCloud as pre-1.0. All three ship inside the release archive, so a v1.0 download would have carried a roadmap listing its own release as pending, an architecture overview naming Phase 1 as current, and a governance doc calling the API unstable — contradicting the compatibility policy packaged beside them ([#130](https://github.com/skyoo2003/devcloud/issues/130))