diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 8a4f8dd..74ea818 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -5,6 +5,13 @@ This document lists backward-incompatible changes in Quixote, and
 explains how to update application code to work with the newer
 version.
 
+Changes from 2.8 to 2.9
+-----------------------
+
+util.randbytes() returns a URL-safe base64 encoded token rather than
+a hex encoded token.  The session module now uses 128-bit random tokens
+rather than 64-bit.
+
 Changes from 2.7 to 2.8
 -----------------------
 
diff --git a/quixote/__init__.py b/quixote/__init__.py
index c6df943..fbf598e 100644
--- a/quixote/__init__.py
+++ b/quixote/__init__.py
@@ -3,7 +3,7 @@
 A small and flexible Python web application framework.
 """
 
-__version__ = '2.8'
+__version__ = '2.9'
 
 # These are frequently needed by Quixote applications.
 from quixote.publish import \