diff --git a/.github/release-please/release-please-manifest.json b/.github/release-please/release-please-manifest.json
index cacecb2ca9..bc122782db 100644
--- a/.github/release-please/release-please-manifest.json
+++ b/.github/release-please/release-please-manifest.json
@@ -3,7 +3,7 @@
   "lib/ocrypto": "0.14.0",
   "lib/flattening": "0.2.0",
   "lib/identifier": "0.4.0",
-  "otdfctl": "0.38.0",
+  "otdfctl": "0.39.0",
   "protocol/go": "0.42.0",
   "sdk": "0.35.0",
   "service": "0.29.0"
diff --git a/otdfctl/CHANGELOG.md b/otdfctl/CHANGELOG.md
index 05e3a2bff7..1921d4a0e2 100644
--- a/otdfctl/CHANGELOG.md
+++ b/otdfctl/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.39.0](https://github.com/opentdf/platform/compare/otdfctl/v0.38.0...otdfctl/v0.39.0) (2026-10-19)
+
+
+### Features
+
+* **cli:** add FQN policy get lookups ([#4219](https://github.com/opentdf/platform/issues/4219)) ([1117862](https://github.com/opentdf/platform/commit/1117862f810fe80f6a86ff0a94a2455af7dde48f))
+* **cli:** deprecate KAS URL path flag ([#4201](https://github.com/opentdf/platform/issues/4201)) ([af6b1f8](https://github.com/opentdf/platform/commit/af6b1f89bf8560ef598bff008fcc16cf30141250))
+* **kas:** support ML-KEM client session keys in rewrap ([#3814](https://github.com/opentdf/platform/issues/3814)) ([b81da1e](https://github.com/opentdf/platform/commit/b81da1eea030e75925187a2d6b11bcc763f67d60))
+
+
+### Bug Fixes
+
+* **cli:** drop the encrypt-side stdin spool ([#3948](https://github.com/opentdf/platform/issues/3948)) ([5603c2e](https://github.com/opentdf/platform/commit/5603c2eca9a445eb58b974df393b64adb4d36635))
+* **cli:** DSPX-4168 allow Linux profile authentication ([#4235](https://github.com/opentdf/platform/issues/4235)) ([118e11c](https://github.com/opentdf/platform/commit/118e11ca8b90e0e2abbac2c66a1eb56c3cedb0e1))
+* **cli:** validate endpoint before profile creation ([#4130](https://github.com/opentdf/platform/issues/4130)) ([a2f1327](https://github.com/opentdf/platform/commit/a2f1327aa6358b55c65d3a50bd73ab0ec28b6014))
+* **deps:** bump github.com/opentdf/platform/protocol/go from 0.41.0 to 0.42.0 in /otdfctl ([#4226](https://github.com/opentdf/platform/issues/4226)) ([5580481](https://github.com/opentdf/platform/commit/5580481f5a13a1c6882a20cf4f13bf9c6d3133b9))
+* **deps:** bump github.com/opentdf/platform/sdk from 0.33.0 to 0.35.0 in /otdfctl ([#4230](https://github.com/opentdf/platform/issues/4230)) ([562a937](https://github.com/opentdf/platform/commit/562a93795648197a08e1193a1812ae0d5e370f0e))
+* **deps:** bump SDK from v0.32.0 to v0.33.0 in /otdfctl ([#4110](https://github.com/opentdf/platform/issues/4110)) ([87dcf1c](https://github.com/opentdf/platform/commit/87dcf1c848ec392a39509609b04f321888fb0609))
+* **policy:** reject concurrent and non-active key rotations ([#4200](https://github.com/opentdf/platform/issues/4200)) ([5679545](https://github.com/opentdf/platform/commit/567954501feaa7d380b6579dc1747fec27667f31))
+
 ## [0.38.0](https://github.com/opentdf/platform/compare/otdfctl/v0.37.0...otdfctl/v0.38.0) (2026-09-22)
 
 
diff --git a/otdfctl/pkg/config/config.go b/otdfctl/pkg/config/config.go
index d3f982dd90..e78f06b7a1 100644
--- a/otdfctl/pkg/config/config.go
+++ b/otdfctl/pkg/config/config.go
@@ -8,7 +8,7 @@ var (
 	// config file naming and in the profile store
 	AppName = "otdfctl"
 
-	Version   = "0.38.0" // x-release-please-version
+	Version   = "0.39.0" // x-release-please-version
 	BuildTime = "1970-01-01T00:00:00Z"
 	CommitSha = "0000000"