diff --git a/Cargo.lock b/Cargo.lock
index 1b72032..89c919a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2353,7 +2353,7 @@ dependencies = [
 
 [[package]]
 name = "restate-operator"
-version = "2.5.0"
+version = "2.5.1"
 dependencies = [
  "actix-web",
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index 38e84c1..3ee02c7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "restate-operator"
-version = "2.5.0"
+version = "2.5.1"
 authors = ["restate.dev"]
 edition = "2024"
 rust-version = "1.92"
diff --git a/charts/restate-operator-helm/Chart.yaml b/charts/restate-operator-helm/Chart.yaml
index 8fabd8b..6395d79 100644
--- a/charts/restate-operator-helm/Chart.yaml
+++ b/charts/restate-operator-helm/Chart.yaml
@@ -2,4 +2,4 @@ apiVersion: v2
 name: restate-operator-helm
 description: An operator for Restate clusters
 type: application
-version: "2.5.0"
+version: "2.5.1"
diff --git a/release-notes/v2.5.1.md b/release-notes/v2.5.1.md
new file mode 100644
index 0000000..6b56519
--- /dev/null
+++ b/release-notes/v2.5.1.md
@@ -0,0 +1,38 @@
+# Restate Operator v2.5.1 Release Notes
+
+## Highlights
+
+- **Fix: Knative deployments now work with Restate Cloud** — The Knative reconciler was passing raw in-cluster Route URLs to the Restate admin API, which Restate Cloud cannot reach. Service URLs are now routed through the cloud tunnel, matching the existing ReplicaSet behavior.
+
+## Bug Fixes
+
+### Knative service URLs not tunneled for Restate Cloud
+
+When using RestateDeployment in Knative mode with a Restate Cloud endpoint
+(`spec.restate.register.cloud`), the operator passed the in-cluster Knative
+Route URL directly to `register_service_with_restate`. Restate Cloud cannot
+reach in-cluster URLs, so registration failed and the operator looped
+indefinitely.
+
+The fix extracts a `maybe_tunnel_url()` method from `RestateAdminEndpoint` and
+calls it in the Knative reconciler after resolving the Route URL, matching how
+the ReplicaSet reconciler already handled this case.
+
+**Impact on Users:**
+- **Knative + Restate Cloud deployments**: This was broken; it now works.
+- **Knative + non-Cloud deployments**: No change; `maybe_tunnel_url` is a no-op
+  when `cloud` is not set.
+- **ReplicaSet deployments**: No change. The internal refactoring of
+  `service_url_for_deployment()` is equivalent to the previous behavior.
+
+*Related: Issue [#120](https://github.com/restatedev/restate-operator/issues/120), PR [#122](https://github.com/restatedev/restate-operator/pull/122)*
+
+---
+
+## Upgrading
+
+No CRD changes in this release. Upgrade the operator via Helm:
+
+```bash
+helm upgrade restate-operator restatedev/restate-operator --version 2.5.1
+```