diff --git a/clients/android b/clients/android
index 4bdde0ae..7d1e7c72 160000
--- a/clients/android
+++ b/clients/android
@@ -1 +1 @@
-Subproject commit 4bdde0ae4db2f0fe041a52520e12315141d0981c
+Subproject commit 7d1e7c72cebdce23ea4f5f3dcfc8d12a4dc29633
diff --git a/clients/apple b/clients/apple
index 015dcd26..80c86686 160000
--- a/clients/apple
+++ b/clients/apple
@@ -1 +1 @@
-Subproject commit 015dcd266ba8651f5be20de531bf9184470f750d
+Subproject commit 80c866861df86b43d597e86b086458ff8d6c103b
diff --git a/docs/changelog.md b/docs/changelog.md
index d3162824..b67663e1 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -2,9 +2,7 @@
 icon: material/alert-decagram
 ---
 
-#### 1.13.0-rc.6
-
-* Fixes and improvements
+#### 1.13.0
 
 Important changes since 1.12:
 
@@ -22,7 +20,7 @@ Important changes since 1.12:
 * Improve `local` DNS server **12**
 * Add `disable_tcp_keep_alive`, `tcp_keep_alive` and `tcp_keep_alive_interval` options for listen and dial fields **13**
 * Add `bind_address_no_port` option for dial fields **14**
-* Add system interface and relay server options for Tailscale endpoint **15**
+* Add system interface, relay server and advertise tags options for Tailscale endpoint **15**
 * Add Claude Code Multiplexer service **16**
 * Add OpenAI Codex Multiplexer service **17**
 * Apple/Android: Refactor GUI
@@ -136,6 +134,7 @@ See [Dial Fields](/configuration/shared/dial/#bind_address_no_port).
 
 Tailscale endpoint can now create a system TUN interface to handle traffic directly.
 New `relay_server_port` and `relay_server_static_endpoints` options for incoming relay connections.
+New `advertise_tags` option for ACL tag advertisement.
 
 See [Tailscale endpoint](/configuration/endpoint/tailscale/).
 
@@ -169,6 +168,10 @@ Also, documentation has been updated with a warning about uTLS fingerprinting vu
 uTLS is not recommended for censorship circumvention due to fundamental architectural limitations;
 use NaiveProxy instead for TLS fingerprint resistance.
 
+#### 1.12.23
+
+* Fixes and improvements
+
 #### 1.13.0-rc.5
 
 * Add `mipsle`, `mips64le`, `riscv64` and `loong64` support for NaiveProxy outbound