diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,13 @@
+### 0.2.1.6
+
+_2026-08-13, Simon Jakobi_
+
+* Fix validation of the fourth byte of four-byte UTF-8 sequences (#80).
+* Fix the license identifier to say `GPL-2.0-or-later` instead of `GPL-2`
+  (aka `GPL-2.0-only`) (#81, #82).
+  Consequently, `cabal-version` is bumped to 2.2.
+* Tested with GHC 8.0 - 9.14.
+
 ### 0.2.1.5
 
 _2025-03-11, Andreas Abel_
diff --git a/HsYAML.cabal b/HsYAML.cabal
--- a/HsYAML.cabal
+++ b/HsYAML.cabal
@@ -1,12 +1,11 @@
-cabal-version:       1.14
+cabal-version:       2.2
 name:                HsYAML
-version:             0.2.1.5
+version:             0.2.1.6
 
 synopsis:            Pure Haskell YAML 1.2 processor
 homepage:            https://github.com/haskell-hvr/HsYAML
 bug-reports:         https://github.com/haskell-hvr/HsYAML/issues
-license:             GPL-2
-X-SPDX-License-Identifier: GPL-2.0-or-later
+license:             GPL-2.0-or-later
 license-files:       LICENSE.GPLv2 LICENSE.GPLv3
 author:              Herbert Valerio Riedel
 maintainer:          https://github.com/haskell-hvr/HsYAML
@@ -15,10 +14,11 @@
 category:            Text
 build-type:          Simple
 tested-with:
-  GHC == 9.12.1
-  GHC == 9.10.1
+  GHC == 9.14.1
+  GHC == 9.12.2
+  GHC == 9.10.2
   GHC == 9.8.4
-  GHC == 9.6.6
+  GHC == 9.6.7
   GHC == 9.4.8
   GHC == 9.2.8
   GHC == 9.0.2
@@ -46,7 +46,7 @@
    .
    See also the <//hackage.haskell.org/package/HsYAML-aeson HsYAML-aeson> package which allows to decode and encode YAML by leveraging @aeson@'s 'FromJSON' and 'ToJSON' instances.
 
-extra-source-files:
+extra-doc-files:
   ChangeLog.md
 
 source-repository head
@@ -145,9 +145,7 @@
                  , base
                  , text
                  , containers
-                 , mtl
                    -- non-inherited
                    -- lower bounds chosen from lts-11.22 (GHC 8.2)
-                 , QuickCheck       >= 2.10.1   && < 2.16
                  , tasty            >= 1.0.1.1  && < 1.6
                  , tasty-quickcheck >= 0.9.2    && < 1
diff --git a/src/Data/YAML/Token/Encoding.hs b/src/Data/YAML/Token/Encoding.hs
--- a/src/Data/YAML/Token/Encoding.hs
+++ b/src/Data/YAML/Token/Encoding.hs
@@ -247,7 +247,7 @@
 decodeFourUTF8 first offset (second:third:fourth:rest)
   | second < 0x80 || 0xBF < second = error "UTF-8 quad byte char has invalid second byte"
   | third  < 0x80 || 0xBF < third  = error "UTF-8 quad byte char has invalid third byte"
-  | third  < 0x80 || 0xBF < third  = error "UTF-8 quad byte char has invalid fourth byte"
+  | fourth  < 0x80 || 0xBF < fourth  = error "UTF-8 quad byte char has invalid fourth byte"
   | otherwise                      = (offset', c) : undoUTF8' rest offset'
   where
     !offset' = offset + 4