diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15b1a93..71f3a65 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,28 @@ All notable changes to the KoalaSync browser extension and relay server.
---
+## [v2.0.4] — 2026-06-03
+
+### Security & Hardening
+- Hardened relay health endpoints against simple flood traffic: `GET /` and `GET /health` are now limited to 10 requests per minute per client IP.
+- Added lazy 60-second server-side caching for `GET /`, basic `/health`, and admin `/health` JSON responses to reduce repeated health-check work under noisy polling.
+- Added stricter brute-force throttling for invalid admin metrics bearer attempts.
+- Added startup warning for short `ADMIN_METRICS_TOKEN` values and documented that production Node ports must stay private behind Caddy or another trusted reverse proxy.
+- Lowered the default maximum peers per room to 25.
+
+### Added
+- Optional privacy-preserving admin metrics on `/health` when `ADMIN_METRICS_TOKEN` is configured and a valid bearer token is supplied. Metrics are aggregate-only and exclude room IDs, peer IDs, usernames, IP addresses, media titles, passwords, and other user-level data.
+
+### Changed
+- Removed `bcryptjs`; temporary room passwords continue to use keyed SHA-256/HMAC hashing as documented.
+- Public room discovery is now rate-limited server-side to one refresh every 10 seconds per socket, with the extension refresh button locked for 11 seconds.
+
+### Fixed
+- Improved Shadow DOM video detection so real embedded players are not hidden by smaller light-DOM preview or placeholder videos.
+- Fixed join-button timeout cleanup after join status responses.
+
+---
+
## [v2.0.2] — 2026-06-02
### Fixed
diff --git a/extension/manifest.base.json b/extension/manifest.base.json
index 232e0bb..68d02a1 100644
--- a/extension/manifest.base.json
+++ b/extension/manifest.base.json
@@ -1,7 +1,7 @@
{
"manifest_version": 3,
"name": "KoalaSync",
- "version": "2.0.3",
+ "version": "2.0.4",
"description": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends.",
"permissions": [
"storage",
diff --git a/package.json b/package.json
index 9a0681f..bc765a5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "koalasync",
- "version": "2.0.3",
+ "version": "2.0.4",
"description": "KoalaSync Build Scripts",
"private": true,
"scripts": {
diff --git a/website/version.json b/website/version.json
index c57c47d..406ca78 100644
--- a/website/version.json
+++ b/website/version.json
@@ -1,4 +1,4 @@
{
- "version": "2.0.3",
- "date": "2026-06-03T08:49:25Z"
+ "version": "2.0.4",
+ "date": "2026-06-03T09:05:38Z"
}
diff --git a/website/www/de/index.html b/website/www/de/index.html
index b4e886c..3cae2cf 100644
--- a/website/www/de/index.html
+++ b/website/www/de/index.html
@@ -256,7 +256,7 @@
