diff --git a/CHANGELOG.md b/CHANGELOG.md
index 55401410..383a33f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,17 @@
 
 Record breaking or significant changes here. All dates are UTC.
 
-## Unreleased - September 2026
+## Unreleased - October 2026
 
 Put changes for the upcoming release here!
 
+## [0.6.0](https://github.com/tailscale/tailscale-rs/releases/tag/v0.5.0) - 2026-09-17
+
+- **Security** (ts_tunnel): we've completed a third-party security audit of the cryptography in ts_tunnel, and this
+  release remediates all security-relevant findings. A number of low-priority findings and "things to think about" are
+  open in [GitHub Issues](https://github.com/tailscale/tailscale-rs/issues/162), but aren't security-relevant at the
+  moment; as such, we're comfortable recommending `tailscale-rs` from a security perspective. We've removed the README
+  security caveats and env var requirement (see below).
 - **Breaking** (Rust API): changed the key types of `tailscale::keys::PersistState` to new "exportable" keys. This
   should require no changes to code if you're just serializing/deserializing `PersistStates` without touching the
   contents.
@@ -17,9 +24,13 @@ Put changes for the upcoming release here!
   pair types allow code to explicitly opt into serializability.
 - Changed (Rust API, lang bindings): the `TS_RS_EXPERIMENT` environment variable is no longer required to use the
   library. The library logs a warning during initialization, as a reminder that it's still work-in-progress software.
-- Updated MSRV to 1.97.
-- Added (ts_netmon): support for macOS. This brings macOS support for direct peer-to-peer connections to parity with 
+- Changed (ts_runtime): the overlay netstack is now configured with 64KiB TCP rx/tx buffers (up from 16KiB) and a deeper
+  command channel queue, improving throughput for file downloads.
+- Added (ts_netmon): support for macOS. This brings macOS support for direct peer-to-peer connections to parity with
   Linux and Windows. [#396](https://github.com/tailscale/tailscale-rs/pull/396)
+- Fixed (ts_control_serde): `DerpMap::omit_default_regions` is now correctly deserialized from the control plane. Thanks
+  to @valkum for the report! [#416](https://github.com/tailscale/tailscale-rs/pull/416)
+- Updated MSRV to 1.97.
 
 ## [0.5.0](https://github.com/tailscale/tailscale-rs/releases/tag/v0.5.0) - 2026-08-14
 
diff --git a/Cargo.lock b/Cargo.lock
index 9a907af5..a061aa7f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -650,7 +650,7 @@ dependencies = [
 
 [[package]]
 name = "checks"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "clap",
  "globwalk",
@@ -5192,7 +5192,7 @@ dependencies = [
 
 [[package]]
 name = "tailscale"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "axum",
  "bytes",
@@ -5808,7 +5808,7 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "ts_array256"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "heapless",
  "lazy_static",
@@ -5820,7 +5820,7 @@ dependencies = [
 
 [[package]]
 name = "ts_bart"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "cfg-if",
  "divan",
@@ -5839,7 +5839,7 @@ dependencies = [
 
 [[package]]
 name = "ts_bart_packetfilter"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "hashbrown 0.17.1",
  "ipnet",
@@ -5854,7 +5854,7 @@ dependencies = [
 
 [[package]]
 name = "ts_bitset"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "cfg-if",
  "divan",
@@ -5864,14 +5864,14 @@ dependencies = [
 
 [[package]]
 name = "ts_capabilityversion"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "ts_cli_util"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "cfg-if",
  "clap",
@@ -5890,7 +5890,7 @@ dependencies = [
 
 [[package]]
 name = "ts_control"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "chrono",
@@ -5923,7 +5923,7 @@ dependencies = [
 
 [[package]]
 name = "ts_control_noise"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -5946,7 +5946,7 @@ dependencies = [
 
 [[package]]
 name = "ts_control_serde"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -5964,7 +5964,7 @@ dependencies = [
 
 [[package]]
 name = "ts_dataplane"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bitrs",
  "bytes",
@@ -5984,7 +5984,7 @@ dependencies = [
 
 [[package]]
 name = "ts_derp"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "crypto_box",
@@ -6012,7 +6012,7 @@ dependencies = [
 
 [[package]]
 name = "ts_devtools"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "clap",
@@ -6030,7 +6030,7 @@ dependencies = [
 
