diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4205148..872b6ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,33 @@
 
 All notable changes to Multi-Debrid Downloader are documented in this file.
 
+## [2.0.25] - 2026-08-12
+
+### Credential and application security
+
+- Encrypted persisted provider credentials with the operating system credential protection and migrated legacy plaintext values safely.
+- Removed provider secrets from renderer snapshots, account-check responses, settings backups, support diagnostics, and copied account details.
+- Added passphrase-protected local backup encryption while keeping legacy backup import available without writing the legacy format again.
+- Hardened Electron navigation, redirects, permissions, popup handling, remote-login windows, and IPC sender validation.
+- Restricted remote diagnostics to loopback by default, Bearer authentication, POST-only mutations, rate limiting, non-cacheable responses, and token-free support URLs.
+
+### Storage reliability
+
+- Added volume-aware capacity reservations before download writes, archive extraction, and media remux operations.
+- Accounted for concurrent reservations and a configurable safety margin so parallel work cannot overbook the same volume.
+- Parked capacity-blocked work without consuming regular retry attempts and exposed structured disk-wait state for automatic recovery.
+
+### Large queue performance
+
+- Virtualized package and file rows with fixed row heights and overscan to keep very large queues responsive.
+- Preserved logical range selection, select-all behavior, column dragging, context actions, expansion state, and inline renaming outside the rendered viewport.
+- Kept the existing scroll container and limited DOM work without adding another runtime dependency.
+
+### Status and reliability
+
+- Removed archive names from visible finalization progress in both German and English while retaining compact phase progress.
+- Added focused regression coverage for credential migration, backup encryption, Electron trust boundaries, diagnostics authentication, disk reservations, and virtualized download rows.
+
 ## [2.0.24] - 2026-08-11
 
 ### Download queue
diff --git a/README.md b/README.md
index 3eb9a70..f588914 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ Windows 10 or Windows 11 is required. Release executables are currently unsigned
 
 ## Highlights
 
-- Dense package queue with expandable file rows, search, filters, bulk selection, Shift range selection, and keyboard clearing with Escape.
+- Virtualized package queue with expandable file rows, search, filters, bulk selection, Shift range selection, and keyboard clearing with Escape.
 - RapidGator availability and file-size discovery before a download starts.
 - Package totals calculated from known link sizes and updated while links are checked.
 - Multi-account provider routing with configurable priority, hoster overrides, traffic limits, and automatic fallback.
diff --git a/package-lock.json b/package-lock.json
index 28b52cc..11e0689 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "real-debrid-downloader",
-  "version": "2.0.24",
+  "version": "2.0.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "real-debrid-downloader",
-      "version": "2.0.24",
+      "version": "2.0.25",
       "license": "MIT",
       "dependencies": {
         "adm-zip": "0.6.0",
diff --git a/package.json b/package.json
index 759ed98..ec70899 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "real-debrid-downloader",
-  "version": "2.0.24",
+  "version": "2.0.25",
   "description": "Desktop downloader",
   "main": "build/main/main/main.js",
   "author": "Sucukdeluxe",