diff --git a/CHANGELOG.md b/CHANGELOG.md
index d8e6e27..d7f6ecf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,51 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.4.0.0] - 2026-06-07
+
+### Added
+
+- **`.secrets.json` manifest (EGB-677 stage 1)** — a committed, project-root
+  manifest is now the source of truth for what syncs. List the env files you
+  want under `dotenv[]` (project-relative, nested paths and `@`-scoped
+  workspaces allowed; `..`, absolute, and symlink paths are rejected) and
+  out-of-project files under `external[]` (`properties` or `file`). The
+  manifest is shared across machines, so a teammate who clones the project
+  sees exactly what to pull.
+- **`secrets add <path>`** — declare an env file in the manifest without
+  pushing. Bootstraps `.secrets.json` on first use, dedupes, and writes a
+  stable canonical form.
+- **Auto-add on push** — `secrets push` discovers new `.env*` / `.dev.vars`
+  files and adds them to the manifest (prints what it added and reminds you to
+  commit). Gated by `options.autoAdd` in the manifest (default on);
+  `push --frozen` syncs only declared files, and `push --dry-run` previews
+  what would change without writing anything.
+- **Manifest-driven pull** — restores every declared file, recreating nested
+  directories as needed, with the same path-safety rail applied at restore
+  time so a malicious committed manifest can't write outside the project. An
+  empty manifest is a safe no-op.
+- **Legacy `.secrets-files` absorb** — an existing `.secrets-files` is folded
+  into `.secrets.json` on first push (gradle-properties entries become
+  `properties`); on pull the legacy file is superseded with a warning.
+- **Platform-aware install hints** — missing-dependency errors now print the
+  right install command for your platform (brew / apt-get / dnf).
+
+### Changed
+
+- `jq` is required only when a manifest is present or being written;
+  manifest-less projects keep working without `jq` (manifest features are
+  skipped with a notice).
+
+### Fixed
+
+- **Key rotation no longer orphans nested or external blobs.** `secrets rekey`
+  and `secrets list` now walk the entire project tree, so nested manifest
+  entries (`<project>/<relpath>.age`) and `external/` blobs are re-encrypted
+  and listed correctly. Previously a rekey could leave nested blobs encrypted
+  under the discarded old key, making them permanently undecryptable.
+- Test assertions now fail correctly under system bash 3.2 (standalone
+  `[[ ]]` checks no longer pass silently).
+
 ## [0.3.0.0] - 2026-06-07
 
 ### Added
diff --git a/VERSION b/VERSION
index 1da00ae..9551b0d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.3.0.0
+0.4.0.0