diff --git a/.changeset/web-binding-cookie-only.md b/.changeset/web-binding-cookie-only.md
deleted file mode 100644
index 31db541..0000000
--- a/.changeset/web-binding-cookie-only.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@seamless-auth/react': minor
----
-
-`AuthProvider` is cookie transport only. Its `transport` prop no longer accepts `mode` or `tokenStorage`, and passing `mode: 'bearer'` throws, so in a browser the tokens stay with the server adapter in `httpOnly` cookies and a script on the page can never read them. `basePath`, `fetch` and `trustedOrigins` are unchanged. Native apps that need bearer transport use `@seamless-auth/react-native`, which is unaffected. No first-party template, the admin console or RoxTarget used bearer mode from `@seamless-auth/react`.
diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
index 683d3b0..a871e3c 100644
--- a/packages/react/CHANGELOG.md
+++ b/packages/react/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @seamless-auth/react
 
+## 0.18.0
+
+### Minor Changes
+
+- 9847d05: `AuthProvider` is cookie transport only. Its `transport` prop no longer accepts `mode` or `tokenStorage`, and passing `mode: 'bearer'` throws, so in a browser the tokens stay with the server adapter in `httpOnly` cookies and a script on the page can never read them. `basePath`, `fetch` and `trustedOrigins` are unchanged. Native apps that need bearer transport use `@seamless-auth/react-native`, which is unaffected. No first-party template, the admin console or RoxTarget used bearer mode from `@seamless-auth/react`.
+
 ## 0.17.1
 
 ### Patch Changes
diff --git a/packages/react/package.json b/packages/react/package.json
index 6d4d396..1ff867c 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "description": "A drop-in authentication solution for modern React applications.",
   "type": "module",
   "exports": {