diff --git a/ChangeLog b/ChangeLog
index d998e7d..bb7fd35 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2024-04-20  NIIBE Yutaka  <gniibe@fsij.org>
+
+	* VERSION: Version 2.2.
+
 2024-04-18  NIIBE Yutaka  <gniibe@fsij.org>
 
 	* src/keccak.c, src/keccak.h: Rename.  Also offer SHA-3.
diff --git a/NEWS b/NEWS
index 85a1d4b..ecdf02c 100644
--- a/NEWS
+++ b/NEWS
@@ -3,11 +3,16 @@ Gnuk NEWS - User visible changes
 
 * Major changes in Gnuk 2.2
 
-  Released 202?-??-??, by NIIBE Yutaka
+  Released 2024-04-20, by NIIBE Yutaka
 
 ** Modular inverse by safegcd256 for Ed25519 and X25519 computation
 
-Ed25519 and X25519 computation are now faster with safegcd256.
+Ed25519 and X25519 computation are now a bit faster with safegcd256.
+
+** X25519 with 2^25.5 limb
+
+X25519 computation is done with 2^25.5 limb.  It may be better on
+other MCUs.
 
 
 * Major changes in Gnuk 2.1
diff --git a/README b/README
index ceefbaa..1c8e19e 100644
--- a/README
+++ b/README
@@ -1,14 +1,14 @@
 Gnuk - An Implementation of USB Cryptographic Token for GnuPG
 
-							    Version 2.1
-							     2023-09-05
+							    Version 2.2
+							     2024-04-20
 							   Niibe Yutaka
 				      Free Software Initiative of Japan
 
 Release Notes
 =============
 
-This is the release of Gnuk, version 2.1, which has major clean up
+This is the release of Gnuk, version 2.2, which has major clean up
 from Gnuk 1.2.  Many (questionable) features have been removed.
 
 It has supports of Ed25519 and X25519 (ECDH on Curve25519).  It also
@@ -161,9 +161,7 @@ Gnuk source code is under src/ directory.
 Note that SHA-2 hash function implementation, src/sha256.c, is based
 on the original implementation by Dr. Brian Gladman.  See:
 
-  http://brg.a2hosted.com//oldsite/cryptography_technology/sha/index.php
-(was at:
- http://gladman.plushost.co.uk/oldsite/cryptography_technology/sha/index.php)
+  https://web.archive.org/web/20140314032610/http://gladman.plushost.co.uk/oldsite/cryptography_technology/sha/index.php
 
 
 License
@@ -257,13 +255,10 @@ You need GNU toolchain and newlib for 'arm-none-eabi' target.
 On Debian we can install the packages of gcc-arm-none-eabi
 and its friends.  I'm using:
 
-	binutils-arm-none-eabi	2.40-2+18+b1
-	gcc-arm-none-eabi 	15:12.2.rel1-1
-	picolibc-arm-none-eabi	1.8-1
-	gdb-multiarch 		13.1-3
-
-Or else, see https://launchpad.net/gcc-arm-embedded for preparation of
-GNU Toolchain for 'arm-none-eabi' target.
+	binutils-arm-none-eabi	2.41.90.20240115-1+23
+	gcc-arm-none-eabi 	15:13.2.rel1-2
+	picolibc-arm-none-eabi	1.8.6-2
+	gdb-multiarch 		13.2-1
 
 Change directory to `src':
 
@@ -312,9 +307,9 @@ Flying Stone Tiny 01
 
 If you are using Flying Stone Tiny 01, you need a SWD writer.
 
-OpenOCD 0.9.0 now supports ST-Link/V2.  We can use it like:
+OpenOCD 0.12.0 supports ST-Link/V2.  We can use it like:
 
-  $ openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg \
+  $ openocd -f interface/stlink.cfg -f target/stm32f1x.cfg \
             -c "program build/gnuk.elf verify reset exit"
 
 
@@ -338,7 +333,7 @@ How to protect flash ROM
 
 To protect, invoke OpenOCD like (for FST-01):
 
-  $ openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg \
+  $ openocd -f interface/stlink.cfg -f target/stm32f1x.cfg \
             -c init -c "reset halt" -c "stm32f1x lock 0" -c reset -c exit
 
 After power-off / power-on sequence, the contents of flash ROM cannot
@@ -346,7 +341,7 @@ be accessible from JTAG debugger.
 
 Unprotecting is:
 
-  $ openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg \
+  $ openocd -f interface/stlink.cfg -f target/stm32f1x.cfg \
             -c init -c "reset halt" -c "stm32f1x unlock 0" -c reset -c exit
 
 Upon unprotection, flash is erased.
diff --git a/VERSION b/VERSION
index e20a3d4..480bb8c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-release/2.1
+release/2.2