diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 2b2b4fa..fed4b17 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.51.0"
+  ".": "0.52.0"
 }
\ No newline at end of file
diff --git a/.stats.yml b/.stats.yml
index d58220c..33f284f 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 112
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel%2Fkernel-a674e3c4c0063942621d1b4e7f67b72f7e240c12dd88564fe16627618ba33dd6.yml
-openapi_spec_hash: 8b97c87f0dafe5fc5e5a7365f3687755
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel%2Fkernel-4ce09d1a7546ab36f578cb27d819187eeb90c580b11834c7ff7a375aa22f9a20.yml
+openapi_spec_hash: 1043ab2d699f6c828680c3352cd4cece
 config_hash: 08d55086449943a8fec212b870061a3f
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d37c34..ec22edc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.52.0 (2026-04-29)
+
+Full Changelog: [v0.51.0...v0.52.0](https://github.com/kernel/kernel-go-sdk/compare/v0.51.0...v0.52.0)
+
+### Features
+
+* **go:** add default http client with timeout ([a999228](https://github.com/kernel/kernel-go-sdk/commit/a999228cc4426709eb1561f6cf46d51833509014))
+* profile download: 409 for empty profile + surface API errors in dashboard ([c14aef2](https://github.com/kernel/kernel-go-sdk/commit/c14aef289c5418906fb003893a728ec11cf549cc))
+* support setting headers via env ([728fe39](https://github.com/kernel/kernel-go-sdk/commit/728fe3931a9a8b9f7de3ef6f338c3872fb67c4b1))
+
 ## 0.51.0 (2026-04-25)
 
 Full Changelog: [v0.50.0...v0.51.0](https://github.com/kernel/kernel-go-sdk/compare/v0.50.0...v0.51.0)
diff --git a/README.md b/README.md
index 66d9e25..45fd7c1 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ Or to pin the version:
 <!-- x-release-please-start-version -->
 
 ```sh
-go get -u 'github.com/kernel/kernel-go-sdk@v0.51.0'
+go get -u 'github.com/kernel/kernel-go-sdk@v0.52.0'
 ```
 
 <!-- x-release-please-end -->
diff --git a/client.go b/client.go
index cf6e7d7..27982b8 100644
--- a/client.go
+++ b/client.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"slices"
+	"strings"
 
 	"github.com/kernel/kernel-go-sdk/internal/requestconfig"
 	"github.com/kernel/kernel-go-sdk/lib/browserrouting"
@@ -48,13 +49,21 @@ type Client struct {
 // DefaultClientOptions read from the environment (KERNEL_API_KEY,
 // KERNEL_BASE_URL). This should be used to initialize new clients.
 func DefaultClientOptions() []option.RequestOption {
-	defaults := []option.RequestOption{option.WithEnvironmentProduction()}
+	defaults := []option.RequestOption{option.WithHTTPClient(defaultHTTPClient()), option.WithEnvironmentProduction()}
 	if o, ok := os.LookupEnv("KERNEL_BASE_URL"); ok {
 		defaults = append(defaults, option.WithBaseURL(o))
 	}
 	if o, ok := os.LookupEnv("KERNEL_API_KEY"); ok {
 		defaults = append(defaults, option.WithAPIKey(o))
 	}
+	if o, ok := os.LookupEnv("KERNEL_CUSTOM_HEADERS"); ok {
+		for _, line := range strings.Split(o, "\n") {
+			colon := strings.Index(line, ":")
+			if colon >= 0 {
+				defaults = append(defaults, option.WithHeader(strings.TrimSpace(line[:colon]), strings.TrimSpace(line[colon+1:])))
+			}
+		}
+	}
 	return defaults
 }
 
diff --git a/default_http_client.go b/default_http_client.go
new file mode 100644
index 0000000..036bc47
--- /dev/null
+++ b/default_http_client.go
@@ -0,0 +1,24 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package kernel
+
+import (
+	"net/http"
+	"time"
+)
+
+// defaultResponseHeaderTimeout bounds the time between a fully written request
+// and the server's response headers. It does not apply to the response body,
+// so long-running streams are unaffected. Without this, a server that accepts
+// the connection but never responds would hang the request indefinitely.
+const defaultResponseHeaderTimeout = 10 * time.Minute
+
+// defaultHTTPClient returns an [*http.Client] used when the caller does not
+// supply one via [option.WithHTTPClient]. It clones [http.DefaultTransport]
+// and adds a [http.Transport.ResponseHeaderTimeout] so stuck connections
+// fail fast instead of compounding across retries.
+func defaultHTTPClient() *http.Client {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.ResponseHeaderTimeout = defaultResponseHeaderTimeout
+	return &http.Client{Transport: transport}
+}
diff --git a/internal/version.go b/internal/version.go
index 5d9eddd..6542caa 100644
--- a/internal/version.go
+++ b/internal/version.go
@@ -2,4 +2,4 @@
 
 package internal
 
-const PackageVersion = "0.51.0" // x-release-please-version
+const PackageVersion = "0.52.0" // x-release-please-version
diff --git a/profile.go b/profile.go
index e5c352f..ac7b022 100644
--- a/profile.go
+++ b/profile.go
@@ -96,8 +96,7 @@ func (r *ProfileService) Delete(ctx context.Context, idOrName string, opts ...op
 	return err
 }
 
-// Download the profile. Profiles are JSON files containing the pieces of state
-// that we save.
+// Returns a zstd-compressed tar file of the full user-data directory.
 func (r *ProfileService) Download(ctx context.Context, idOrName string, opts ...option.RequestOption) (res *http.Response, err error) {
 	opts = slices.Concat(r.Options, opts)
 	opts = append([]option.RequestOption{option.WithHeader("Accept", "application/octet-stream")}, opts...)