diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bf0f2cd..d5ff4107 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0]
+
 This release stops nvx asking questions an agent could answer, closes a set of
 sandbox and check gaps that 0.7.0 shipped with, and makes pnpm, yarn and bun
 installs as checked as npm ones. Read "Upgrading from 0.7.0" first. Several
diff --git a/internal/nvx/main.go b/internal/nvx/main.go
index 5601f6f0..cce25ace 100644
--- a/internal/nvx/main.go
+++ b/internal/nvx/main.go
@@ -812,7 +812,7 @@ func printHelp() {
 // list in README.md. The two are hand-maintained copies and had already drifted:
 // the README was missing doctor, grants, import, setup and shim.
 func helpText() string {
-	return `nvx - A Node.js and Bun version manager that runs package installs in an OS sandbox
+	return `nvx - Runs npm install and npx in an OS sandbox, and manages Node.js and Bun versions
 
 Usage:
   nvx <command> [arguments]
diff --git a/internal/nvx/version.go b/internal/nvx/version.go
index 9c376c72..a7f0c92b 100644
--- a/internal/nvx/version.go
+++ b/internal/nvx/version.go
@@ -13,7 +13,7 @@ import (
 	"time"
 )
 
-var appVersion = "0.7.0"
+var appVersion = "0.8.0"
 
 // Release represents a Node.js release from the official index.json
 type Release struct {
diff --git a/site/src/content/docs/docs/commands.md b/site/src/content/docs/docs/commands.md
index 166e2596..930d81e1 100644
--- a/site/src/content/docs/docs/commands.md
+++ b/site/src/content/docs/docs/commands.md
@@ -154,7 +154,7 @@ This is what `nvx help` prints, including every flag and environment
 variable.
 
 ```text
-nvx - A Node.js and Bun version manager that runs package installs in an OS sandbox
+nvx - Runs npm install and npx in an OS sandbox, and manages Node.js and Bun versions
 
 Usage:
   nvx <command> [arguments]
diff --git a/site/src/data/site-content/changelog.ts b/site/src/data/site-content/changelog.ts
index e24996a0..a4f8f797 100644
--- a/site/src/data/site-content/changelog.ts
+++ b/site/src/data/site-content/changelog.ts
@@ -38,6 +38,8 @@ export const changelogSurfaces: ChangelogSurface[] = [
 ];
 
 export const releaseSummaries: Record<string, string> = {
+  'v0.8.0':
+    'Security release. Closes three ways code could get out of the 0.7.0 sandbox or run as you, and makes widening the sandbox a command you run yourself. Agent mode refuses instead of approving, every .env is hidden on all three systems, and installs use the exact lockfile nvx checked.',
   'v0.7.0':
     'The first Authenticode-signed release, and nvx is on npm. pnpm installs inside the Windows sandbox, nvx setup takes seconds, and the pre-install checks cover every package an npm install brings in.',
   'v0.6.0':
diff --git a/site/src/data/site-content/version.ts b/site/src/data/site-content/version.ts
index 35e44e0a..1ee2581f 100644
--- a/site/src/data/site-content/version.ts
+++ b/site/src/data/site-content/version.ts
@@ -1,4 +1,4 @@
 // The version the structured data and the changelog page report. nvx's own
 // source of truth is internal/nvx/version.go, which a Go test holds equal to
 // the newest CHANGELOG heading; bump this alongside a release.
-export const productVersion = '0.7.0';
+export const productVersion = '0.8.0';