diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,50 @@
 
 ## Unreleased
 
+## 0.13.0.0 — 2026-08-17
+
+### Breaking Changes
+
+- Requires `kiroku-store >=0.8 && <0.9` and
+  `kiroku-store-migrations ^>=0.4.0.0`, replacing `>=0.7 && <0.8` and
+  `^>=0.3.2.0`. `kiroku-store-migrations` 0.3.2.0 and 0.3.2.1 are deprecated on
+  Hackage.
+
+- **Kiroku migration `0010` has a corrected payload, and therefore a new
+  checksum.** `keiro-migrate` composes Kiroku's plan ahead of Keiro's, and
+  `pg-migrate` verifies the exact SHA-256 of each applied migration's payload,
+  so a database that already applied `0010` from `kiroku-store-migrations`
+  0.3.2.0 or 0.3.2.1 will fail every `keiro-migrate up` and `keiro-migrate
+  verify` with a `MigrationChecksumMismatch` until its ledger row is
+  re-baselined. Run Kiroku's
+  `ledger-fixups/2026-08-16-rebaseline-0010-checksum.sql` against such a
+  database once, before migrating; it rewrites that one checksum, is
+  idempotent, and touches no schema. Kiroku's forward migration `0011` then
+  converges the schema through the ordinary runner.
+
+  Which databases are affected, and which are not:
+
+  | Database | Needs the fixup |
+  |---|---|
+  | Applied `0010` under 0.3.2.x — every PostgreSQL 18 database, and a fresh PostgreSQL 17 install performed by 0.3.2.x | Yes, once, before the next `up` |
+  | Never reached `0010` — every ordinary PostgreSQL 17 upgrade, which is the path this Kiroku release fixes | No; `0010` is still pending there and applies from the corrected payload |
+  | Ephemeral or template test databases | No; they apply the whole plan from scratch |
+
+  For a data-bearing database, rehearse on a restored clone before touching
+  production, as `docs/user/upgrading-to-the-keiro-schema.md` describes for the
+  2026-07-05 realignment.
+
+### Bug Fixes
+
+- Picks up Kiroku BUG-1: migration `0010` no longer defaults
+  `history_retention_leases.lease_id` to an unqualified `uuidv7()`. `uuidv7()`
+  is a PostgreSQL 18 builtin; on PostgreSQL 17 the name came from the fallback
+  Kiroku's `0001` installs and was reachable only through the `search_path`
+  that `0001` itself sets, so `0010` parsed on a fresh install and failed with
+  SQLSTATE 42883 on every upgrade of a database already bootstrapped through
+  `0009`. Keiro's own suites run on PostgreSQL 18 and never observed this;
+  PostgreSQL 17 deployments did.
+
 ## 0.12.0.0 — 2026-08-14
 
 ### Breaking Changes
diff --git a/keiro-migrations.cabal b/keiro-migrations.cabal
--- a/keiro-migrations.cabal
+++ b/keiro-migrations.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               keiro-migrations
-version:            0.12.0.0
+version:            0.13.0.0
 synopsis:           Schema migrations for keiro
 description:
   Embedded PostgreSQL schema migrations and a migration runner for the Keiro
@@ -333,7 +333,7 @@
     , bytestring               >=0.11     && <0.13
     , containers               >=0.6      && <0.8
     , hasql                    >=1.10     && <1.11
-    , kiroku-store-migrations  ^>=0.3.2.0
+    , kiroku-store-migrations  ^>=0.4.0.0
     , pg-migrate               ^>=1.1.0.0
     , pg-migrate-embed         ^>=1.1.0.0
     , pg-migrate-import-codd   ^>=1.1.0.0
@@ -365,7 +365,7 @@
     , bytestring               >=0.11     && <0.13
     , hasql                    >=1.10     && <1.11
     , keiro-migrations
-    , kiroku-store-migrations  ^>=0.3.2.0
+    , kiroku-store-migrations  ^>=0.4.0.0
     , optparse-applicative     >=0.17     && <0.20
     , pg-migrate               ^>=1.1.0.0
     , pg-migrate-cli           ^>=1.1.0.0
@@ -405,7 +405,7 @@
     , hasql                    >=1.10     && <1.11
     , hspec                    >=2.10     && <2.12
     , keiro-migrations
-    , kiroku-store-migrations  ^>=0.3.2.0
+    , kiroku-store-migrations  ^>=0.4.0.0
     , pg-migrate               ^>=1.1.0.0
     , pg-migrate-import-codd   ^>=1.1.0.0
     , pg-migrate-test-support  ^>=1.1.0.0
@@ -438,8 +438,8 @@
     , hasql-pool               >=1.2      && <1.5
     , hspec                    >=2.10
     , keiro-migrations
-    , kiroku-store             >=0.7      && <0.8
-    , kiroku-store-migrations  ^>=0.3.2.0
+    , kiroku-store             >=0.8      && <0.9
+    , kiroku-store-migrations  ^>=0.4.0.0
     , lens                     >=5.2      && <5.4
     , temporary
     , text                     >=2.0      && <2.2
diff --git a/test/Main.hs b/test/Main.hs
--- a/test/Main.hs
+++ b/test/Main.hs
@@ -76,7 +76,7 @@
           ] -> do
             componentNameText kirokuName `shouldBe` "kiroku"
             kirokuDependencies `shouldBe` mempty
-            length kirokuEntries `shouldBe` 10
+            length kirokuEntries `shouldBe` 11
             componentNameText keiroName `shouldBe` "keiro"
             dependencyName <- requireRight (componentName "kiroku")
             keiroDependencies `shouldBe` Set.singleton dependencyName
@@ -183,7 +183,7 @@
             plan
             >>= requireRight
         Keiro.pendingMigrations handshake `shouldBe` planMigrationIds plan
-        length (Keiro.pendingMigrations handshake) `shouldBe` 40
+        length (Keiro.pendingMigrations handshake) `shouldBe` 41
         Keiro.ledgerIssues handshake `shouldBe` []
         handshakePassed handshake `shouldBe` False
 