 [[package]]
 name = "ts_disco_protocol"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "aead 0.5.2",
  "crypto_box",
@@ -6045,7 +6045,7 @@ dependencies = [
 
 [[package]]
 name = "ts_dynbitset"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "proptest",
  "smallvec",
@@ -6054,7 +6054,7 @@ dependencies = [
 
 [[package]]
 name = "ts_elixir"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "rustler",
  "static_assertions",
@@ -6066,7 +6066,7 @@ dependencies = [
 
 [[package]]
 name = "ts_ffi"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "cbindgen",
  "tailscale",
@@ -6078,7 +6078,7 @@ dependencies = [
 
 [[package]]
 name = "ts_future_util"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "futures-core",
  "futures-util",
@@ -6089,14 +6089,14 @@ dependencies = [
 
 [[package]]
 name = "ts_hexdump"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "heapless",
 ]
 
 [[package]]
 name = "ts_http_util"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "futures",
@@ -6117,7 +6117,7 @@ dependencies = [
 
 [[package]]
 name = "ts_keys"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "crypto_box",
  "serde",
@@ -6129,14 +6129,14 @@ dependencies = [
 
 [[package]]
 name = "ts_kv_store"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "ts_kv_store_tokio"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "thiserror 2.0.18",
  "tokio",
@@ -6146,7 +6146,7 @@ dependencies = [
 
 [[package]]
 name = "ts_netcheck"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "dashmap",
@@ -6167,7 +6167,7 @@ dependencies = [
 
 [[package]]
 name = "ts_netmon"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bitflags 2.13.0",
  "bstr",
@@ -6199,7 +6199,7 @@ dependencies = [
 
 [[package]]
 name = "ts_netstack_smoltcp"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "axum",
  "bytes",
@@ -6220,7 +6220,7 @@ dependencies = [
 
 [[package]]
 name = "ts_netstack_smoltcp_core"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "flume",
@@ -6234,7 +6234,7 @@ dependencies = [
 
 [[package]]
 name = "ts_netstack_smoltcp_socket"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "futures-io",
@@ -6245,7 +6245,7 @@ dependencies = [
 
 [[package]]
 name = "ts_nodecapability"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "cfg-if",
  "serde",
@@ -6254,7 +6254,7 @@ dependencies = [
 
 [[package]]
 name = "ts_noise"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "aead 0.5.2",
  "blake2",
@@ -6270,7 +6270,7 @@ dependencies = [
 
 [[package]]
 name = "ts_overlay_router"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "itertools",
  "tracing",
@@ -6281,7 +6281,7 @@ dependencies = [
 
 [[package]]
 name = "ts_packet"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "crypto_box",
@@ -6292,7 +6292,7 @@ dependencies = [
 
 [[package]]
 name = "ts_packetfilter"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "hashbrown 0.17.1",
  "ipnet",
@@ -6302,7 +6302,7 @@ dependencies = [
 
 [[package]]
 name = "ts_packetfilter_serde"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "ipnet",
  "nom 8.0.0",
@@ -6315,7 +6315,7 @@ dependencies = [
 
 [[package]]
 name = "ts_packetfilter_state"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "divan",
  "serde_json",
@@ -6326,7 +6326,7 @@ dependencies = [
 
 [[package]]
 name = "ts_peercapability"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "serde",
  "url",
@@ -6334,7 +6334,7 @@ dependencies = [
 
 [[package]]
 name = "ts_python"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "hex",
  "pyo3",
@@ -6346,7 +6346,7 @@ dependencies = [
 
 [[package]]
 name = "ts_runtime"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "chrono",
@@ -6391,18 +6391,18 @@ dependencies = [
 
 [[package]]
 name = "ts_test_util"
-version = "0.5.0"
+version = "0.6.0"
 
 [[package]]
 name = "ts_time"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "proptest",
 ]
 
 [[package]]
 name = "ts_tls_util"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "tokio",
  "tokio-rustls",
@@ -6413,7 +6413,7 @@ dependencies = [
 
 [[package]]
 name = "ts_transport"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "dyn-eq",
  "dyn-hash",
@@ -6426,7 +6426,7 @@ dependencies = [
 
 [[package]]
 name = "ts_transport_tun"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bytes",
  "ipnet",
@@ -6441,7 +6441,7 @@ dependencies = [
 
