diff --git a/compatibility.json b/compatibility.json
index 9ff034c..9c97ef9 100644
--- a/compatibility.json
+++ b/compatibility.json
@@ -44,12 +44,13 @@
     {
       "evidence": [
         "auth_ci",
-        "auth_security"
+        "auth_security",
+        "auth_release"
       ],
       "golden": false,
       "name": "hayate-auth",
       "role": "Sessions, API keys, OAuth clients, and authorization server",
-      "version": "0.10.3"
+      "version": "0.10.4"
     },
     {
       "evidence": [
@@ -158,14 +159,19 @@
   "schema_version": 1,
   "sources": {
     "auth_ci": {
-      "commit": "20dd7ae08c12051d23fdbe4b242578f800dacdfc",
-      "label": "hayate-auth 0.10.3 main CI",
-      "url": "https://github.com/hayatepy/hayate-auth/actions/runs/30493342017"
+      "commit": "938751d0f225def770d6ae47e1da3da40829c8d1",
+      "label": "hayate-auth 0.10.4 main CI",
+      "url": "https://github.com/hayatepy/hayate-auth/actions/runs/30498321148"
+    },
+    "auth_release": {
+      "commit": "938751d0f225def770d6ae47e1da3da40829c8d1",
+      "label": "hayate-auth 0.10.4 release provenance",
+      "url": "https://github.com/hayatepy/hayate-auth/actions/runs/30498396435"
     },
     "auth_security": {
-      "commit": "20dd7ae08c12051d23fdbe4b242578f800dacdfc",
-      "label": "hayate-auth 0.10.3 security profiles",
-      "url": "https://github.com/hayatepy/hayate-auth/actions/runs/30493342021"
+      "commit": "938751d0f225def770d6ae47e1da3da40829c8d1",
+      "label": "hayate-auth 0.10.4 security profiles",
+      "url": "https://github.com/hayatepy/hayate-auth/actions/runs/30498321150"
     },
     "core_ci": {
       "commit": "9e27b0191c7fa9f920ad6fe5b126e190268afba2",
diff --git a/data/ecosystem.toml b/data/ecosystem.toml
index ff4fbca..d7c48fe 100644
--- a/data/ecosystem.toml
+++ b/data/ecosystem.toml
@@ -18,14 +18,19 @@ url = "https://github.com/hayatepy/golden-app/actions/runs/30494459938"
 commit = "cfa07c1d129b588b3c539a6d6c9fcdd443cefbf7"
 
 [sources.auth_ci]
-label = "hayate-auth 0.10.3 main CI"
-url = "https://github.com/hayatepy/hayate-auth/actions/runs/30493342017"
-commit = "20dd7ae08c12051d23fdbe4b242578f800dacdfc"
+label = "hayate-auth 0.10.4 main CI"
+url = "https://github.com/hayatepy/hayate-auth/actions/runs/30498321148"
+commit = "938751d0f225def770d6ae47e1da3da40829c8d1"
 
 [sources.auth_security]
-label = "hayate-auth 0.10.3 security profiles"
-url = "https://github.com/hayatepy/hayate-auth/actions/runs/30493342021"
-commit = "20dd7ae08c12051d23fdbe4b242578f800dacdfc"
+label = "hayate-auth 0.10.4 security profiles"
+url = "https://github.com/hayatepy/hayate-auth/actions/runs/30498321150"
+commit = "938751d0f225def770d6ae47e1da3da40829c8d1"
+
+[sources.auth_release]
+label = "hayate-auth 0.10.4 release provenance"
+url = "https://github.com/hayatepy/hayate-auth/actions/runs/30498396435"
+commit = "938751d0f225def770d6ae47e1da3da40829c8d1"
 
 [sources.mcp_ci]
 label = "hayate-mcp 0.12.0 main CI and conformance"
@@ -87,10 +92,10 @@ evidence = ["golden_app", "ecosystem_full"]
 
 [[packages]]
 name = "hayate-auth"
-version = "0.10.3"
+version = "0.10.4"
 role = "Sessions, API keys, OAuth clients, and authorization server"
 golden = false
-evidence = ["auth_ci", "auth_security"]
+evidence = ["auth_ci", "auth_security", "auth_release"]
 
