diff --git a/CHANGELOG.md b/CHANGELOG.md
index ecf9df9..c49ed3d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## v1.0.1
+
+- README: the API URL note now names only the public `https://<org>.app.dstl8.ai`
+  host. No change to the action's behavior.
+- Repository: SOC 2 change-management protection on `main` (pull request with one
+  approving review, no force-push or deletion) and a pull-request template.
+
 ## v1.0.0
 
 - First public release: `dstl8 graph push` from GitHub Actions.
diff --git a/README.md b/README.md
index 678f4fc..b4460b1 100644
--- a/README.md
+++ b/README.md
@@ -46,10 +46,9 @@ jobs:
           token: ${{ secrets.DSTL8_API_TOKEN }}
 ```
 
-The API URL is the address you use for your org's Dstl8 API. Most orgs are
-`https://<org>.app.dstl8.ai`. If your org lives elsewhere (for example
-`https://<org>.wd.dstl8.ai`), use that host. A wrong host returns an HTML 404,
-not an auth error.
+The API URL is your org's Dstl8 API address, `https://<org>.app.dstl8.ai`.
+A wrong host returns an HTML 404, not an auth error, so check it first if
+pushes fail.
 
 ## Inputs