diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 2be9c43..0ee8c01 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.2.0"
+  ".": "0.3.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c75947b..1daa71b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.3.0](https://github.com/Krustytoe/platform-workflows/compare/v0.2.0...v0.3.0) (2026-10-15)
+
+
+### ⚠ BREAKING CHANGES
+
+* terraform-apply requires an `environment` input. Move `environment:` from the calling job into `with:`.
+
+### Features
+
+* apply the reviewed plan behind an environment gate ([#6](https://github.com/Krustytoe/platform-workflows/issues/6)) ([c821236](https://github.com/Krustytoe/platform-workflows/commit/c82123606a7fc043babc6c2245beddfd3006deae))
+
+
+### Bug Fixes
+
+* inline composite action steps so releases don't edit workflow files ([#7](https://github.com/Krustytoe/platform-workflows/issues/7)) ([10f7ce8](https://github.com/Krustytoe/platform-workflows/commit/10f7ce854f3fe5b57fafb3e7af250453b739cb35))
+
 ## [0.2.0](https://github.com/Krustytoe/platform-workflows/compare/v0.1.0...v0.2.0) (2026-10-06)
 
 
diff --git a/README.md b/README.md
index 1124372..e85cdd4 100644
--- a/README.md
+++ b/README.md
@@ -80,7 +80,7 @@ Runs `fmt -check → init → validate → tflint → plan` and posts the plan o
 ```yaml
 jobs:
   plan:
-    uses: Krustytoe/platform-workflows/.github/workflows/terraform-plan.yml@v0.2.0 # x-release-please-version
+    uses: Krustytoe/platform-workflows/.github/workflows/terraform-plan.yml@v0.3.0 # x-release-please-version
     permissions:
       contents: read
       id-token: write
@@ -124,7 +124,7 @@ jobs:
   apply:
     needs: plan
     if: needs.plan.outputs.has_changes == 'true'
-    uses: Krustytoe/platform-workflows/.github/workflows/terraform-apply.yml@v0.2.0 # x-release-please-version
+    uses: Krustytoe/platform-workflows/.github/workflows/terraform-apply.yml@v0.3.0 # x-release-please-version
     permissions:
       contents: read
       id-token: write
@@ -157,7 +157,7 @@ Runs Trivy against a filesystem/IaC path or container image and uploads the resu
 ```yaml
 jobs:
   scan:
-    uses: Krustytoe/platform-workflows/.github/workflows/trivy-scan.yml@v0.2.0 # x-release-please-version
+    uses: Krustytoe/platform-workflows/.github/workflows/trivy-scan.yml@v0.3.0 # x-release-please-version
     permissions:
       contents: read
       security-events: write
@@ -179,7 +179,7 @@ jobs:
 ## aws-oidc-auth
 
 ```yaml
-- uses: Krustytoe/platform-workflows/actions/aws-oidc-auth@v0.2.0 # x-release-please-version
+- uses: Krustytoe/platform-workflows/actions/aws-oidc-auth@v0.3.0 # x-release-please-version
   with:
     role_arn: ${{ secrets.AWS_ROLE_ARN }}
     region: us-gov-west-1
@@ -192,7 +192,7 @@ Wraps `aws-actions/configure-aws-credentials`. Requires `id-token: write` permis
 ## azure-oidc-auth
 
 ```yaml
-- uses: Krustytoe/platform-workflows/actions/azure-oidc-auth@v0.2.0 # x-release-please-version
+- uses: Krustytoe/platform-workflows/actions/azure-oidc-auth@v0.3.0 # x-release-please-version
   with:
     client_id: ${{ secrets.AZURE_CLIENT_ID }}
     tenant_id: ${{ secrets.AZURE_TENANT_ID }}
@@ -206,7 +206,7 @@ Wraps `azure/login`. Requires `id-token: write` permission on the calling job.
 ## terraform-setup
 
 ```yaml
-- uses: Krustytoe/platform-workflows/actions/terraform-setup@v0.2.0 # x-release-please-version
+- uses: Krustytoe/platform-workflows/actions/terraform-setup@v0.3.0 # x-release-please-version
   with:
     terraform_version: "~1.10"
 ```
@@ -227,7 +227,7 @@ on:
 
 jobs:
   plan:
-    uses: Krustytoe/platform-workflows/.github/workflows/terraform-plan.yml@v0.2.0 # x-release-please-version
+    uses: Krustytoe/platform-workflows/.github/workflows/terraform-plan.yml@v0.3.0 # x-release-please-version
     permissions:
       contents: read
       id-token: write
@@ -243,7 +243,7 @@ jobs:
   apply:
     needs: plan
     if: github.event_name == 'push' && needs.plan.outputs.has_changes == 'true'
-    uses: Krustytoe/platform-workflows/.github/workflows/terraform-apply.yml@v0.2.0 # x-release-please-version
+    uses: Krustytoe/platform-workflows/.github/workflows/terraform-apply.yml@v0.3.0 # x-release-please-version
     permissions:
       contents: read
       id-token: write