diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95f7c9e..83c3de8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -215,7 +215,7 @@ jobs:
 
   release-assets:
     name: Upload release assets
-    needs: [create-release]
+    needs: [create-release, build-release]
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
@@ -231,12 +231,45 @@ jobs:
         with:
           name: anyllm-proxy-deb-arm64
           path: ./debs
-      - name: Upload to GitHub Release
+      - name: Upload debs to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           ls -la ./debs/
           gh release upload "${{ github.ref_name }}" ./debs/*.deb --repo "${{ github.repository }}" --clobber
+      # Linux + Windows binaries are built by build-release but only uploaded as
+      # CI artifacts; package them into release archives (tar.gz / zip) matching
+      # the macOS tarball naming produced by brew-release.
+      - name: Download linux x86_64 binary
+        uses: actions/download-artifact@v8
+        with:
+          name: anyllm_proxy-x86_64-unknown-linux-gnu
+          path: ./bins/linux-x86_64
+      - name: Download linux arm64 binary
+        uses: actions/download-artifact@v8
+        with:
+          name: anyllm_proxy-aarch64-unknown-linux-gnu
+          path: ./bins/linux-arm64
+      - name: Download windows x86_64 binary
+        uses: actions/download-artifact@v8
+        with:
+          name: anyllm_proxy-x86_64-pc-windows-msvc
+          path: ./bins/windows-x86_64
+      - name: Package binary archives
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#v}"
+          chmod +x ./bins/linux-x86_64/anyllm-proxy ./bins/linux-arm64/anyllm-proxy
+          mkdir -p dist
+          tar -czf "dist/anyllm-proxy-${VERSION}-linux-x86_64.tar.gz" -C ./bins/linux-x86_64 anyllm-proxy
+          tar -czf "dist/anyllm-proxy-${VERSION}-linux-arm64.tar.gz"  -C ./bins/linux-arm64  anyllm-proxy
+          ( cd ./bins/windows-x86_64 && zip -q "${GITHUB_WORKSPACE}/dist/anyllm-proxy-${VERSION}-windows-x86_64.zip" anyllm-proxy.exe )
+          ls -la dist/
+      - name: Upload binary archives to GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${{ github.ref_name }}" dist/*.tar.gz dist/*.zip --repo "${{ github.repository }}" --clobber
 
   publish:
     name: Publish to crates.io
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00b6e8f..b025eb1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,19 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versions follo
 
 ## [Unreleased]
 
+### Added
+- Release: GitHub Releases now include Linux (`x86_64`, `arm64`) `.tar.gz` and Windows
+  (`x86_64`) `.zip` binary archives, alongside the existing macOS tarballs and `.deb`
+  packages. The binaries were already built in CI but never packaged/attached.
+
+### Fixed
+- Security: Bedrock native routes (`POST /model/{modelId}/converse`,
+  `/converse-stream`, `/invoke`, `/invoke-with-response-stream`) now enforce the
+  virtual key's model allowlist. Previously these handlers skipped the
+  `is_model_allowed` check that `bedrock_passthrough` and every other
+  client-facing handler apply, so a model-scoped key could invoke any Bedrock
+  `modelId` (model-scope bypass / cost-abuse). Found via a keyless 3gate scan.
+
 ## [0.13.0] - 2026-07-12
 
 ### Fixed