diff --git a/CHANGELOG.md b/CHANGELOG.md
index a176506..f707c94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,13 +4,14 @@ All notable changes to NotAlterra are documented in this file.
 
 ---
 
-## [v0.4.3] — 2026-06-09
+## [v0.4.3] — 2026-06-14
 
 ### Fixed
 - **Dashboard counts** — "Saves" now shows `.bak` recovery file count, "Backups" shows `.tar.gz` archive count
 - **Backup mtime preservation** — tar archives now store source file modification times, preventing epoch dates on restored files
 - **Navigation bound** — restore backup picker no longer stops before migrated entries
 - **Save folder dialog** — pre-fills with the current path if one is already set
+- **Disclaimer sentinel not removed on decline** — rejecting the disclaimer now deletes the `NOTALTERRA_LICENSE_ACCEPTED` sentinel file, so the disclaimer reappears on the next launch. Previously, acceptance was irrevocable even through the "View disclaimer" menu item.
 
 ## [v0.4.2] — 2026-06-09
 
diff --git a/docs/GOVERNANCE.md b/docs/GOVERNANCE.md
index abc2a26..13851b1 100644
--- a/docs/GOVERNANCE.md
+++ b/docs/GOVERNANCE.md
@@ -12,7 +12,7 @@ maintainer becomes unavailable.
 | Code review | All changes pass through CI (`cargo check`, `cargo test`, `cargo doc`). Human review is performed by the maintainer before signing. |
 | Release | Signed GPG tag by the maintainer. No automated tag creation. CI builds, packages, and attaches provenance. |
 | Policy documents | Maintainer drafts. Significant changes are committed with justification in the commit message. |
-| Security issues | Reported via email. Patched within 48 hours. Disclosed publicly after patch release. |
+| Security issues | Reported via email. Patched within 14 days for serious issues, 90 days for standard. Disclosed publicly after patch release. |
 
 ## Maintainer