diff --git a/README.md b/README.md
index 9b60def..dc214b6 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ A post-quantum encrypted channel for zero-knowledge pipelines: a pairwise handsh
 
 **Constant-binding domains.** One envelope circuit serves both families: the payload domain is an input the app writes into its record, and each family pins it with `bind_const` (a noir-zk layout entry the kernel enforces). The sender doesn't choose the domain, two envelopes of one pipeline never share a keystream, and a pipeline folding the circuit twice under one domain is refused at build. Another payload (another domain string) is another family over the same frozen key.
 
-This freeze's roots (`zk-encryption@0.1.2`: `channel_session` 1.1.0, `channel_envelope` 1.0.0; noir 1.0.0-rc.3, bb 7.0.0-nightly.20260927, noir-zk 0.3.0): see `measurements.json` for the gates and the release's `catalog.json` for the roots and layouts.
+This freeze's roots (`zk-encryption@0.1.3`: `channel_session` 1.1.0, `channel_envelope` 1.0.0; noir 1.0.0-rc.3, bb 7.0.0-nightly.20260927, noir-zk 0.3.0): see `measurements.json` for the gates and the release's `catalog.json` for the roots and layouts.
 
 ## Receiver flow
 
diff --git a/mise.toml b/mise.toml
index 4935ef4..7e9f923 100644
--- a/mise.toml
+++ b/mise.toml
@@ -14,7 +14,7 @@ NOIR_VERSION = "1.0.0-rc.3"
 BB_VERSION = "7.0.0-nightly.20260927"
 # noir-zk (registries, codegen, the generic kernels) from crates.io;
 # rust/Cargo.toml pins the same version.
-NOIR_ZK_VERSION = "0.3.0"
+NOIR_ZK_VERSION = "0.3.3"
 # Per-version toolchain directories: this repository never replaces the
 # nargo or bb other projects use from ~/.nargo and ~/.bb.
 NARGO_HOME = "{{env.HOME}}/.toolchains/noir-{{env.NOIR_VERSION}}"
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 44079b2..ffff1c5 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -971,9 +971,9 @@ dependencies = [
 
 [[package]]
 name = "noir-zk-backend"
-version = "0.3.0"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eb67f284245690f87732dc983dc86b302339bb2e55c3e1cfe6520c5d2eb536d"
+checksum = "edc2f00dac0942afb6dd6281857101adbed6d8a39c78562f40edc21a557f04a6"
 dependencies = [
  "acir",
  "acvm",
@@ -995,23 +995,27 @@ dependencies = [
 
 [[package]]
 name = "noir-zk-codegen"
-version = "0.3.0"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6b989d788696e32fe71dc56c628d44355149d5f6ff14f8c5a524e59d377c72b"
+checksum = "ee1717923eea8c2bf18568f79908fc4ddeffa1aa8235220e1e657b074d41cdc0"
 dependencies = [
  "hex",
  "noir-zk-core",
  "noir-zk-kernels",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
  "serde_json",
  "sha2 0.10.9",
+ "syn 3.0.6",
  "toml 0.9.12+spec-1.1.0",
 ]
 
 [[package]]
 name = "noir-zk-core"
-version = "0.3.0"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9362e048fb6615f247bd3990c06f3d3489ba7319dcb657efa25250918195540"
+checksum = "de4caf35cd5ff9f2ad255a03e932099ac12eda64dcffffdca61ba7126be9713f"
 dependencies = [
  "ark-bn254",
  "ark-ff",
@@ -1020,9 +1024,9 @@ dependencies = [
 
 [[package]]
 name = "noir-zk-kernels"
-version = "0.3.0"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f65e1f4c4add7de04e57af2eb7f1ee573cb6a5d9a4496f3a032998855aba4f"
+checksum = "c426962f3d5ad568094e46288f13cc2c78f3a77e2f12152ad041f5fc8ef48b73"
 dependencies = [
  "hex",
  "noir-zk-core",
@@ -1148,6 +1152,16 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "prettyplease"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
+dependencies = [
+ "proc-macro2",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "primefield"
 version = "0.14.0"
diff --git a/rust/zk-encryption-circuits/Cargo.toml b/rust/zk-encryption-circuits/Cargo.toml
index bc8b711..b9adb18 100644
--- a/rust/zk-encryption-circuits/Cargo.toml
+++ b/rust/zk-encryption-circuits/Cargo.toml
@@ -9,8 +9,8 @@ publish.workspace = true
 repository.workspace = true
 
 [dependencies]
-noir-zk-core = "=0.3.0"
-noir-zk-backend = { version = "=0.3.0", features = ["packs", "http"] }
+noir-zk-core = "=0.3.3"
+noir-zk-backend = { version = "=0.3.3", features = ["packs", "http"] }
 zk-encryption = { path = "../zk-encryption", version = "0.1.0" }
 serde_json = "1"
 sha3 = "0.10"
@@ -19,7 +19,7 @@ hex = "0.4"
 toml = "1"
 
 [build-dependencies]
-noir-zk-codegen = "=0.3.0"
+noir-zk-codegen = "=0.3.3"
 
 [features]
 serde = ["zk-encryption/serde"]
diff --git a/rust/zk-encryption-circuits/README.md b/rust/zk-encryption-circuits/README.md
index b3470e5..22f7a1f 100644
--- a/rust/zk-encryption-circuits/README.md
+++ b/rust/zk-encryption-circuits/README.md
@@ -4,7 +4,7 @@ The post-quantum channel as one building block for noir-zk pipelines: the circui
 
 ## What the layer is
 
-**Circuits** (`circuits/manifest.toml`, frozen by `noir-zk freeze --library zk-encryption@0.1.2`, bytecode bundled: no packs, no download):
+**Circuits** (`circuits/manifest.toml`, frozen by `noir-zk freeze --library zk-encryption@0.1.3`, bytecode bundled: no packs, no download):
 
 | family | circuit | record | what it does |
 |---|---|---|---|
diff --git a/rust/zk-encryption-circuits/circuits/manifest.toml b/rust/zk-encryption-circuits/circuits/manifest.toml
index a184f6d..a9f2099 100644
--- a/rust/zk-encryption-circuits/circuits/manifest.toml
+++ b/rust/zk-encryption-circuits/circuits/manifest.toml
@@ -5,7 +5,7 @@ bb = "7.0.0-nightly.20260927"
 
 [library]
 name = "zk-encryption"
-version = "0.1.2"
+version = "0.1.3"
 
 [[circuit]]
 label = "channel_envelope"