 [[package]]
 name = "ts_tunnel"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "aead 0.5.2",
  "base64 0.22.1",
@@ -6465,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "ts_underlay_router"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "ts_packet",
  "ts_transport",
diff --git a/Cargo.toml b/Cargo.toml
index 705256ea..ab68c08c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -52,7 +52,7 @@ members = [
 edition = "2024"
 license = "BSD-3-Clause"
 publish = true
-version = "0.5.0"
+version = "0.6.0"
 repository = "https://github.com/tailscale/tailscale-rs"
 
 # This disagrees with the README's stated MSRV. That's intentional: this field causes cargo to error
@@ -112,47 +112,47 @@ zerocopy = { version = "0.8", features = ["derive"] }
 zeroize = { version = "1.8.2", features = ["zeroize_derive"] }
 
 # local workspace deps
-tailscale = { path = ".", version = "0.5.0" }
-ts_array256 = { path = "ts_array256", version = "0.5.0" }
-ts_bart = { path = "ts_bart", version = "0.5.0" }
-ts_bart_packetfilter = { path = "ts_bart_packetfilter", version = "0.5.0" }
-ts_bitset = { path = "ts_bitset", default-features = false, version = "0.5.0" }
-ts_capabilityversion = { path = "ts_capabilityversion", version = "0.5.0" }
+tailscale = { path = ".", version = "0.6.0" }
+ts_array256 = { path = "ts_array256", version = "0.6.0" }
+ts_bart = { path = "ts_bart", version = "0.6.0" }
+ts_bart_packetfilter = { path = "ts_bart_packetfilter", version = "0.6.0" }
+ts_bitset = { path = "ts_bitset", default-features = false, version = "0.6.0" }
+ts_capabilityversion = { path = "ts_capabilityversion", version = "0.6.0" }
 ts_cli_util = { path = "ts_cli_util" }
-ts_control = { path = "ts_control", version = "0.5.0" }
-ts_control_noise = { path = "ts_control_noise", version = "0.5.0" }
-ts_control_serde = { path = "ts_control_serde", version = "0.5.0" }
-ts_dataplane = { path = "ts_dataplane", version = "0.5.0" }
-ts_derp = { path = "ts_derp", version = "0.5.0" }
-ts_disco_protocol = { path = "ts_disco_protocol", version = "0.5.0" }
-ts_dynbitset = { path = "ts_dynbitset", version = "0.5.0" }
-ts_future_util = { path = "ts_future_util", version = "0.5.0" }
-ts_hexdump = { path = "ts_hexdump", version = "0.5.0" }
-ts_keys = { path = "ts_keys", version = "0.5.0" }
-ts_kv_store = { path = "ts_kv_store", version = "0.5.0" }
-ts_kv_store_tokio = { path = "ts_kv_store_tokio", version = "0.5.0" }
-ts_netcheck = { path = "ts_netcheck", version = "0.5.0" }
-ts_netmon = { path = "ts_netmon", version = "0.5.0" }
-ts_netstack_smoltcp = { path = "ts_netstack_smoltcp", version = "0.5.0" }
-ts_netstack_smoltcp_core = { path = "ts_netstack_smoltcp_core", version = "0.5.0" }
-ts_netstack_smoltcp_socket = { path = "ts_netstack_smoltcp_socket", version = "0.5.0" }
-ts_nodecapability = { path = "ts_nodecapability", version = "0.5.0" }
-ts_noise = { path = "ts_noise", version = "0.5.0" }
-ts_overlay_router = { path = "ts_overlay_router", version = "0.5.0" }
