diff --git a/.github/release-please/release-please-manifest.json b/.github/release-please/release-please-manifest.json
index 6d78745c..091cfb12 100644
--- a/.github/release-please/release-please-manifest.json
+++ b/.github/release-please/release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.9.0"
+  ".": "0.10.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 200a8d09..51dd2844 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.10.0](https://github.com/opentdf/java-sdk/compare/v0.9.0...v0.10.0) (2025-08-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* **sdk:** add base key and support for key grants in ZTDF ([#271](https://github.com/opentdf/java-sdk/issues/271))
+
+### Features
+
+* ability to set connect-rpc protocol ([#285](https://github.com/opentdf/java-sdk/issues/285)) ([47041c5](https://github.com/opentdf/java-sdk/commit/47041c56036bdcfe172dfc4817de5aec868a78e5))
+* add system metadata assertion ([#270](https://github.com/opentdf/java-sdk/issues/270)) ([d235f13](https://github.com/opentdf/java-sdk/commit/d235f13ae8e20add618ebe30e18d0b485b7ed58f))
+* introduce the base key for nano flows ([#273](https://github.com/opentdf/java-sdk/issues/273)) ([d337704](https://github.com/opentdf/java-sdk/commit/d337704fa9ac63864a9bc896a837f19b15cf3c0c))
+* **sdk:** add base key and support for key grants in ZTDF ([#271](https://github.com/opentdf/java-sdk/issues/271)) ([c3b79db](https://github.com/opentdf/java-sdk/commit/c3b79dbd8786fdcbd18beff76b8cdf26c38b24da))
+
+
+### Bug Fixes
+
+* **ci:** Update codeql.yaml to run on all pull requests ([#283](https://github.com/opentdf/java-sdk/issues/283)) ([9e318bb](https://github.com/opentdf/java-sdk/commit/9e318bb80a38a657f35735616c493744aeb68f62))
+* create AES-256 keys of the correct length with all curves ([#282](https://github.com/opentdf/java-sdk/issues/282)) ([95c20b3](https://github.com/opentdf/java-sdk/commit/95c20b3af31bd4e6c58a570d1d760747ce3e3d3f))
+* **sdk:** add methods to examine Manifest and Policy ([#278](https://github.com/opentdf/java-sdk/issues/278)) ([03d5d41](https://github.com/opentdf/java-sdk/commit/03d5d410d093348507e3fc68f0f8bff8445db0a9))
+
 ## [0.9.0](https://github.com/opentdf/java-sdk/compare/v0.8.1...v0.9.0) (2025-07-14)
 
 
diff --git a/cmdline/pom.xml b/cmdline/pom.xml
index 9f07abe0..48661745 100644
--- a/cmdline/pom.xml
+++ b/cmdline/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.opentdf.platform</groupId>
         <artifactId>sdk-pom</artifactId>
-        <version>0.9.1-SNAPSHOT</version>
+        <version>0.10.0</version>
     </parent>
     <artifactId>cmdline</artifactId>
     <properties>
diff --git a/cmdline/src/main/java/io/opentdf/platform/Command.java b/cmdline/src/main/java/io/opentdf/platform/Command.java
index ae11679a..55fb4cad 100644
--- a/cmdline/src/main/java/io/opentdf/platform/Command.java
+++ b/cmdline/src/main/java/io/opentdf/platform/Command.java
@@ -49,7 +49,7 @@
  */
 class Versions {
     // Version of the SDK, managed by release-please.
-    public static final String SDK = "0.9.1-SNAPSHOT"; // x-release-please-version
+    public static final String SDK = "0.10.0"; // x-release-please-version
 
     // This sdk aims to support this version of the TDF spec; currently 4.3.0.
     public static final String TDF_SPEC = "4.3.0";
diff --git a/examples/pom.xml b/examples/pom.xml
index ace2cda8..2221ca4d 100644
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <artifactId>sdk-pom</artifactId>
     <groupId>io.opentdf.platform</groupId>
-    <version>0.9.1-SNAPSHOT</version>
+    <version>0.10.0</version>
   </parent>
 
