diff --git a/Makefile b/Makefile
index 3a92a9c..3e5e28d 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ DATA = snowflake--1.0.sql \
 	   snowflake--2.2--2.3.sql \
 	   snowflake--2.3.sql \
 	   snowflake--2.3--2.4.sql \
-	   snowflake--2.4--2.5.sql
+	   snowflake--2.4--2.5.0.sql
 PGFILEDESC = "snowflake - snowflake style IDs for PostgreSQL"
 
 REGRESS = conversion maxvalue repair
diff --git a/docs/changelog.md b/docs/changelog.md
new file mode 100644
index 0000000..9b08eb8
--- /dev/null
+++ b/docs/changelog.md
@@ -0,0 +1,39 @@
+# Changelog
+
+All notable changes to the Snowflake extension are documented here.
+
+## 2.5.0 (unreleased)
+
+### Added
+
+- PG18 support: added a PG18 test configuration and adjusted the Docker
+  build to skip LLVM bitcode compilation on PG18.
+
+### Changed
+
+- Adopted three-digit (`MAJOR.MINOR.PATCH`) versioning. The extension
+  version is now `2.5.0`.
+
+### Fixed
+
+- Fixed dump/restore of snowflake-converted sequences.
+  `convert_sequence_to_snowflake()` previously left `MAXVALUE` at
+  `(old last_value + 1)`, but `snowflake.nextval()` bypasses `MAXVALUE`
+  and writes snowflake-sized values, so `pg_dump` could emit a `setval()`
+  that failed to restore. Sequences are now converted with
+  `AS bigint MAXVALUE 9223372036854775807`, and sequences converted by
+  earlier versions are auto-repaired on upgrade. (SUP-140)
+- Fixed the SQL command used to convert sequences to Snowflake.
+
+### Security / CI
+
+- Pinned GitHub Actions to full commit SHAs to harden against supply
+  chain attacks.
+- Removed `shell=True` and shell-injection risks from test runner and
+  helper subprocess calls; use `shlex.split()` for correct argument
+  tokenization.
+- Fixed a SQL injection warning and a missing parameter in
+  `execute_sqlite_query`, and suppressed Bandit B603 warnings on internal
+  test helper subprocess calls.
+- Fixed the Dockerfile `ARG` handling for newer BuildKit versions.
+- Updated the copyright year to 2026.
diff --git a/expected/repair.out b/expected/repair.out
index 96e73c2..64e5743 100644
--- a/expected/repair.out
+++ b/expected/repair.out
@@ -62,11 +62,11 @@ FROM pg_sequences WHERE sequencename = 'standalone_seq';
 (1 row)
 
 -- ----------------------------------------------------------------------
--- Upgrade to 2.5: the repair block runs automatically.  Suppress its
+-- Upgrade to 2.5.0: the repair block runs automatically.  Suppress its
 -- NOTICEs so the test output does not depend on repair ordering.
 -- ----------------------------------------------------------------------
 SET client_min_messages = warning;
-ALTER EXTENSION snowflake UPDATE TO '2.5';
+ALTER EXTENSION snowflake UPDATE TO '2.5.0';
 RESET client_min_messages;
 -- Both sequences must now carry the full bigint ceiling.
 SELECT sequencename, max_value = 9223372036854775807 AS repaired
diff --git a/mkdocs.yml b/mkdocs.yml
index be3a698..b87f135 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -54,3 +54,4 @@ nav:
   - Converting an Existing Postgres Sequence: converting.md
   - Using Snowflake Functions: snowflake_functions.md
   - Reviewing Snowflake Meta-Data: review_seq.md
+  - Changelog: changelog.md
diff --git a/snowflake--2.4--2.5.sql b/snowflake--2.4--2.5.0.sql
similarity index 99%
rename from snowflake--2.4--2.5.sql
rename to snowflake--2.4--2.5.0.sql
index d953515..4eaf080 100644
--- a/snowflake--2.4--2.5.sql
+++ b/snowflake--2.4--2.5.0.sql
@@ -1,7 +1,7 @@
-/* snowflake--2.4--2.5.sql */
+/* snowflake--2.4--2.5.0.sql */
 
 -- complain if script is sourced in psql, rather than via ALTER EXTENSION
-\echo Use "ALTER EXTENSION snowflake UPDATE TO '2.5'" to load this file. \quit
+\echo Use "ALTER EXTENSION snowflake UPDATE TO '2.5.0'" to load this file. \quit
 
 -- ----------------------------------------------------------------------
 -- 2.4 -> 2.5 - fix MAXVALUE on snowflake-converted sequences.
diff --git a/snowflake.control b/snowflake.control
index 4582083..238706a 100644
--- a/snowflake.control
+++ b/snowflake.control
@@ -1,6 +1,6 @@
 # snowflake extension
 comment = 'Snowflake style IDs for PostgreSQL'
-default_version = '2.5'
+default_version = '2.5.0'
 module_pathname = '$libdir/snowflake'
 relocatable = false
 schema = snowflake
diff --git a/sql/repair.sql b/sql/repair.sql
index bb5e077..6458a79 100644
--- a/sql/repair.sql
+++ b/sql/repair.sql
@@ -46,11 +46,11 @@ SELECT max_value < 9223372036854775807 AS max_is_low,
 FROM pg_sequences WHERE sequencename = 'standalone_seq';
 
 -- ----------------------------------------------------------------------
--- Upgrade to 2.5: the repair block runs automatically.  Suppress its
+-- Upgrade to 2.5.0: the repair block runs automatically.  Suppress its
 -- NOTICEs so the test output does not depend on repair ordering.
 -- ----------------------------------------------------------------------
 SET client_min_messages = warning;
-ALTER EXTENSION snowflake UPDATE TO '2.5';
+ALTER EXTENSION snowflake UPDATE TO '2.5.0';
 RESET client_min_messages;
 
 -- Both sequences must now carry the full bigint ceiling.