diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0971688..2606a33 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.8] - 2026-06-20
+
+### Fixed
+
+- **Received attachments keep their original name and folder layout.** Files
+  were landing at `inbox/<distribution_id>/<basename>` — the original filename
+  buried under a UUID directory and any subdirectories flattened. The inbox now
+  mirrors the sender's outbox layout: a file dropped at `outbox/sub/report.pdf`
+  lands at `inbox/sub/report.pdf`, and re-delivery of the same path overwrites
+  (latest-wins). Sender-controlled names are re-sanitised on arrival (only
+  `Normal` path components accepted), so an absolute path or one containing `..`
+  can never escape the inbox — such a name falls back to a flat
+  `<distribution_id>.bin` at the inbox root. (#173)
+
 ### Added
 
 - **Startup version banner.** The first log line now reports peat-node's own
diff --git a/Cargo.lock b/Cargo.lock
index 1ab1583..731b383 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3959,7 +3959,7 @@ dependencies = [
 
 [[package]]
 name = "peat-node"
-version = "0.4.7"
+version = "0.4.8"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index bc08ba2..c6f13ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ resolver = "2"
 
 [package]
 name = "peat-node"
-version = "0.4.7"
+version = "0.4.8"
 edition = "2021"
 authors = ["Kit Plummer <kitplummer@defenseunicorns.com>"]
 license = "Apache-2.0"