   <groupId>io.opentdf.platform</groupId>
diff --git a/pom.xml b/pom.xml
index ae8ce236..61beb55f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
 
     <groupId>io.opentdf.platform</groupId>
     <artifactId>sdk-pom</artifactId>
-    <version>0.9.1-SNAPSHOT</version>
+    <version>0.10.0</version>
     <name>io.opentdf.platform:sdk-pom</name>
     <description>OpenTDF Java SDK</description>
     <url>https://github.com/opentdf/java-sdk</url>
diff --git a/sdk/pom.xml b/sdk/pom.xml
index ef2ed2f3..e892b895 100644
--- a/sdk/pom.xml
+++ b/sdk/pom.xml
@@ -1,14 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <name>io.opentdf.platform:sdk</name>
     <artifactId>sdk</artifactId>
     <parent>
         <artifactId>sdk-pom</artifactId>
         <groupId>io.opentdf.platform</groupId>
-        <version>0.9.1-SNAPSHOT</version>
+        <version>0.10.0</version>
     </parent>
     <packaging>jar</packaging>
     <properties>
@@ -371,18 +369,17 @@
                             <target>
                                 <!-- Generate OpenTDF Platform Protobuf -->
                                 <exec executable="buf" dir="." failOnError="true">
-                                    <arg value="generate" />
-                                    <arg
-                                        value="https://github.com/opentdf/platform.git#branch=${platform.branch},subdir=service" />
-                                    <arg value="-o" />
-                                    <arg value="target" />
+                                    <arg value="generate"/>
+                                    <arg value="https://github.com/opentdf/platform.git#branch=${platform.branch},subdir=service"/>
+                                    <arg value="-o"/>
+                                    <arg value="target"/>
                                 </exec>
                                 <!-- Generate gRPC Protobuf -->
                                 <exec executable="buf" dir="." failOnError="true">
-                                    <arg value="generate" />
-                                    <arg value="buf.build/grpc-ecosystem/grpc-gateway" />
-                                    <arg value="-o" />
-                                    <arg value="target" />
+                                    <arg value="generate"/>
+                                    <arg value="buf.build/grpc-ecosystem/grpc-gateway"/>
+                                    <arg value="-o"/>
+                                    <arg value="target"/>
                                 </exec>
                             </target>
                         </configuration>
@@ -510,21 +507,18 @@
                                 <configuration>
                                     <target>
                                         <condition property="jazzer.os" value="windows">
-                                            <os family="windows" />
+                                            <os family="windows"/>
                                         </condition>
                                         <condition property="jazzer.os" value="macos">
-                                            <os family="mac" />
+                                            <os family="mac"/>
                                         </condition>
                                         <condition property="jazzer.os" value="linux">
-                                            <os family="unix" />
+                                            <os family="unix"/>
                                         </condition>
-                                        <echo message="Detected OS: ${jazzer.os}" />
-                                        <mkdir dir="${project.build.directory}/jazzer" />
-                                        <get src="${jazzer.baseurl}/jazzer-${jazzer.os}.tar.gz"
-                                            dest="${project.build.directory}/jazzer/jazzer.tar.gz" />
-                                        <untar compression="gzip"
-                                            src="${project.build.directory}/jazzer/jazzer.tar.gz"
-                                            dest="${project.build.directory}/jazzer" />
+                                        <echo message="Detected OS: ${jazzer.os}"/>
+                                        <mkdir dir="${project.build.directory}/jazzer"/>
+                                        <get src="${jazzer.baseurl}/jazzer-${jazzer.os}.tar.gz" dest="${project.build.directory}/jazzer/jazzer.tar.gz"/>
+                                        <untar compression="gzip" src="${project.build.directory}/jazzer/jazzer.tar.gz" dest="${project.build.directory}/jazzer"/>
                                     </target>
                                 </configuration>
                                 <goals>
@@ -566,28 +560,22 @@
                                 <configuration>
                                     <target>
                                         <path id="project.classpath">
-                                            <pathelement
-                                                location="${project.build.directory}/classes" />
-                                            <pathelement
-                                                location="${project.build.directory}/test-classes" />
-                                            <fileset
-                                                dir="${project.build.directory}/dependency-jars">
-                                                <include name="**/*.jar" />
+                                            <pathelement location="${project.build.directory}/classes"/>
+                                            <pathelement location="${project.build.directory}/test-classes"/>
+                                            <fileset dir="${project.build.directory}/dependency-jars">
+                                                <include name="**/*.jar"/>
                                             </fileset>
                                         </path>
-                                        <pathconvert property="project.classpath.string"
-                                            pathsep="${path.separator}">
-                                            <path refid="project.classpath" />
+                                        <pathconvert property="project.classpath.string" pathsep="${path.separator}">
+                                            <path refid="project.classpath"/>
                                         </pathconvert>
-                                        <property environment="env" />
+                                        <property environment="env"/>
 
