diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84b9d23..eb5bfee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 0.4.0 (2026-09-24)
 
 ### Analysis
 
@@ -8,10 +8,10 @@
 
 ### Dependencies
 
-- Advisories distinguish the `affected_symbols` a fix changed from the public `entry_points` through which they are reached, each justified and carrying `conditions` (checkable argument values, or `semantic` ones kept as pending review); `modules` names what the package installs. Every dependency finding records its evidence `level`: `declared`, `imported`, `reachable` or `exploitable`.
-- A call to an API affected by several advisories of the pinned release reports every one of them, not the first listed.
-- One advisory per identifier and package: a later contributor replaces an earlier one, so a curated feed refines the bundled sample, and the sample names the modules its packages install.
-- A version specifier may be a union of ranges separated by `||`, as an advisory over several release series needs (`>=4.2,<4.2.28 || >=5.2,<5.2.11`); the OSV import produces one such advisory per package instead of one per range.
+- Advisories distinguish the `affected_symbols` a fix changed from the public `entry_points` through which they are reached, each justified and carrying `conditions` (checkable argument values, or `semantic` ones kept as pending review); `modules` names what the package installs. Every dependency finding records its evidence `level`: `declared`, `imported`, `reachable` or `exploitable` (#109).
+- A call to an API affected by several advisories of the pinned release reports every one of them, not the first listed (#109).
+- One advisory per identifier and package: a later contributor replaces an earlier one, so a curated feed refines the bundled sample, and the sample names the modules its packages install (#109).
+- A version specifier may be a union of ranges separated by `||`, as an advisory over several release series needs (`>=4.2,<4.2.28 || >=5.2,<5.2.11`); the OSV import produces one such advisory per package instead of one per range (#112).
 
 ### Plugins
 
diff --git a/docs/usage.md b/docs/usage.md
index 61d2676..db7b66e 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -201,7 +201,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.3.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.4.0"},
   "root": "/home/me/project",
   "findings": [
     {
diff --git a/pyproject.toml b/pyproject.toml
index 88069fc..2a70fc5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.3.0"
+version = "0.4.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/coretrace_python/__init__.py b/src/coretrace_python/__init__.py
index 9544301..c329c36 100644
--- a/src/coretrace_python/__init__.py
+++ b/src/coretrace_python/__init__.py
@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"
 
diff --git a/tests/test_release.py b/tests/test_release.py
index 1155fcf..0df7ec5 100644
--- a/tests/test_release.py
+++ b/tests/test_release.py
@@ -30,7 +30,7 @@ def require_changelog() -> None:
 def test_the_version_is_declared_once_and_mirrored() -> None:
     project = tomllib.loads((REPO / "pyproject.toml").read_text(encoding="utf-8"))["project"]
 
-    assert project["version"] == coretrace_python.__version__ == "0.3.0"
+    assert project["version"] == coretrace_python.__version__ == "0.4.0"
 
 
 def test_the_changelog_starts_with_the_current_version() -> None: