diff --git a/.github/actions/cask-audit/action.yml b/.github/actions/cask-audit/action.yml
index 27a768fef..f6a5b3c7e 100644
--- a/.github/actions/cask-audit/action.yml
+++ b/.github/actions/cask-audit/action.yml
@@ -11,8 +11,8 @@ inputs:
     required: true
   core:
     description: >
-      Generate the homebrew-cask core variant (drops the --no-quarantine hint,
-      which core rejects) instead of the tap variant.
+      Generate the homebrew-cask core variant (drops the command-line
+      quarantine workaround) instead of the tap variant.
     required: false
     default: 'false'
   audit-args:
@@ -52,6 +52,10 @@ runs:
         variant=""
         [ "$CORE" = "true" ] && variant="--core"
         bash scripts/gen-homebrew-cask.sh "$TAG" $variant > out/Casks/voltius.rb
+        if grep -q -- '--no-quarantine' out/Casks/voltius.rb; then
+          echo "::error::Generated cask uses Homebrew's removed --no-quarantine option"
+          exit 1
+        fi
         cat out/Casks/voltius.rb
 
     - name: Style and audit
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41324b819..b16ac06de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,15 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.30.0] - 2026-08-24
+
 ### Added
 
-- Cloud sync is now yours to choose, group by group and setting by setting.
-  Settings → Sync gains a switch per group — themes, interface, shortcuts,
-  app settings, recent people — and each individual setting gains a cloud
-  button in its row's hover controls, so a single value can stay on this
-  device without switching its whole group off. A held-back value never enters
-  the uploaded backup, and a copy already on the server is withdrawn when you
-  switch the setting off. Each group also lists what it is keeping local, which is the
+- Your settings are now yours to sync group by group and setting by setting.
+  Settings → Sync gains a second block, "Settings", below the existing Sync
+  Preferences block that already governed hosts, identities, keys and the rest.
+  It carries one switch per group — Themes, Interface, Shortcuts, App settings,
+  Recent people — and each individual setting gains a cloud button in its own
+  row's hover controls, so a single value can stay on this device without
+  switching its whole group off. A held-back value never enters the uploaded
+  backup, and a copy already on the server is withdrawn when you switch the
+  setting off. Each group also lists what it is keeping local, which is the
   only control for the handful of settings that have no row of their own.
 - The default shell is no longer synced unless you ask for it. A shell path is
   wrong on another machine by construction, so it is now device-scoped: it
@@ -26,11 +30,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   the uploaded backup — and out of any third-party sync destination, such as
   the gist-sync plugin — until you opt it in from the cloud button beside the
   latitude and longitude fields.
-- Snippets now have their own cloud sync switch. Settings → Sync gains a
-  Snippets row alongside hosts, identities, keys, folders and port forwarding,
-  so the whole collection can stay off the backup — individual snippets could
-  already be excluded one at a time from their card. Switching Folders off now
-  also stops snippet folders syncing, which is what their cards already showed.
+- Snippets now have their own cloud sync switch. The Sync Preferences block
+  gains a Snippets row alongside Hosts, Identities, SSH Keys, Folders and Port
+  Forwarding, so the whole collection can stay off the backup — individual
+  snippets could already be excluded one at a time from their card. Switching
+  Folders off now also stops snippet folders syncing, which is what their cards
+  already showed.
+- Terminal font size is now a setting of its own in Appearance, overriding the
+  active theme, where before changing it meant cloning a theme or scaling the
+  whole UI. On mobile a two-finger pinch on the terminal drives the same value.
+  It stays on this device — a size that reads well on a phone does not read
+  well on a desktop — so it is never synced.
 