-                                        <chmod file="${project.build.directory}/jazzer/jazzer"
-                                            perm="777" />
+                                        <chmod file="${project.build.directory}/jazzer/jazzer" perm="777"/>
 
                                         <exec executable="bash">
-                                            <arg value="-c" />
-                                            <arg
-                                                value="if [ -z &quot;${JAVA_HOME}&quot; ]; then JAVA_HOME=$(dirname $(dirname $(which java))); fi; DYLD_LIBRARY_PATH=$(find &quot;${JAVA_HOME}&quot; -type d | grep 'libexec/openjdk.jdk/Contents/Home/lib/server' 2&gt;/dev/null | head -n 1); if [ -z &quot;${DYLD_LIBRARY_PATH}&quot; ]; then DYLD_LIBRARY_PATH=&quot;${JAVA_HOME}/lib/server&quot;; fi; export DYLD_LIBRARY_PATH=${DYLD_LIBRARY_PATH}; ${project.build.directory}/jazzer/jazzer --cp='${project.classpath.string}' --target_class='io.opentdf.platform.sdk.Fuzzing' --instrumentation_includes='io.opentdf.platform.sdk.**' ${jazzer.testDir}" />
+                                            <arg value="-c"/>
+                                            <arg value="if [ -z &quot;${JAVA_HOME}&quot; ]; then JAVA_HOME=$(dirname $(dirname $(which java))); fi; DYLD_LIBRARY_PATH=$(find &quot;${JAVA_HOME}&quot; -type d | grep 'libexec/openjdk.jdk/Contents/Home/lib/server' 2&gt;/dev/null | head -n 1); if [ -z &quot;${DYLD_LIBRARY_PATH}&quot; ]; then DYLD_LIBRARY_PATH=&quot;${JAVA_HOME}/lib/server&quot;; fi; export DYLD_LIBRARY_PATH=${DYLD_LIBRARY_PATH}; ${project.build.directory}/jazzer/jazzer --cp='${project.classpath.string}' --target_class='io.opentdf.platform.sdk.Fuzzing' --instrumentation_includes='io.opentdf.platform.sdk.**' ${jazzer.testDir}"/>
                                         </exec>
                                     </target>
                                 </configuration>
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/Version.java b/sdk/src/main/java/io/opentdf/platform/sdk/Version.java
index ef0ee8fd..9cae1e44 100644
--- a/sdk/src/main/java/io/opentdf/platform/sdk/Version.java
+++ b/sdk/src/main/java/io/opentdf/platform/sdk/Version.java
@@ -12,7 +12,7 @@
 class Version implements Comparable<Version> {
 
     // Version of the SDK, managed by release-please.
-    public static final String SDK = "0.9.1-SNAPSHOT"; // x-release-please-version
+    public static final String SDK = "0.10.0"; // x-release-please-version
 
     private final int major;
     private final int minor;