-ts_packet = { path = "ts_packet", version = "0.5.0" }
-ts_packetfilter = { path = "ts_packetfilter", version = "0.5.0" }
-ts_packetfilter_serde = { path = "ts_packetfilter_serde", version = "0.5.0" }
-ts_packetfilter_state = { path = "ts_packetfilter_state", version = "0.5.0" }
-ts_peercapability = { path = "ts_peercapability", version = "0.5.0" }
-ts_http_util = { path = "ts_http_util", version = "0.5.0" }
-ts_tls_util = { path = "ts_tls_util", version = "0.5.0" }
-ts_runtime = { path = "ts_runtime", version = "0.5.0" }
+ts_control = { path = "ts_control", version = "0.6.0" }
+ts_control_noise = { path = "ts_control_noise", version = "0.6.0" }
+ts_control_serde = { path = "ts_control_serde", version = "0.6.0" }
+ts_dataplane = { path = "ts_dataplane", version = "0.6.0" }
+ts_derp = { path = "ts_derp", version = "0.6.0" }
+ts_disco_protocol = { path = "ts_disco_protocol", version = "0.6.0" }
+ts_dynbitset = { path = "ts_dynbitset", version = "0.6.0" }
+ts_future_util = { path = "ts_future_util", version = "0.6.0" }
+ts_hexdump = { path = "ts_hexdump", version = "0.6.0" }
+ts_keys = { path = "ts_keys", version = "0.6.0" }
+ts_kv_store = { path = "ts_kv_store", version = "0.6.0" }
+ts_kv_store_tokio = { path = "ts_kv_store_tokio", version = "0.6.0" }
+ts_netcheck = { path = "ts_netcheck", version = "0.6.0" }
+ts_netmon = { path = "ts_netmon", version = "0.6.0" }
+ts_netstack_smoltcp = { path = "ts_netstack_smoltcp", version = "0.6.0" }
+ts_netstack_smoltcp_core = { path = "ts_netstack_smoltcp_core", version = "0.6.0" }
+ts_netstack_smoltcp_socket = { path = "ts_netstack_smoltcp_socket", version = "0.6.0" }
+ts_nodecapability = { path = "ts_nodecapability", version = "0.6.0" }
+ts_noise = { path = "ts_noise", version = "0.6.0" }
+ts_overlay_router = { path = "ts_overlay_router", version = "0.6.0" }
+ts_packet = { path = "ts_packet", version = "0.6.0" }
+ts_packetfilter = { path = "ts_packetfilter", version = "0.6.0" }
+ts_packetfilter_serde = { path = "ts_packetfilter_serde", version = "0.6.0" }
+ts_packetfilter_state = { path = "ts_packetfilter_state", version = "0.6.0" }
+ts_peercapability = { path = "ts_peercapability", version = "0.6.0" }
+ts_http_util = { path = "ts_http_util", version = "0.6.0" }
+ts_tls_util = { path = "ts_tls_util", version = "0.6.0" }
+ts_runtime = { path = "ts_runtime", version = "0.6.0" }
 ts_test_util = { path = "ts_test_util" }
-ts_time = { path = "ts_time", version = "0.5.0" }
-ts_transport = { path = "ts_transport", version = "0.5.0" }
-ts_transport_tun = { path = "ts_transport_tun", version = "0.5.0" }
-ts_underlay_router = { path = "ts_underlay_router", version = "0.5.0" }
-ts_tunnel = { path = "ts_tunnel", version = "0.5.0" }
+ts_time = { path = "ts_time", version = "0.6.0" }
+ts_transport = { path = "ts_transport", version = "0.6.0" }
+ts_transport_tun = { path = "ts_transport_tun", version = "0.6.0" }
+ts_underlay_router = { path = "ts_underlay_router", version = "0.6.0" }
+ts_tunnel = { path = "ts_tunnel", version = "0.6.0" }
 