 [[packages]]
 name = "hayate-fetch"
diff --git a/docs/COMPATIBILITY.md b/docs/COMPATIBILITY.md
index f679779..72c4b01 100644
--- a/docs/COMPATIBILITY.md
+++ b/docs/COMPATIBILITY.md
@@ -9,7 +9,7 @@ passing CI evidence. Do not edit it manually. The evidence snapshot is dated
 | Package | Version | Role | Production golden app | Evidence |
 |---|---:|---|---|---|
 | [`hayate`](https://github.com/hayatepy/hayate) | `0.15.1` | Core framework and native ASGI, Workers, and Lambda adapters | yes | [golden-app create-hayate 0.13.1 main CI](https://github.com/hayatepy/golden-app/actions/runs/30494459938), [Hayate 0.15.1 downstream full compatibility CI](https://github.com/hayatepy/hayate/actions/runs/30315289736) |
-| [`hayate-auth`](https://github.com/hayatepy/hayate-auth) | `0.10.3` | Sessions, API keys, OAuth clients, and authorization server | downstream gate | [hayate-auth 0.10.3 main CI](https://github.com/hayatepy/hayate-auth/actions/runs/30493342017), [hayate-auth 0.10.3 security profiles](https://github.com/hayatepy/hayate-auth/actions/runs/30493342021) |
+| [`hayate-auth`](https://github.com/hayatepy/hayate-auth) | `0.10.4` | Sessions, API keys, OAuth clients, and authorization server | downstream gate | [hayate-auth 0.10.4 main CI](https://github.com/hayatepy/hayate-auth/actions/runs/30498321148), [hayate-auth 0.10.4 security profiles](https://github.com/hayatepy/hayate-auth/actions/runs/30498321150), [hayate-auth 0.10.4 release provenance](https://github.com/hayatepy/hayate-auth/actions/runs/30498396435) |
 | [`hayate-fetch`](https://github.com/hayatepy/hayate-fetch) | `0.1.3` | Portable WHATWG-style outbound fetch | downstream gate | [Hayate 0.15.1 downstream full compatibility CI](https://github.com/hayatepy/hayate/actions/runs/30315289736) |
 | [`hayate-mcp`](https://github.com/hayatepy/hayate-mcp) | `0.12.0` | MCP transport, tools, context, and OAuth resource server | yes | [golden-app create-hayate 0.13.1 main CI](https://github.com/hayatepy/golden-app/actions/runs/30494459938), [hayate-mcp 0.12.0 main CI and conformance](https://github.com/hayatepy/hayate-mcp/actions/runs/30481675199), [hayate-mcp 0.12.0 release provenance](https://github.com/hayatepy/hayate-mcp/actions/runs/30481707512), FolioMCP production Workerd CI (private downstream evidence) at `a4d110efc223` |
 | [`hayate-openapi`](https://github.com/hayatepy/hayate-openapi) | `0.8.1` | OpenAPI 3.1, Scalar, and generated zero-runtime TypeScript clients | yes | [golden-app create-hayate 0.13.1 main CI](https://github.com/hayatepy/golden-app/actions/runs/30494459938), [hayate-openapi 0.8.1 main CI and TypeScript interoperability](https://github.com/hayatepy/hayate-openapi/actions/runs/30487122341), [hayate-openapi 0.8.1 release provenance](https://github.com/hayatepy/hayate-openapi/actions/runs/30487193584), FolioMCP production Workerd CI (private downstream evidence) at `a4d110efc223` |
@@ -54,8 +54,9 @@ Golden lock SHA-256: `400de843b728b759aafc6fa55f1a810021f4c08837dbc6677e33db1313
 ## Evidence sources
 
 - [golden-app create-hayate 0.13.1 main CI](https://github.com/hayatepy/golden-app/actions/runs/30494459938) at `cfa07c1d129b588b3c539a6d6c9fcdd443cefbf7`
-- [hayate-auth 0.10.3 main CI](https://github.com/hayatepy/hayate-auth/actions/runs/30493342017) at `20dd7ae08c12051d23fdbe4b242578f800dacdfc`
-- [hayate-auth 0.10.3 security profiles](https://github.com/hayatepy/hayate-auth/actions/runs/30493342021) at `20dd7ae08c12051d23fdbe4b242578f800dacdfc`
+- [hayate-auth 0.10.4 main CI](https://github.com/hayatepy/hayate-auth/actions/runs/30498321148) at `938751d0f225def770d6ae47e1da3da40829c8d1`
+- [hayate-auth 0.10.4 security profiles](https://github.com/hayatepy/hayate-auth/actions/runs/30498321150) at `938751d0f225def770d6ae47e1da3da40829c8d1`
+- [hayate-auth 0.10.4 release provenance](https://github.com/hayatepy/hayate-auth/actions/runs/30498396435) at `938751d0f225def770d6ae47e1da3da40829c8d1`
 - [hayate-mcp 0.12.0 main CI and conformance](https://github.com/hayatepy/hayate-mcp/actions/runs/30481675199) at `175e6ed85a5e9af3e2fd9fcbf8886594bd2f6723`
 - [hayate-mcp 0.12.0 release provenance](https://github.com/hayatepy/hayate-mcp/actions/runs/30481707512) at `175e6ed85a5e9af3e2fd9fcbf8886594bd2f6723`
 - [hayate-openapi 0.8.1 main CI and TypeScript interoperability](https://github.com/hayatepy/hayate-openapi/actions/runs/30487122341) at `2ed34215ec3dd5ebd0a0780f7b7903f0b3492a78`