diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 52ffe5a..7b0cc97 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.74.0"
+  ".": "0.75.0"
 }
diff --git a/.stats.yml b/.stats.yml
index 0297d26..70c2c4f 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ebbe079bb2542625826422afd876a3e8b499c579cf45efc5fd50e7982d34df7d.yml
-openapi_spec_hash: db850b61a0d71fe9f4b642df8782d7ae
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4395690aa03bf5e2482d60132f7eebdbf88265af3d53098789f6c2f3c623d769.yml
+openapi_spec_hash: ad7c56d655a6e3899532caa4588a02b7
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 689aff5..6bf96db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.75.0 (2026-07-07)
+
+Full Changelog: [v0.74.0...v0.75.0](https://github.com/kernel/kernel-node-sdk/compare/v0.74.0...v0.75.0)
+
+### Features
+
+* Document env var redaction on deployment and app reads ([aff324f](https://github.com/kernel/kernel-node-sdk/commit/aff324f5a779b188da8a3ab1f7d18726b35a2853))
+* Reject API key self-deletion ([9cac0f1](https://github.com/kernel/kernel-node-sdk/commit/9cac0f1dc231364362b3b1f7f9a0f48259205864))
+* Revert "Store and return a sha256 checksum for uploaded extensions (#… ([4b702a9](https://github.com/kernel/kernel-node-sdk/commit/4b702a92fd902bdf6b259e194a81e3ef0857149f))
+* Store and return a sha256 checksum for uploaded extensions ([44b2c99](https://github.com/kernel/kernel-node-sdk/commit/44b2c99671cef89a61e2f84e734eb8800351bb20))
+
+
+### Documentation
+
+* **api:** clarify reuse/discard_all_idle pool config staleness ([83fd84c](https://github.com/kernel/kernel-node-sdk/commit/83fd84c9c88bb7764fe8f7fdfba0523485906a2c))
+
 ## 0.74.0 (2026-07-06)
 
 Full Changelog: [v0.73.0...v0.74.0](https://github.com/kernel/kernel-node-sdk/compare/v0.73.0...v0.74.0)
diff --git a/package.json b/package.json
index 6ee8ffa..d020614 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",
diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts
index 60b41f5..a82e2c3 100644
--- a/src/resources/api-keys.ts
+++ b/src/resources/api-keys.ts
@@ -75,7 +75,8 @@ export class APIKeys extends APIResource {
   }
 
   /**
-   * Delete an API key.
+   * Delete an API key. A key cannot delete itself; use a different key to delete
+   * this one.
    *
    * @example
    * ```ts
diff --git a/src/resources/apps.ts b/src/resources/apps.ts
index 915193d..c6710c9 100644
--- a/src/resources/apps.ts
+++ b/src/resources/apps.ts
@@ -47,7 +47,9 @@ export interface AppListResponse {
   deployment: string;
 
   /**
-   * Environment variables configured for this app version
+   * Environment variables configured for this app version. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars: { [key: string]: string };
 
diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts
index 2cc6a0e..f157c72 100644
--- a/src/resources/browser-pools.ts
+++ b/src/resources/browser-pools.ts
@@ -581,8 +581,12 @@ export interface BrowserPoolUpdateParams {
   chrome_policy?: { [key: string]: unknown };
 
   /**
-   * Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-   * to false.
+   * Whether to discard all idle browsers and rebuild them immediately with the new
+   * configuration. Defaults to false. Only browsers that are idle when the update
+   * runs are rebuilt. A browser that is in use during the update keeps its original
+   * configuration, and if it is later released with `reuse: true` it returns to the
+   * pool with that stale configuration until it is discarded (by this flag on a
+   * later update, or by flushing the pool).
    */
   discard_all_idle?: boolean;
 
@@ -752,7 +756,10 @@ export interface BrowserPoolReleaseParams {
 
   /**
    * Whether to reuse the browser instance or destroy it and create a new one.
-   * Defaults to true.
+   * Defaults to true. A reused browser keeps the configuration it was created with,
+   * so it does not pick up pool configuration changes made while it was in use.
+   * Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+   * current configuration.
    */
   reuse?: boolean;
 }
diff --git a/src/resources/deployments.ts b/src/resources/deployments.ts
index a389f8b..597dad2 100644
--- a/src/resources/deployments.ts
+++ b/src/resources/deployments.ts
@@ -159,7 +159,9 @@ export namespace DeploymentStateEvent {
     entrypoint_rel_path?: string;
 
     /**
-     * Environment variables configured for this deployment
+     * Environment variables configured for this deployment. Values are redacted for
+     * API key, OAuth, and managed-auth callers, which receive every key with an empty
+     * string value. Only dashboard sessions receive the actual values.
      */
     env_vars?: { [key: string]: string };
 
@@ -205,7 +207,9 @@ export interface DeploymentCreateResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -250,7 +254,9 @@ export interface DeploymentRetrieveResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -295,7 +301,9 @@ export interface DeploymentListResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -361,7 +369,8 @@ export namespace DeploymentFollowResponse {
     version: string;
 
     /**
-     * Environment variables configured for this app version
+     * Environment variables configured for this app version. Not currently populated
+     * on streamed app_version_summary events.
      */
     env_vars?: { [key: string]: string };
   }
diff --git a/src/version.ts b/src/version.ts
index c88d4bf..766f1ae 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '0.74.0'; // x-release-please-version
+export const VERSION = '0.75.0'; // x-release-please-version