@@ -208,7 +208,7 @@
         _ <- runMigrationPlan defaultRunOptions settings kirokuOnly >>= requireRight
         handshake <-
           missingMigrations defaultRunOptions provider plan >>= requireRight
-        Keiro.pendingMigrations handshake `shouldBe` drop 10 (planMigrationIds plan)
+        Keiro.pendingMigrations handshake `shouldBe` drop 11 (planMigrationIds plan)
         length (Keiro.pendingMigrations handshake) `shouldBe` 30
         Keiro.ledgerIssues handshake `shouldBe` []
         handshakePassed handshake `shouldBe` False
@@ -292,12 +292,12 @@
         assertSchema connection
         let provider = providerFor connection
         rerun <- runMigrationPlanWith defaultRunOptions provider plan >>= requireRight
-        reportOutcomes rerun `shouldBe` replicate 40 AlreadyApplied
+        reportOutcomes rerun `shouldBe` replicate 41 AlreadyApplied
         verified <- verifyMigrationPlanWith defaultRunOptions provider plan >>= requireRight
         case verified of
           VerificationReport verificationIssues applied pending unknown -> do
             verificationIssues `shouldBe` []
-            length applied `shouldBe` 40
+            length applied `shouldBe` 41
             pending `shouldBe` []
             unknown `shouldBe` []
       either (expectationFailure . show) pure result
@@ -346,7 +346,7 @@
             (runMigrationPlan defaultRunOptions settings plan >>= requireRight)
             (runMigrationPlan defaultRunOptions settings plan >>= requireRight)
         sort [reportOutcomes first, reportOutcomes second]
-          `shouldBe` sort [replicate 40 AppliedNow, replicate 40 AlreadyApplied]
+          `shouldBe` sort [replicate 41 AppliedNow, replicate 41 AlreadyApplied]
 
