diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ddfa3e3..37fcefa 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.11.1"
+  ".": "1.0.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 035d471..3078b11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## [1.0.0](https://github.com/rubykatzen/flightdeck/compare/v0.11.1...v1.0.0) (2026-08-28)
+
+
+### ⚠ BREAKING CHANGES
+
+* rework deploy/renovate as composite actions with validated targets ([#162](https://github.com/rubykatzen/flightdeck/issues/162))
+
+### Bug Fixes
+
+* rename dependabot label to deps, matching baseline 0.16.2 ([#175](https://github.com/rubykatzen/flightdeck/issues/175)) ([800eb86](https://github.com/rubykatzen/flightdeck/commit/800eb860fc58653a1a95e0c11151dd76dbf4ce53))
+
+
+### Code Refactoring
+
+* rework deploy/renovate as composite actions with validated targets ([#162](https://github.com/rubykatzen/flightdeck/issues/162)) ([cfd3cb7](https://github.com/rubykatzen/flightdeck/commit/cfd3cb7d170e06a54f9513cfcd5e4b391ab4b448))
+
 ## [0.11.1](https://github.com/rubykatzen/flightdeck/compare/v0.11.0...v0.11.1) (2026-08-26)
 
 
diff --git a/README.md b/README.md
index 6c13b19..2cdc0ff 100644
--- a/README.md
+++ b/README.md
@@ -294,12 +294,12 @@ Builds a zip archive from caller-selected paths, rejects runtime state and env f
 steps:
   - uses: actions/checkout@v7
     with:
-      ref: v0.11.1
-  - uses: rubykatzen/flightdeck/.github/actions/build-bundle@v0.11.1
+      ref: v1.0.0
+  - uses: rubykatzen/flightdeck/.github/actions/build-bundle@v1.0.0
     with:
       paths: apps
       bundle-name: flightdeck-apps.zip
-      release-tag: v0.11.1
+      release-tag: v1.0.0
       token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
@@ -319,10 +319,10 @@ A thin defaults wrapper around `build-bundle`: `paths` defaults to `apps`, `bund
 steps:
   - uses: actions/checkout@v7
     with:
-      ref: v0.11.1
-  - uses: rubykatzen/flightdeck/.github/actions/build-apps-bundle@v0.11.1
+      ref: v1.0.0
+  - uses: rubykatzen/flightdeck/.github/actions/build-apps-bundle@v1.0.0
     with:
-      release-tag: v0.11.1
+      release-tag: v1.0.0
       token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
@@ -352,7 +352,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: rubykatzen/flightdeck/.github/actions/deploy@v0.11.1
+      - uses: rubykatzen/flightdeck/.github/actions/deploy@v1.0.0
         with:
           target-manifest: targets/mainframe.yml                          # required, path in this repository
           ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
@@ -362,7 +362,7 @@ jobs:
           # tailscale-oauth-secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}    # required only if tailscale-oauth-client-id is set
           # tailscale-tags: tag:ci                                          # default: tag:ci
       - name: Notify Telegram
-        uses: rubykatzen/baseline/.github/actions/send-telegram-message@v0.16.1
+        uses: rubykatzen/baseline/.github/actions/send-telegram-message@v1.0.0
         with:
           message: "Deploy: mainframe updated"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
@@ -371,7 +371,7 @@ jobs:
 
 <!-- x-release-please-end -->
 
-The `@v0.11.1` pin on the `uses:` line only controls which ref this action's own code runs at. `target-manifest`'s own `app_refs` entries are separate and don't have to match it. <!-- x-release-please-version -->
+The `@v1.0.0` pin on the `uses:` line only controls which ref this action's own code runs at. `target-manifest`'s own `app_refs` entries are separate and don't have to match it. <!-- x-release-please-version -->
 
 #### `deploy.yml`