diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e143c3..5abdbe9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable user-facing changes to this package will be documented in this file.
 
 ## [Unreleased]
 
+## [v0.1.0-beta.3](https://github.com/coder/libghostty-vt-node/releases/tag/v0.1.0-beta.3) - 2026-10-30
+
+## Fixed
+- Prevent `snapshot()` from running arbitrary JavaScript (via accessors on `Object.prototype` / `Array.prototype`) while the native code holds the terminal handle. Snapshot result objects are now built with own data properties (`napi_define_properties`), and both `includeScrollback` and `includeCells` options are read before the disposed-terminal check, so a getter that disposes the terminal during that read throws "GhosttyVtTerminal has been disposed". Before, such a setter (for example on `row` or `text`) crashed Node with a segfault or an assertion abort, and such a getter aborted it on an assertion ([#46](https://github.com/coder/libghostty-vt-node/pull/46) by @ThomasK33).
+
 ## [v0.1.0-beta.2](https://github.com/coder/libghostty-vt-node/releases/tag/v0.1.0-beta.2) - 2026-10-30
 
 ## Added
diff --git a/package-lock.json b/package-lock.json
index 8c8040e..b82e824 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@coder/libghostty-vt-node",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@coder/libghostty-vt-node",
-      "version": "0.1.0-beta.2",
+      "version": "0.1.0-beta.3",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index 52162be..b4c477a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@coder/libghostty-vt-node",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "description": "ABI-stable Node-API bindings for Ghostty libghostty-vt terminal semantics.",
   "license": "MIT",
   "engines": {