diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a38122ec..9aa80dc1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 ## Next release
 
+## 0.7.0 / 2020-09-15
+
+* [CHANGE] Make images rootless. #86
+* [FEATURE] Add ability to check for allowed request paths with new `--allow-paths` config option. #83
+
 ## 0.6.0 / 2020-06-11
 
 * [CHANGE] Use gcr.io/distroless/static as base image instead of alpine. #67
diff --git a/VERSION b/VERSION
index 60f634328..8b20e4852 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-v0.6.0
+v0.7.0
diff --git a/examples/non-resource-url-token-request/README.md b/examples/non-resource-url-token-request/README.md
index 88edb8b62..41dc6eb7b 100644
--- a/examples/non-resource-url-token-request/README.md
+++ b/examples/non-resource-url-token-request/README.md
@@ -76,7 +76,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/non-resource-url-token-request/deployment.yaml b/examples/non-resource-url-token-request/deployment.yaml
index d512deb26..8720c81b6 100644
--- a/examples/non-resource-url-token-request/deployment.yaml
+++ b/examples/non-resource-url-token-request/deployment.yaml
@@ -63,7 +63,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/non-resource-url/README.md b/examples/non-resource-url/README.md
index e0b442a68..0929afe34 100644
--- a/examples/non-resource-url/README.md
+++ b/examples/non-resource-url/README.md
@@ -76,7 +76,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/non-resource-url/deployment.yaml b/examples/non-resource-url/deployment.yaml
index efdf49dea..4e28cfdda 100644
--- a/examples/non-resource-url/deployment.yaml
+++ b/examples/non-resource-url/deployment.yaml
@@ -60,7 +60,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/oidc/deployment.yaml b/examples/oidc/deployment.yaml
index 4ea379e40..31d913da6 100644
--- a/examples/oidc/deployment.yaml
+++ b/examples/oidc/deployment.yaml
@@ -63,7 +63,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--insecure-listen-address=0.0.0.0:8444"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/resource-attributes/README.md b/examples/resource-attributes/README.md
index e4ea9b6dd..f0ca7c184 100644
--- a/examples/resource-attributes/README.md
+++ b/examples/resource-attributes/README.md
@@ -90,7 +90,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/resource-attributes/deployment.yaml b/examples/resource-attributes/deployment.yaml
index eaa507c0b..39944395e 100644
--- a/examples/resource-attributes/deployment.yaml
+++ b/examples/resource-attributes/deployment.yaml
@@ -74,7 +74,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/rewrites/README.md b/examples/rewrites/README.md
index 80b22c342..5c436b698 100644
--- a/examples/rewrites/README.md
+++ b/examples/rewrites/README.md
@@ -92,7 +92,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"
diff --git a/examples/rewrites/deployment.yaml b/examples/rewrites/deployment.yaml
index bdae91679..da95f7ab8 100644
--- a/examples/rewrites/deployment.yaml
+++ b/examples/rewrites/deployment.yaml
@@ -76,7 +76,7 @@ spec:
       serviceAccountName: kube-rbac-proxy
       containers:
       - name: kube-rbac-proxy
-        image: quay.io/brancz/kube-rbac-proxy:v0.6.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.7.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8081/"