diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7b27f4..a96d251 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,6 +46,17 @@ jobs:
           repository: zentinelproxy/zentinel-agent-rust-sdk
           path: zentinel-agent-rust-sdk
 
+      - name: Check that the tag matches Cargo.toml
+        working-directory: agent
+        run: |
+          tag="${{ inputs.version }}"
+          [ -n "$tag" ] || tag="${GITHUB_REF#refs/tags/v}"
+          crate=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          if [ "$tag" != "$crate" ]; then
+            echo "::error::Releasing $tag, but Cargo.toml says $crate. Bump Cargo.toml first."
+            exit 1
+          fi
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
         with:
diff --git a/Cargo.toml b/Cargo.toml
index 4c67e15..d23c552 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "zentinel-agent-transform"
-version = "0.2.0"
+version = "0.5.0"
 edition = "2021"
 authors = ["Raskell <hello@raskell.io>"]
 description = "Request and response transformation agent for Zentinel proxy"
diff --git a/README.md b/README.md
index 7859cdd..771ef8b 100644
--- a/README.md
+++ b/README.md
@@ -463,15 +463,22 @@ rules:
 zentinel-transform-agent [OPTIONS]
 
 Options:
-  -s, --socket <PATH>        Unix socket path [default: /tmp/zentinel-transform.sock]
-  -c, --config <FILE>        Configuration file (YAML or JSON)
-  -t, --template-dir <DIR>   Template directory
-  -l, --log-level <LEVEL>    Log level: trace, debug, info, warn, error [default: info]
-      --json-logs            Output logs in JSON format
-  -h, --help                 Print help
-  -V, --version              Print version
+  -c, --config <FILE>          Configuration file (YAML or JSON)
+      --template-dir <DIR>     Template directory [default: /etc/zentinel/templates]
+  -s, --socket <PATH>          Listen on this Unix socket (UDS) [env: TRANSFORM_SOCKET]
+      --grpc-address <ADDR>    Listen for gRPC on this address [env: TRANSFORM_GRPC_ADDRESS]
+      --json-logs              Output logs as JSON
+      --log-level <LEVEL>      Log level: trace, debug, info, warn, error [default: info]
+      --example-config         Print an example configuration and exit
+      --validate               Validate the configuration and exit
+  -h, --help                   Print help
+  -V, --version                Print version
 ```
 
+`--socket` and `--grpc-address` are mutually exclusive. With neither, the agent
+listens for gRPC on `0.0.0.0:50051`. For gRPC, point Zentinel at it with
+`grpc "http://127.0.0.1:50051"` instead of `unix-socket`.
+
 ## Debug Mode
 
 Enable debug headers to see transformation info:
diff --git a/src/main.rs b/src/main.rs
index 9eeaf74..1517c84 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -7,7 +7,7 @@ use clap::Parser;
 use std::path::PathBuf;
 use tracing::info;
 use tracing_subscriber::{fmt, prelude::*, EnvFilter};
-use zentinel_agent_protocol::v2::GrpcAgentServerV2;
+use zentinel_agent_protocol::v2::{GrpcAgentServerV2, UdsAgentServerV2};
 use zentinel_agent_transform::{TransformAgent, TransformConfig};
 
 #[derive(Parser, Debug)]
@@ -26,8 +26,13 @@ struct Args {
     #[arg(long, default_value = "/etc/zentinel/templates")]
     template_dir: PathBuf,
 
+    /// Unix socket path to listen on. If provided, uses UDS transport
+    /// instead of gRPC.
+    #[arg(short, long, env = "TRANSFORM_SOCKET", conflicts_with = "grpc_address")]
+    socket: Option<PathBuf>,
+
     /// gRPC address to listen on (e.g., "0.0.0.0:50051").
-    /// Defaults to "0.0.0.0:50051" if not specified.
+    /// Defaults to "0.0.0.0:50051" if neither this nor --socket is given.
     #[arg(long, env = "TRANSFORM_GRPC_ADDRESS")]
     grpc_address: Option<String>,
 
@@ -157,6 +162,25 @@ async fn main() -> Result<()> {
 
     info!("Transform agent initialized");
 
+    if let Some(socket) = args.socket {
+        info!(
+            config = ?args.config,
+            socket = %socket.display(),
+            "Starting Zentinel Transform Agent (UDS v2)"
+        );
+
+        let server = UdsAgentServerV2::new("transform", socket, Box::new(agent));
+
+        info!("Transform agent ready and listening on UDS");
+
+        server
+            .run()
+            .await
+            .context("Failed to run Transform Agent UDS server")?;
+
+        return Ok(());
+    }
+
     // Determine gRPC address
     let grpc_addr = args
         .grpc_address