diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bca91f..96ca9a6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,15 @@ release notes.
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-10-15
+
+Fixes to the CI pieces, found by running the gate script, the workflow template, the suite template
+and the SARIF export against a repository laid out the way the templates describe. The gate leaves
+out the two kinds of file the suite template puts under the script folders, the Pester suite and a
+Win32 app's package content, so neither fails a build for findings that do not apply to it; the
+SARIF export describes the policy rules and no longer throws on a policy check; the templates work
+on Windows on ARM and use current action versions. No verdict changes.
+
 ### Fixed
 
 - `Examples/Invoke-IntuneScriptGate.ps1` analyzed a Pester suite placed next to the scripts, where
@@ -665,7 +674,8 @@ Nothing any command does has changed.
 
 - Static rules: `Test-IntuneScript`.
 
-[Unreleased]: https://github.com/fadwen/IntuneScriptLab/compare/v0.32.0...HEAD
+[Unreleased]: https://github.com/fadwen/IntuneScriptLab/compare/v0.33.0...HEAD
+[0.33.0]: https://github.com/fadwen/IntuneScriptLab/compare/v0.32.0...v0.33.0
 [0.32.0]: https://github.com/fadwen/IntuneScriptLab/compare/v0.31.0...v0.32.0
 [0.31.0]: https://github.com/fadwen/IntuneScriptLab/compare/v0.30.0...v0.31.0
 [0.30.0]: https://github.com/fadwen/IntuneScriptLab/compare/v0.29.0...v0.30.0
diff --git a/IntuneScriptLab.psd1 b/IntuneScriptLab.psd1
index 94eea23..7e29d27 100644
--- a/IntuneScriptLab.psd1
+++ b/IntuneScriptLab.psd1
@@ -1,7 +1,7 @@
 @{
     # Module manifest for IntuneScriptLab
     RootModule = 'IntuneScriptLab.psm1'
-    ModuleVersion = '0.32.0'
+    ModuleVersion = '0.33.0'
     GUID = '3f6b2c9e-7d41-4a8f-9c2b-5e0d8a1f4b76'
     Author = 'Jeffrey Stuhr'
     CompanyName = ''
@@ -64,6 +64,16 @@ pre-flight over the tenant's deployed scripts and readers for the agent's logs
             LicenseUri = 'https://github.com/fadwen/IntuneScriptLab/blob/main/LICENSE'
             ProjectUri = 'https://github.com/fadwen/IntuneScriptLab'
             ReleaseNotes = @'
+0.33.0 - The CI pieces, after a run against a repository laid out the way the templates describe.
+        The gate script no longer analyzes a Pester suite next to the scripts or the contents of a
+        Win32 app's Package folder, both of which the suite template puts there and both of which
+        failed a build at -FailOn Warning for findings that do not apply to them; its GitHub
+        annotations percent-encode the file and title values as well as the message.
+        Export-IntuneFindingSarif describes the assignment, filter and schedule rules, gives a
+        mixed-severity rule the level of its worst finding, and writes a policy check, which has no
+        script behind it, as a result without a location instead of throwing. The workflow template
+        uses checkout@v7 and upload-sarif@v4; the suite template names its static tests by package
+        and runs the device's own 64-bit host, so it works on Windows on ARM. See CHANGELOG.md.
 0.32.0 - Get-IntuneAgentTimeline read Kind as Unknown for a policy whose lines all sat in a rolled
         log file (HealthScripts-20260925-101500 lost only its time part); it reads Remediation or
         Win32App like one from the current file. The Policy column of the health report and drift
@@ -78,15 +88,7 @@ pre-flight over the tenant's deployed scripts and readers for the agent's logs
         assignment: a clause that never matches excludes nobody, so the assignment reaches every
         device in the group. The tenant-wide help example keeps to Windows filters. See
         CHANGELOG.md.
-0.30.0 - Invoke-IntuneDetectionTest, Invoke-IntuneRequirementTest and Invoke-IntuneWin32AppTest no
-        longer default -Architecture to x64, which Windows on ARM refuses; left out, it is the
-        device's 64-bit host (x64, or arm64 on ARM), the one the agent uses. Two Win32 fixes: the
-        launcher starts its child without NoDefaultCurrentDirectoryInExePath, a per-user cmd.exe
-        setting that made a bare install.cmd fail with "not recognized" although the agent's
-        cmd.exe finds it; and the 32-bit host warning also reads the batch file an install or
-        uninstall command names, where a powershell.exe call runs 32-bit just the same. See
-        CHANGELOG.md.
-Earlier versions, 0.1.0 to 0.29.0: CHANGELOG.md, which ships with the module.
+Earlier versions, 0.1.0 to 0.30.0: CHANGELOG.md, which ships with the module.
 '@
             RequireLicenseAcceptance = $false
         }