diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8530abe..8c0996b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [0.8.4](https://github.com/cipherstash/envelopers/compare/0.8.3...0.8.4) - 2026-09-28
+
+### Other
+
+- Merge pull request #65 from cipherstash/chore/cip-4135-enable-trusted-publishing
+- publish only when a release PR merges
+- check release workflow structurally and drop publish job write token
+- use app client-id and check release environment binding
+- harden release workflow invariants
+- *(cip-4135)* enable trusted publishing
+- record envelopers 0.8.3 release
+- *(cip-4132)* add release-plz observation workflow
+
 ## [0.8.3]
 
 ### Security
diff --git a/Cargo.lock b/Cargo.lock
index 9dd2b65..5318ba1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -905,7 +905,7 @@ checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
 [[package]]
 name = "envelopers"
-version = "0.8.3"
+version = "0.8.4"
 dependencies = [
  "aes-gcm",
  "aes-gcm-siv",
diff --git a/Cargo.toml b/Cargo.toml
index 99d13be..273bbb8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "envelopers"
-version = "0.8.3"
+version = "0.8.4"
 edition = "2021"
 rust-version = "1.94.1"
 license-file = "LICENSE"