diff --git a/.bumpy/npm-otp-env-var.md b/.bumpy/npm-otp-env-var.md
deleted file mode 100644
index 0787af1..0000000
--- a/.bumpy/npm-otp-env-var.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'fledgling': patch
----
-
-Read npm's own `NPM_CONFIG_OTP` env var as a fallback for `--otp`, so a 2FA code supplied that way also suppresses the interactive browser-approval prompt instead of fledgling assuming it still needs one. Docs now lead with npm's browser flow — approving with a passkey or security key is how most people will do this, and npm is moving away from authenticator codes — with the `--otp` / `--otp-secret` options kept but framed as the legacy fallback.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d68305d..c6bc0b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@
 
 
 
+
+## 1.2.2
+<sub>2026-07-30</sub>
+
+- [#12](https://github.com/dmno-dev/fledgling/pull/12)  *(patch)*
+  Read npm's own `NPM_CONFIG_OTP` env var as a fallback for `--otp`, so a 2FA code supplied that way also suppresses the interactive browser-approval prompt instead of fledgling assuming it still needs one. Docs now lead with npm's browser flow — approving with a passkey or security key is how most people will do this, and npm is moving away from authenticator codes — with the `--otp` / `--otp-secret` options kept but framed as the legacy fallback.
+
 ## 1.2.1
 <sub>2026-07-30</sub>
 
diff --git a/package.json b/package.json
index a0571fe..d48fe2c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fledgling",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "🐣 Hatch your new npm package safely - claim the name on npm and set up / sync trusted publishing settings, for one package or a whole monorepo.",
   "keywords": [
     "npm",