diff --git a/CHANGELOG.md b/CHANGELOG.md
index 109f4ef..d019ccd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## v3.14.3 — 2026-10-18
+
+[GitHub release](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.3) ·
+[Changes since v3.14.2](https://github.com/pgsty/silo-pkg/compare/v3.14.2...v3.14.3)
+
+- Speed up `AdminAction.IsValid` and `HasResource` with exact lookups and
+  early rejection of patterns that cannot match. Preserve wildcard matching,
+  policy decisions, and bucket-scoped admin resource checks.
+- Add equivalence tests, a fuzz target, and a benchmark for policies with
+  many bucket grants. Independent alternating benchmarks measured about 82%
+  less policy-evaluation time in that scenario, with no additional allocations.
+- Keep public APIs, policy formats, dependencies, and the Go 1.26 library floor
+  unchanged. Server builds can adopt this optimization without requiring a
+  simultaneous mcli or standalone Console release.
+- Thanks to [Denis Babchuk (@botdeniska)](https://github.com/botdeniska) for
+  [PR #11](https://github.com/pgsty/silo-pkg/pull/11), and
+  [Klaus Post (@klauspost)](https://github.com/klauspost) for the original work.
+
 ## v3.14.2 — 2026-10-15
 
 [GitHub release](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.2) ·
diff --git a/README.md b/README.md
index f25a6aa..76c3939 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ collection of common packages used in MinIO projects. It exists so the
 community MinIO fork has somewhere to take fixes that upstream, now driven by a
 closed product, will not carry.
 
-Current release: [v3.14.2](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.2).
+Current release: [v3.14.3](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.3).
 Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/)
 before adopting the password-authorization changes introduced in v3.14.0.
 The matrix tracks which matching Server and Console releases include them.
@@ -16,7 +16,7 @@ Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v
 so a consumer requires it by name and needs no `replace` directive:
 
 ```go
-require github.com/pgsty/silo-pkg/v3 v3.14.2
+require github.com/pgsty/silo-pkg/v3 v3.14.3
 ```
 
 ```go