 [workspace.lints.rust]
 closure_returning_async_block = "warn"
diff --git a/README.md b/README.md
index 3df1c03a..68ce2565 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ Add this dependency line to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-tailscale = { version = "0.5" }
+tailscale = { version = "0.6" }
 ```
 
 Examples of using the `tailscale` crate can be found in [`examples/`](examples/README.md).
@@ -68,7 +68,8 @@ and to see where the community runs with it, but please be aware of a few import
 
 - There are no compatibility guarantees at the moment. We may break dependent code in order to get things right,
   although we will try to avoid doing so gratuitously.
-- Direct connections via NAT traversal is a work in progress. Communication may fall back to DERP relaying in more cases,
+- Direct connections via NAT traversal is a work in progress. Communication may fall back to DERP relaying in more
+  cases,
   with a corresponding hit to latency and throughput.
 - Core networking functionality is implemented. Many other features are still either in progress or not implemented yet.
   See [Status](#status) for details.
@@ -87,7 +88,8 @@ The current MSRV is 1.97. The current edition is Rust 2024.
 `tailscale-rs` has a rolling MSRV (Minimum Supported Rust Version) policy to support the current and previous Rust
 compiler versions, and the latest [edition of Rust](https://doc.rust-lang.org/edition-guide/editions/index.html).
 
-We may periodically lag the MSRV behind this latest version/edition in rare cases for our dependencies to catch up and for us to perform any necessary
+We may periodically lag the MSRV behind this latest version/edition in rare cases for our dependencies to catch up and
+for us to perform any necessary
 fixes.
 
 ## Platform Support
@@ -101,7 +103,8 @@ We support the following platforms and architectures:
 ## Status
 
 `tailscale-rs` is a work-in-progress. We're still rapidly iterating, fixing bugs, and adding new features.
-We aim to keep this section up-to-date, but our [issue tracker](https://github.com/tailscale/tailscale-rs/issues) is the best way to see the latest updates.
+We aim to keep this section up-to-date, but our [issue tracker](https://github.com/tailscale/tailscale-rs/issues) is the
+best way to see the latest updates.
 
 ### Implemented
 
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 24eff1b5..a6055c5e 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -55,6 +55,9 @@ audit-as-crates-io = false
 [policy.ts_ffi]
 audit-as-crates-io = false
 
+[policy.ts_future_util]
+audit-as-crates-io = false
+
 [policy.ts_hexdump]
 audit-as-crates-io = false
 
@@ -64,6 +67,12 @@ audit-as-crates-io = false
 [policy.ts_keys]
 audit-as-crates-io = false
 
+[policy.ts_kv_store]
+audit-as-crates-io = false
+
+[policy.ts_kv_store_tokio]
+audit-as-crates-io = false
+
 [policy.ts_netcheck]
 audit-as-crates-io = false
 
@@ -815,10 +824,6 @@ criteria = "safe-to-run"
 version = "0.5.14"
 criteria = "safe-to-run"
 
-[[exemptions.quote]]
-version = "1.0.45"
-criteria = "safe-to-deploy"
-
 [[exemptions.r-efi]]
 version = "5.3.0"
 criteria = "safe-to-deploy"
diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
index 655260a6..1ce1bda1 100644
--- a/supply-chain/imports.lock
+++ b/supply-chain/imports.lock
@@ -557,6 +557,56 @@ criteria = "safe-to-run"
 version = "1.2.3"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
 
+[[audits.google.audits.quote]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.35"
+notes = """
+Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits
+(except for benign "net" hit in tests and "fs" hit in README.md)
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.35 -> 1.0.36"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.36 -> 1.0.37"
+notes = """
+The delta just 1) inlines/expands `impl ToTokens` that used to be handled via
+`primitive!` macro and 2) adds `impl ToTokens` for `CStr` and `CString`.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Dustin J. Mitchell <djmitche@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.37 -> 1.0.38"
