diff --git a/CHANGELOG.md b/CHANGELOG.md
index 509d5d1..5494149 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## [0.2.2] - 2026-03-31
+## [0.2.3] - 2026-03-31
 
 ### Fixed
 - FIDO2 key generation on macOS — detect Homebrew's openssh via `ssh-sk-helper` (no freeze), use its `ssh-keygen` binary for hardware key generation
 - Linux gitleaks install hint now shows `apt`/`dnf` instead of `brew`
+- e2e test runner distro loop broken by `IFS` setting — use bash array
 
 ### Changed
 - Group interactive apply prompts into 6 categories with one-line explanations (replaces ~25 individual prompts)
diff --git a/git-harden.sh b/git-harden.sh
index ce89312..afa87d3 100755
--- a/git-harden.sh
+++ b/git-harden.sh
@@ -10,7 +10,7 @@ IFS=$'\n\t'
 # ------------------------------------------------------------------------------
 # Constants
 # ------------------------------------------------------------------------------
-readonly VERSION="0.2.2"
+readonly VERSION="0.2.3"
 readonly BACKUP_DIR="${HOME}/.config/git"
 readonly HOOKS_DIR="${HOME}/.config/git/hooks"
 readonly ALLOWED_SIGNERS_FILE="${HOME}/.config/git/allowed_signers"
diff --git a/test/e2e.sh b/test/e2e.sh
index c851c33..0766f49 100755
--- a/test/e2e.sh
+++ b/test/e2e.sh
@@ -18,8 +18,8 @@ readonly REPO_ROOT
 readonly CONTAINER_DIR="${SCRIPT_DIR}/containers"
 readonly IMAGE_PREFIX="git-harden-test"
 
-# Distro matrix: name=image
-readonly DISTROS="ubuntu debian fedora alpine arch"
+# Distro matrix
+readonly DISTROS=(ubuntu debian fedora alpine arch)
 
 # Colors (empty if not a terminal)
 if [ -t 2 ]; then
@@ -314,19 +314,19 @@ main() {
     if [ -n "$TARGET_DISTRO" ]; then
         # Validate distro name
         local valid=false
-        for d in $DISTROS; do
+        for d in "${DISTROS[@]}"; do
             if [ "$d" = "$TARGET_DISTRO" ]; then
                 valid=true
                 break
             fi
         done
         if [ "$valid" = false ]; then
-            die "Unknown distro: ${TARGET_DISTRO}. Available: ${DISTROS}"
+            die "Unknown distro: ${TARGET_DISTRO}. Available: ${DISTROS[*]}"
         fi
 
         run_distro "$TARGET_DISTRO"
     else
-        for d in $DISTROS; do
+        for d in "${DISTROS[@]}"; do
             run_distro "$d"
         done
     fi
diff --git a/test/git-harden.bats b/test/git-harden.bats
index d6b1ba3..4f86058 100755
--- a/test/git-harden.bats
+++ b/test/git-harden.bats
@@ -1148,7 +1148,7 @@ EOF
 # v0.2.0: Version bump
 # ===========================================================================
 
-@test "--version reports 0.2.2" {
+@test "--version reports 0.2.3" {
     run bash "$SCRIPT" --version
-    assert_output --partial "0.2.2"
+    assert_output --partial "0.2.3"
 }