diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7bba968..8fcd466 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,31 @@ All notable changes to the ValidPay Python SDK will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.0] - 2026-07-02
+
+### Added
+
+- **End-Cell issuance — `create_end_cell_intent()`** (recommended). KeyHalve's
+  blind-rail flow: encrypts the payload locally and XOR-splits the AES key into
+  **ShareA** (returned as `result.key`, rides the QR) plus one share per holder
+  (`holders` defaults to `["keyhalve", "platform"]` → a 3-of-3 split). No
+  single party — not the platform, not KeyHalve — can read or reassemble the
+  key. Requires the API deployment to have End-Cell issuance enabled.
+- **Rail verify.** `verify_intent` now detects End-Cell intents and fetches the
+  independent KeyHalve rail share alongside the platform share, verifying the
+  rail's Ed25519 signature against a **pinned** key (fail-closed) before
+  recombining in memory and decrypting. One `verify_intent` call handles all
+  share models.
+
+### Changed
+
+- **Canonical verify origin is now `https://verify.keyhalve.com`.**
+  `build_verify_url` (and `embed_qr`) emit verify links on the canonical
+  KeyHalve verifier origin by default.
+- README leads with End-Cell (recommended) — quick start and API reference
+  document the 3-share blind-rail flow first; split-key stays the
+  `create_intent` default (2-share).
+
 ## [1.5.0] - 2026-06-19
 
 ### Added
diff --git a/pyproject.toml b/pyproject.toml
index b1e06a0..22a70cb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "validpay"
-version = "1.5.0"
+version = "1.6.0"
 description = "Official ValidPay Python SDK — client-side AES-256-GCM encryption + ValidPay API client"
 readme = "README.md"
 license = { file = "LICENSE" }