+notes = "Still no unsafe"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Daniel Cheng <dcheng@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.38 -> 1.0.39"
+notes = "Only minor changes for clippy lints and documentation."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.39 -> 1.0.40"
+notes = """
+The delta is just a simplification of how `tokens.extend(...)` call is made.
+Still no `unsafe` anywhere.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
 [[audits.google.audits.rand_core]]
 who = "Lukasz Anforowicz <lukasza@chromium.org>"
 criteria = "safe-to-deploy"
@@ -709,8 +759,8 @@ who = "Henri Sivonen <hsivonen@hsivonen.fi>"
 criteria = "safe-to-deploy"
 user-id = 4484 # Henri Sivonen (hsivonen)
 start = "2019-02-26"
-end = "2025-10-23"
-notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
+end = "2027-09-07"
+notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others."
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
 [[audits.mozilla.wildcard-audits.euclid]]
@@ -1139,6 +1189,18 @@ criteria = "safe-to-deploy"
 delta = "1.0.94 -> 1.0.106"
 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.quote]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "1.0.40 -> 1.0.45"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.quote]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "1.0.45 -> 1.0.47"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.rmp]]
 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 criteria = "safe-to-deploy"
@@ -1196,6 +1258,22 @@ delta = "1.0.3 -> 1.1.1"
 notes = "No code changes, just dependency updates."
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.shlex]]
+who = "Emilio Cobos Álvarez <emilio@crisal.io>"
+criteria = "safe-to-deploy"
+delta = "1.3.0 -> 2.0.1"
+notes = """
+Mostly removes some deprecated and unsound APIs.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.simdutf8]]
+who = "Henri Sivonen <hsivonen@hsivonen.fi>"
+criteria = "safe-to-deploy"
+version = "0.1.5"
+notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.smallvec]]
 who = "Erich Gubler <erichdongubler@gmail.com>"
 criteria = "safe-to-deploy"
diff --git a/ts_elixir/mix.exs b/ts_elixir/mix.exs
index 5d9cdadf..0daa1b50 100644
--- a/ts_elixir/mix.exs
+++ b/ts_elixir/mix.exs
@@ -6,7 +6,7 @@ defmodule TsElixir.MixProject do
   def project do
     [
       app: :tailscale,
-      version: "0.5.0",
+      version: "0.6.0",
       elixir: "~> 1.19",
       start_permanent: Mix.env() == :prod,
       deps: deps(),
diff --git a/ts_python/pyproject.toml b/ts_python/pyproject.toml
index 69b2356b..7f0f4ffc 100644
--- a/ts_python/pyproject.toml
+++ b/ts_python/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "tailscale-py"
-version = "0.5.0"
+version = "0.6.0"
 description = "Work-in-progress Tailscale library written in Rust."
 license = "BSD-3-Clause"
 readme = "README.md"
diff --git a/ts_python/uv.lock b/ts_python/uv.lock
index a1bc3fbf..8e3b2739 100644
--- a/ts_python/uv.lock
+++ b/ts_python/uv.lock
@@ -4,28 +4,28 @@ requires-python = ">=3.12"
 
 [[package]]
 name = "maturin"
-version = "1.14.1"
+version = "1.15.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e7/b3/addd877f871fb1860d46d3a4f206ecb10b946c85846805e6367631926fd3/maturin-1.14.1.tar.gz", hash = "sha256:9d6577a62cd08e0ceba7a0db06fb098e0c9b1b3429bad747a4f3a18215a1b3df", size = 369637, upload-time = "2026-06-19T05:19:49.774Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b9/c8/22e5e21b2679c9bce6415ca578034ca2cc9316be0642ae21e051a2d5198c/maturin-1.15.0.tar.gz", hash = "sha256:94b26cc8e8aba61a5f2099715fe640e18c5f678e9a500408b38761263954228a", size = 385504, upload-time = "2026-08-24T12:11:22.665Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f4/f0/97c5a5bd9c71653a066c0976a484eaaae50b9369557838a4176b7b0bdaa5/maturin-1.14.1-py3-none-linux_armv6l.whl", hash = "sha256:522292398945442cdafa9daeb2271b2340fbde57027b818f923f88eab04174f8", size = 10207496, upload-time = "2026-06-19T05:19:09.321Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/83/294bca639b0e052f1e2f65199b3db258780c7d4e31408b934c9c974a1379/maturin-1.14.1-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:ffe5ad71f21d1e6603c4dd75f7fee34adf5ed5ebcebb692886549888ebb329ed", size = 19680113, upload-time = "2026-06-19T05:19:13.43Z" },