     it "upgrades singleton read-model rows into deterministic rebuild groups" $ do
       fullPlan <- requirePlan
@@ -365,7 +365,7 @@
         withConnection settings $ \connection ->
           useSession connection (Session.script legacyReadModelFixtureSql)
         report <- runMigrationPlan defaultRunOptions settings fullPlan >>= requireRight
-        Prelude.drop 31 (reportOutcomes report) `shouldBe` replicate 9 AppliedNow
+        Prelude.drop 32 (reportOutcomes report) `shouldBe` replicate 9 AppliedNow
         withConnection settings $ \connection -> do
           rows <- useSession connection (Session.statement () legacyGroupUpgradeStatement)
           rows
@@ -391,7 +391,7 @@
         withConnection settings $ \connection ->
           useSession connection (Session.script preCanonicalRebuildFixtureSql)
         report <- runMigrationPlan defaultRunOptions settings fullPlan >>= requireRight
-        Prelude.drop 33 (reportOutcomes report) `shouldBe` replicate 7 AppliedNow
+        Prelude.drop 34 (reportOutcomes report) `shouldBe` replicate 7 AppliedNow
         withConnection settings $ \connection -> do
           rows <- useSession connection (Session.statement () preCanonicalRebuildShapeStatement)
           rows
@@ -416,7 +416,7 @@
         withConnection settings $ \connection ->
           useSession connection (Session.script preStatusContractFixtureSql)
         report <- runMigrationPlan defaultRunOptions settings fullPlan >>= requireRight
-        Prelude.drop 35 (reportOutcomes report) `shouldBe` replicate 5 AppliedNow
+        Prelude.drop 36 (reportOutcomes report) `shouldBe` replicate 5 AppliedNow
         withConnection settings $ \connection -> do
           facts <- useSession connection (Session.statement () preStatusContractFactsStatement)
           facts `shouldBe` ("unmanaged", 0, "unmanaged", True, True)
@@ -439,7 +439,7 @@
           withConnection settings $ \connection ->
             useSession connection (Session.statement () guardFunctionOidStatement)
         report <- runMigrationPlan defaultRunOptions settings fullPlan >>= requireRight
-        Prelude.drop 39 (reportOutcomes report) `shouldBe` [AppliedNow]
+        Prelude.drop 40 (reportOutcomes report) `shouldBe` [AppliedNow]
         withConnection settings $ \connection -> do
           (afterOid, epochFenced, publicRevoked) <-
             useSession connection (Session.statement () upgradedGuardFactsStatement)
@@ -606,7 +606,7 @@
         up <- runMigrationPlan defaultRunOptions settings plan >>= requireRight
         reportOutcomes up
           `shouldBe` replicate 7 AlreadyApplied
-            <> replicate 3 AppliedNow
+            <> replicate 4 AppliedNow
             <> replicate 16 AlreadyApplied
             <> replicate 14 AppliedNow
 
@@ -977,14 +977,14 @@
     up <- runMigrationPlan defaultRunOptions settings plan >>= requireRight
     reportOutcomes up
       `shouldBe` replicate 7 AlreadyApplied
-        <> replicate 3 AppliedNow
+        <> replicate 4 AppliedNow
         <> replicate 16 AlreadyApplied
         <> replicate 14 AppliedNow
     verifiedAfterCanaries <- verifyMigrationPlan defaultRunOptions settings plan >>= requireRight
     case verifiedAfterCanaries of
       VerificationReport verificationIssues _ _ _ -> verificationIssues `shouldBe` []
     rerun <- runMigrationPlan defaultRunOptions settings plan >>= requireRight
-    reportOutcomes rerun `shouldBe` replicate 40 AlreadyApplied
+    reportOutcomes rerun `shouldBe` replicate 41 AlreadyApplied
     second <-
       importCoddHistory defaultImportOptions config provider plan frameworkCoddHistoryMappings
         >>= requireRight
@@ -994,7 +994,7 @@
       sourceRows <- useSession connection (Session.statement () (sourceRowCountStatement sourceSchema))
       sourceRows `shouldBe` 23
       facts <- useSession connection (Session.statement () importFactsStatement)
-      facts `shouldBe` (40, 23, True)
+      facts `shouldBe` (41, 23, True)
 
 postCoddImportPendingIssues :: IO [VerificationIssue]
 postCoddImportPendingIssues =
@@ -1007,6 +1007,7 @@
       [ ("kiroku", "0008-schema-management-comment"),
         ("kiroku", "0009"),
         ("kiroku", "0010"),
+        ("kiroku", "0011"),
         ("keiro", "0017-schema-management-comment"),
         ("keiro", "0018"),
         ("keiro", "0019-keiro-snapshots-state-shape-hash"),
@@ -1248,7 +1249,7 @@
       (to_regclass('keiro_read.projection_group_status_v1') IS NOT NULL),
       (obj_description(to_regnamespace('keiro_read'), 'pg_namespace') =
         'Versioned, owner-rights read contracts for out-of-process Keiro consumers.'),
-      (obj_description(to_regnamespace('kiroku'), 'pg_namespace') = 'Managed by pg-migrate component kiroku through 0010'),
+      (obj_description(to_regnamespace('kiroku'), 'pg_namespace') = 'Managed by pg-migrate component kiroku through 0011'),
       (obj_description(to_regnamespace('keiro'), 'pg_namespace') = 'Managed by pg-migrate component keiro through 0017-schema-management-comment')
     ) AS checks(ok)
     """
