diff --git a/CHANGELOG.md b/CHANGELOG.md
index 987911f22..808ca503b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,10 @@
 Unreleased
 ----------
-- [Patch] Validate host param in generated HomeController template to prevent open redirect
-- [Patch] Fix sorbet errors in generated webhook handlers
+
+23.0.2 (May 22, 2026)
+----------
+- Validate host param in generated HomeController template to prevent open redirect [#2059](https://github.com/Shopify/shopify_app/pull/2059)
+- Fix sorbet errors in generated webhook handlers [#2047](https://github.com/Shopify/shopify_app/pull/2047)
 
 23.0.1 (December 22, 2025)
 - Fix engine initialization [#2040](https://github.com/Shopify/shopify_app/pull/2040)
diff --git a/Gemfile.lock b/Gemfile.lock
index 95eaf8f8e..4dc4120fa 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_app (23.0.1)
+    shopify_app (23.0.2)
       addressable (~> 2.7)
       rails (>= 7.1, < 9)
       redirect_safely (~> 1.0)
diff --git a/lib/shopify_app/version.rb b/lib/shopify_app/version.rb
index f5b9f3751..d1016274e 100644
--- a/lib/shopify_app/version.rb
+++ b/lib/shopify_app/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShopifyApp
-  VERSION = "23.0.1"
+  VERSION = "23.0.2"
 end
diff --git a/package.json b/package.json
index cf8c50cbe..1045f87d9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "shopify_app",
-  "version": "23.0.1",
+  "version": "23.0.2",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",