diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..37e02096
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,7 @@
+# Changelog
+
+## 0.11.0 2018-07-30
+
+Initial release of open source modules. Number is kept in-sync with internal repo.
+
+Currently moved to this repo are all our IAM and secrets modules.
\ No newline at end of file
diff --git a/aws-default-vpc-security/README.md b/aws-default-vpc-security/README.md
index 3b4fa1c7..f5fab316 100644
--- a/aws-default-vpc-security/README.md
+++ b/aws-default-vpc-security/README.md
@@ -6,7 +6,7 @@ This module will name, tag and optionally lock down traffic to AWS Default VPCs.
 
 ```hcl
 module "default-vpc" {
-  source = "github.com/chanzuckerberg/cztack/aws-default-vpc-lockdown?ref=master # TODO
+  source = "github.com/chanzuckerberg/cztack/aws-default-vpc-lockdown?ref=master"
   
   default_sg_lockdown = true
 }
@@ -22,7 +22,7 @@ provider "aws"{
 }
 
 module "default-vpc" {
-  source = "github.com/chanzuckerberg/cztack/aws-default-vpc-lockdown?ref=master # TODO
+  source = "github.com/chanzuckerberg/cztack/aws-default-vpc-lockdown?ref=master"
 
   default_sg_lockdown = true
 
diff --git a/aws-iam-ecs-task-role/README.md b/aws-iam-ecs-task-role/README.md
index 746285ee..b38c05fa 100644
--- a/aws-iam-ecs-task-role/README.md
+++ b/aws-iam-ecs-task-role/README.md
@@ -6,7 +6,7 @@ This will create a role for attaching to an ECS task, using `policy`.
 
 ```hcl
 module "ecs-role" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-ecs-task-role?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-ecs-task-role?ref=v0.11.0"
   
   policy = "..."
 
diff --git a/aws-iam-group-assume-role/README.md b/aws-iam-group-assume-role/README.md
index b57d65d8..ceadaafc 100644
--- a/aws-iam-group-assume-role/README.md
+++ b/aws-iam-group-assume-role/README.md
@@ -4,7 +4,7 @@ This module will create a group which has the right to assume a particular IAM r
 
 ```hcl
 module "group" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-group-assume-role?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-group-assume-role?ref=v0.11.0"
 
   group_name      = "…"
   path            = "…"
diff --git a/aws-iam-group-console-login/README.md b/aws-iam-group-console-login/README.md
index 018b86fd..3937f22f 100644
--- a/aws-iam-group-console-login/README.md
+++ b/aws-iam-group-console-login/README.md
@@ -6,7 +6,7 @@ This module will create an IAM group and grant access for its members to log int
 
 ```hcl
 module "group" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-group-console-login?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-group-console-login?ref=v0.11.0"
 
   group_name = "…"
   iam_path = "…"
diff --git a/aws-iam-password-policy/README.md b/aws-iam-password-policy/README.md
index 028214bc..844b18ba 100644
--- a/aws-iam-password-policy/README.md
+++ b/aws-iam-password-policy/README.md
@@ -6,7 +6,7 @@ This module is useful for setting a password policy on AWS IAM.
 
 ```hcl
 module "password-policy" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-password-policy?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-password-policy?ref=v0.11.0"
 }
 ```
 
diff --git a/aws-iam-policy-cwlogs/README.md b/aws-iam-policy-cwlogs/README.md
index 8f701796..2f0ac205 100644
--- a/aws-iam-policy-cwlogs/README.md
+++ b/aws-iam-policy-cwlogs/README.md
@@ -6,7 +6,7 @@ This will create a policy that allows writing to cloudwatch logs and attach it t
 
 ```hcl
 module "policy" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-policy-cwlogs?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-policy-cwlogs?ref=v0.11.0"
 
 
   iam_path            = "…"
diff --git a/aws-iam-role-poweruser/README.md b/aws-iam-role-poweruser/README.md
index ad959222..1e741d0a 100644
--- a/aws-iam-role-poweruser/README.md
+++ b/aws-iam-role-poweruser/README.md
@@ -6,7 +6,7 @@ This creates a role, `role_name` which is assumable from the account `source_acc
 
 ```hcl
 module "group" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-role-poweruser?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-role-poweruser?ref=v0.11.0"
 
   role_name         = "…" # defaults to "poweruser"
   source_account_id = "…"
diff --git a/aws-iam-role-readonly/README.md b/aws-iam-role-readonly/README.md
index 4eca8e9f..5f42498b 100644
--- a/aws-iam-role-readonly/README.md
+++ b/aws-iam-role-readonly/README.md
@@ -6,7 +6,7 @@ This will create a readonly role, assumeable from `source_account_id`.
 
 ```hcl
 module "role" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-role-readonly?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-role-readonly?ref=v0.11.0"
 
   source_account_id = "…"
 }
diff --git a/aws-iam-role-security-audit/README.md b/aws-iam-role-security-audit/README.md
index c0bdfa6a..27546799 100644
--- a/aws-iam-role-security-audit/README.md
+++ b/aws-iam-role-security-audit/README.md
@@ -7,7 +7,7 @@ This will create a role for doing security audits, assumeable from `source_accou
 
 ```hcl
 module "group" {
-  source = "github.com/chanzuckerberg/cztack/aws-iam-group-assume-role?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/aws-iam-group-assume-role?ref=v0.11.0"
 
   source_account_id = "…"
 }
diff --git a/aws-param-secret/README.md b/aws-param-secret/README.md
index 4aa70541..ce936c0f 100644
--- a/aws-param-secret/README.md
+++ b/aws-param-secret/README.md
@@ -8,7 +8,7 @@ You can use [our secrets setup module](../aws-param-secrets-setup/README.md) to
 
 ```hcl
 module "secret" {
-  source = "github.com/chanzuckerberg/cztack/aws-param-secret?ref=master" # TODO fix
+  source = "github.com/chanzuckerberg/cztack/aws-param-secret?ref=v0.11.0"
 
   project = "acme"
   env     = "staging"
diff --git a/module-template/README.md b/module-template/README.md
index 8abc7675..f2163758 100755
--- a/module-template/README.md
+++ b/module-template/README.md
@@ -4,7 +4,7 @@
 
 ```hcl
 module "group" {
-  source = "github.com/chanzuckerberg/cztack/…?ref=master" # FIXME
+  source = "github.com/chanzuckerberg/cztack/…?ref=v0.11.0"
 }
 
 output "…" {