diff --git a/lib/CHANGELOG.md b/lib/CHANGELOG.md
index 0efae6e..1b9a8b0 100644
--- a/lib/CHANGELOG.md
+++ b/lib/CHANGELOG.md
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0](https://github.com/bitcoindevkit/rust-cktap/compare/rust-cktap-v0.3.0...rust-cktap-v0.4.0) - 2026-09-30
+
+### Added
+
+- [**breaking**] harden CVC authentication and preserve APDU errors, #74
+- expose sign_digest for arbitrary 32-byte digest signing, #71
+
 ## [0.3.0](https://github.com/bitcoindevkit/rust-cktap/compare/rust-cktap-v0.2.2...rust-cktap-v0.3.0) - 2026-09-11
 
 ### Fixed
diff --git a/lib/Cargo.toml b/lib/Cargo.toml
index b939dc1..fb64982 100644
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rust-cktap"
-version = "0.3.0"
+version = "0.4.0"
 edition.workspace = true
 authors.workspace = true
 license.workspace = true