-    { url = "https://files.pythonhosted.org/packages/43/b6/79c881410a3b1c187f7eb3d407aecae646c6a4433d630d72200359015e83/maturin-1.14.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:f3306078070c1508fd715b9116070cbcaff5959024272a9f1e6f5cb29768b86c", size = 10169205, upload-time = "2026-06-19T05:19:16.615Z" },
-    { url = "https://files.pythonhosted.org/packages/93/9d/44b6f26dcb7f7a04c5501ac2dbb6ca1490150682baa525ca5860504f9eab/maturin-1.14.1-py3-none-manylinux_2_12_i686.manylinux2010_i686.musllinux_1_1_i686.whl", hash = "sha256:cd457cd88961156e26379e1155bd287cc0ec1c8b2f1582b0660fb31b87c8842d", size = 10188098, upload-time = "2026-06-19T05:19:19.736Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/bd/9c0d5d6983905ce2c9edaa073a7e89355a9cf7f396988e05d32f1c37785d/maturin-1.14.1-py3-none-manylinux_2_12_x86_64.manylinux2010_x86_64.musllinux_1_1_x86_64.whl", hash = "sha256:dfc54ae32e6fcb18302193ab9a30b0b25eefffba994ae13238974805533ef75e", size = 10627576, upload-time = "2026-06-19T05:19:22.713Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/33/b096412bd6a7cb399652b260666f901adf88a687181a6dbd6a3f89f0a94e/maturin-1.14.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:a131d912b5267e640bc96d70f4914e10590aed64082ec9abacba7cea52004224", size = 10085181, upload-time = "2026-06-19T05:19:25.69Z" },
-    { url = "https://files.pythonhosted.org/packages/56/8d/08c3bf469c38a23c9e6c877e338193001eb604d010fedc08341974e38528/maturin-1.14.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_1_armv7l.whl", hash = "sha256:be18fc568fb76884c0205456336892a75105ec398e6b667cd777c6268bd06d69", size = 10026363, upload-time = "2026-06-19T05:19:28.904Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/a4/c4d1a92839f8745ab4aab988a7db884a79d6d710bd3b286fcf9316dece1a/maturin-1.14.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.musllinux_1_1_ppc64le.whl", hash = "sha256:994a0c8ba3ad8a92b3a9ee1b02645d200d610216b15cff5102b0fe65e8e08666", size = 13321347, upload-time = "2026-06-19T05:19:32.411Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/fa/170f04624d03fd07d2a8b1b67de83a127af93aef9eaa425839553347297b/maturin-1.14.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:be80866363e605d137991b491a741a84cde9ae350183c4c85f49690ca9aaaa65", size = 10877609, upload-time = "2026-06-19T05:19:35.448Z" },
-    { url = "https://files.pythonhosted.org/packages/61/ad/1ae2e1d0ded282bf2c55ac13f0811d87deb425e200ae64a15785675dede9/maturin-1.14.1-py3-none-manylinux_2_31_riscv64.musllinux_1_1_riscv64.whl", hash = "sha256:5282dffd4b539d2be245f4e5b1a5ab6bc1033b58f4a4872f5833f9d43c954aa4", size = 10417316, upload-time = "2026-06-19T05:19:38.28Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/27/bf677183920718da49cd7982d6a3ffc440aad8919329f571d189f81b7bdf/maturin-1.14.1-py3-none-win32.whl", hash = "sha256:1a04de0a20188f95c721b5702eed18140bdcccb28c386797093eca3f62f4d4e0", size = 8931293, upload-time = "2026-06-19T05:19:41.183Z" },
-    { url = "https://files.pythonhosted.org/packages/63/4b/585adeb9167b08d3cdff0032a938b0e72655c92003df4f52c3f696a1bcc2/maturin-1.14.1-py3-none-win_amd64.whl", hash = "sha256:3c9f94640ecc4895e94abaf834a0684430032c865b2748a36c12461fd9252fdd", size = 10314067, upload-time = "2026-06-19T05:19:44.389Z" },
-    { url = "https://files.pythonhosted.org/packages/51/d4/dac8c0720ae246be1700afb6fbdbbea20fe35b13f6570b2f70faa005df77/maturin-1.14.1-py3-none-win_arm64.whl", hash = "sha256:15cea8fcb3ba47dd636f50092bb34baea8b04ac777392f23e6bf8a9a61efb894", size = 9718943, upload-time = "2026-06-19T05:19:47.49Z" },
