diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d822ed..5f6edd8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
 env:
   # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
   BUILD_TYPE: Release
-  version: osslsigncode-2.11-dev
+  version: osslsigncode-2.11
 
 jobs:
   build:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8a640ea..e3891cb 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -10,13 +10,13 @@ set(BUILTIN_SOCKET ON CACHE BOOL "") # for static Python
 
 # configure basic project information
 project(osslsigncode
-    VERSION 2.10
+    VERSION 2.11
     DESCRIPTION "OpenSSL based Authenticode signing for PE, CAB, CAT, MSI, APPX and script files"
     HOMEPAGE_URL "https://github.com/mtrojnar/osslsigncode"
     LANGUAGES C)
 
 # force nonstandard version format for development packages
-set(DEV "-dev")
+set(DEV "")
 set(PROJECT_VERSION "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}${DEV}")
 
 # version and contact information
diff --git a/NEWS.md b/NEWS.md
index 4890978..ace590f 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,6 +1,14 @@
 # osslsigncode change log
 
-### 2.11 (unreleased)
+### 2.11 (2026.01.20)
+- added keyUsage validation for signer certificate
+  (thanks to Hanqing Zhao and Zi-Quan You for reporting the issue)
+- added printing CRL details during signature verification
+- implemented a workaround for CRL servers returning the HTTP Content-Type
+  header other than application/pkix-crl (thanks to Chris Thibodeaux)
+- fixed HTTP keep-alive handling
+- fixed macOS compiler and linker flags
+- fixed undefined BIO_get_fp() behavior with BIO_FLAGS_UPLINK_INTERNAL
 
 ### 2.10 (2025.06.23)