diff --git a/CHANGELOG.md b/CHANGELOG.md
index beb4bd5..1734e30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,10 +4,16 @@ All notable changes to Primora. Format follows [Keep a Changelog](https://keepac
 
 ## [Unreleased]
 
+## [0.8.3] - 2026-09-28
+
 ### Added
 
 - **Install script asks for the public URL** — `install.sh` now prompts for where you'll open the app and accepts a full URL: `https://primora.example.com` (TLS at your proxy, hints printed at the end), `primora.example.com`, or `192.168.1.50:8085` (the port becomes `NGINX_PORT`). The answer rewrites every public URL var in `.env` and `COOKIE_DOMAIN` for real DNS names. The prompt reads the controlling terminal so it appears under `curl | bash`; no tty (CI, cron) falls back to `localhost`. Non-interactive via `PUBLIC_URL=`; legacy `DOMAIN`/`NGINX_PORT` envs still work; reruns over an existing `.env` skip the question.
 
+### Fixed
+
+- **Auth origins behind external TLS terminators** — trusted origins now accept both URL schemes on the serving host. Verified live over a Cloudflare quick tunnel: a real browser session cookie + `https://*.trycloudflare.com` origin was 403'd on v0.8.2 (nginx reports `X-Forwarded-Proto: http` inbound); the same request now signs in cleanly while cross-site origins still 403.
+
 ## [0.8.2] - 2026-09-28
 
 ### Fixed
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 0d8b9de..cf77564 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@primora/desktop",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "private": true,
   "description": "Primora desktop shell — thin Tauri client for a self-hosted deployment",
   "scripts": {
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index 94d73b1..d9a1c95 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Primora",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "identifier": "dev.tdvorak.primora",
   "build": {
     "frontendDist": "../ui"
diff --git a/package.json b/package.json
index d265877..61f7df5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "primora",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "private": true,
   "packageManager": "npm@9.2.0",
   "workspaces": [