+    { url = "https://files.pythonhosted.org/packages/14/69/5c01b461044eb1f45ddcce006706eb88110c793cdb11c7ae0b5e08492e94/maturin-1.15.0-py3-none-linux_armv6l.whl", hash = "sha256:6bf6dc62e22d4dcfd5a51244ff0d58975fa4979c48209fe84159617648956d82", size = 10206220, upload-time = "2026-08-24T12:10:53.327Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/1f/2b431554e11687cdb1077e0cdadcc118c53f611086b3af00c8545a67c6a5/maturin-1.15.0-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:cd35772633f489841132bc8e71d6fc7f842df30b9c05cd5cdf1ee1ddcb744cc7", size = 19416513, upload-time = "2026-08-24T12:10:56.126Z" },
+    { url = "https://files.pythonhosted.org/packages/51/36/e23a21cb34a648b711036b9b2fe1d4f3f4ee24f8db54215d73f1a9a3a3ec/maturin-1.15.0-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:c40b4eae7bf5ef1f4b1af8d623fe4105016f93578fb15b764e741d08ec3b92dd", size = 10014962, upload-time = "2026-08-24T12:10:58.486Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/80/33b15cb2d8f30f12c807955e8f2fd775027692904e30ec0784744ce8cd83/maturin-1.15.0-py3-none-manylinux_2_12_i686.manylinux2010_i686.musllinux_1_1_i686.whl", hash = "sha256:7eb066372f541f8eb4909c79c5d9bd0b9e8125980bdf1ec9e8aba23c6c8d6c55", size = 10196223, upload-time = "2026-08-24T12:11:00.696Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/91/b495e19e2f5c503b540452b2039115e7b2363867e8c5ad4179eb752fa92c/maturin-1.15.0-py3-none-manylinux_2_12_x86_64.manylinux2010_x86_64.musllinux_1_1_x86_64.whl", hash = "sha256:653020a63525bb224e5ab0adf02e17a2e08bc86dbea7fc1399c9a56d7529b99e", size = 10541186, upload-time = "2026-08-24T12:11:02.857Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/2b/2abff58037188d852b124871b1f0d720e1c2bfb3d4f1b03d87c52cd66488/maturin-1.15.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:0ebf9767892725083138e671c34482c660317a2f3d6a29fc0e0f34e9d8c99136", size = 10083468, upload-time = "2026-08-24T12:11:05.012Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/07/b7e9f8be99a6627849e81ac7b6694876bce8f50a92995fe17e3cf2610f0a/maturin-1.15.0-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_1_armv7l.whl", hash = "sha256:7ab7eebffd7b8debca2265985de4eaeb332141276d24b9560b5ad484d4b3add1", size = 10047786, upload-time = "2026-08-24T12:11:07.042Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ab/167e3cb7accee11b507dbe53e0e87aeccb376d44ae66284c96ee4df3a9fd/maturin-1.15.0-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.musllinux_1_1_ppc64le.whl", hash = "sha256:126e12e618b4db42f68c779a56d41f82a390145ba36ac3f621d057eb34f5ad9d", size = 13315332, upload-time = "2026-08-24T12:11:09.433Z" },
+    { url = "https://files.pythonhosted.org/packages/14/4d/801379f646cbc6b00998e5289b0630a886be3a4ee4c75b6bc9b87478a7f1/maturin-1.15.0-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4f9d33e6c3f9615c8caceecbbbd440f8eb25a3ddeb687077682cd5eca2e9ae15", size = 10807183, upload-time = "2026-08-24T12:11:11.73Z" },
+    { url = "https://files.pythonhosted.org/packages/89/27/2e612e1cbd1580e9e94d4722c227b5180dca27b32b955a34b79918aa1292/maturin-1.15.0-py3-none-manylinux_2_31_riscv64.musllinux_1_1_riscv64.whl", hash = "sha256:bf29beddd0c6708f112db51d5275fc28b28b9e9c9c5faae387eaef662918b176", size = 10413274, upload-time = "2026-08-24T12:11:14.04Z" },
+    { url = "https://files.pythonhosted.org/packages/70/d8/202a7b4d75a51f20f84ec9ce3b7345b12b822207072164e2b1c6ef665125/maturin-1.15.0-py3-none-win32.whl", hash = "sha256:da649988be98e87e009e51b1bf0d301b6a301bc0cecbdd60d40d8ba60748d1ca", size = 8928744, upload-time = "2026-08-24T12:11:16.269Z" },
+    { url = "https://files.pythonhosted.org/packages/40/dc/4e90da594986ba78dd3bc8a5921ecdcdb11085b22b02a412caab3b225601/maturin-1.15.0-py3-none-win_amd64.whl", hash = "sha256:552c2be4afd43fe8d5c9f3ec8d4c4756d973b8dcbe94c14084390301f50243e1", size = 10335085, upload-time = "2026-08-24T12:11:18.326Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/10/15d4314edf130955edf2dc237aa393a8a7c10f2b9b57b89fa2f61f915659/maturin-1.15.0-py3-none-win_arm64.whl", hash = "sha256:c7dc0c66c78d3debdd9c5aa807e861fbcbf07f3505d34b125df74c03986b0f48", size = 9713795, upload-time = "2026-08-24T12:11:20.83Z" },
 ]
 
 [[package]]
 name = "tailscale-py"
-version = "0.5.0"
+version = "0.6.0"
 source = { editable = "." }
 
 [package.dev-dependencies]