 ### Changed
 
@@ -49,6 +59,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   collision in a panel that also has a Shortcuts group — and the same word was
   used for terminal panes; both now say what they mean. "Недавние люди" became
   "Недавние контакты", which is what the counts beside it already said.
+- Pasting went to the wrong terminal. With more than one terminal on screen,
+  the paste landed in whichever session the pane had opened last rather than
+  the one that received the keystroke.
+- Your own tmux works inside a persistent session again. A persistent session
+  wraps the remote shell in Voltius's own tmux, and that wrapper leaked its
+  socket and its `C-b` prefix into the shell: `tmux ls` listed Voltius's
+  private sessions instead of yours, `tmux attach` refused to nest at all, and
+  a forced nest lost every prefix key. The wrapper now clears the multiplexer
+  environment and gives up its prefix. The fix reaches new sessions; a session
+  started before this release keeps the old wrapper until it is restarted.
+- On a host that has screen but not tmux, the wrapper no longer swallows
+  `C-a`. A bare `C-a d` inside your own nested screen detached Voltius's
+  session instead, closing the connection and reconnecting underneath you.
+- Duplicating a session no longer lands in your home directory when the
+  original's working directory has since been deleted. The directory probe
+  read the kernel's `<path> (deleted)` form verbatim, so the duplicate's `cd`
+  could never succeed; it now falls back to the nearest directory that still
+  exists. The same stale path also reached the stored working directory and
+  the file panel's follow-cwd.
+- Exporting or deploying a key whose public half was never stored no longer
+  fails with "Public key not found". The public half is derived from the
+  private key instead.
 
 ## [0.29.0] - 2026-08-20
 
diff --git a/Cargo.lock b/Cargo.lock
index eb6133b3d..6f5b6743e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7679,7 +7679,7 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "voltius"
-version = "0.29.0"
+version = "0.30.0"
 dependencies = [
  "aes 0.9.0",
  "apple-native-keyring-store",
diff --git a/README.md b/README.md
index ad90879da..c1a49d927 100644
--- a/README.md
+++ b/README.md
@@ -95,18 +95,16 @@ brew install --cask voltiusapp/voltius/voltius
 
 Voltius is ad-hoc signed but not yet notarized (no Apple Developer account yet).
 If macOS Gatekeeper blocks the first launch, right-click the app and choose
-**Open**, or install with `--no-quarantine`:
+**Open**. To clear the quarantine flag from an existing installation instead,
+run:
 
 ```sh
-brew install --cask --no-quarantine voltiusapp/voltius/voltius
+xattr -dr com.apple.quarantine /Applications/Voltius.app
 ```
 
 If you download the `.dmg` directly and macOS says **"Voltius.app is damaged and
-cannot be opened"**, the download was quarantined — clear the flag and launch again:
-
-```sh
-xattr -cr /Applications/Voltius.app
-```
+cannot be opened"**, the same command clears the quarantine flag after you copy
+Voltius to Applications.
 
 ### Windows — winget
 
diff --git a/package.json b/package.json
index e1f60c73b..7f640d43c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "voltius",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "packageManager": "pnpm@11.5.2",
   "type": "module",
   "scripts": {
diff --git a/scripts/gen-homebrew-cask.sh b/scripts/gen-homebrew-cask.sh
index c03983633..980022141 100755
--- a/scripts/gen-homebrew-cask.sh
+++ b/scripts/gen-homebrew-cask.sh
@@ -5,11 +5,9 @@
 #   e.g. gen-homebrew-cask.sh v0.4.0
 #
 #   --core  emit the variant intended for a homebrew-cask *core* submission
-#           rather than for the VoltiusApp/homebrew-voltius tap. Core rejects
-#           casks whose caveats tell the user to reinstall with
-#           --no-quarantine, so that hint is dropped there; the right-click
-#           Open instructions stay, which core does accept for an app that is
-#           ad-hoc signed but not notarized.
+#           rather than for the VoltiusApp/homebrew-voltius tap. The tap gives
+#           an optional command for clearing the quarantine flag; core keeps
+#           only the accepted right-click Open instructions.
 #
 # Requires: gh (authenticated), awk. Reads the .dmg.sha256 release assets.
 set -euo pipefail
@@ -27,8 +25,8 @@ if [ "$VARIANT" = "--core" ]; then
   QUARANTINE_HINT=""
 else
   QUARANTINE_HINT="
-    To skip the warning entirely, install with:
-      brew install --cask --no-quarantine voltiusapp/voltius/voltius
+    To clear the quarantine flag from an existing installation instead, run:
+      xattr -dr com.apple.quarantine /Applications/Voltius.app
 "
 fi
 
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 259f3d980..aab75f435 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "voltius"
-version = "0.29.0"
+version = "0.30.0"
 description = "Open-Source SSH & SFTP Client"
 authors = ["Voltius Contributors"]
 edition = "2021"
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 6db964724..fdca056d1 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,6 +1,6 @@
 {
   "productName": "Voltius",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "identifier": "com.voltius.app",
   "build": {
     "beforeDevCommand": "pnpm dev",