diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..7e794e2
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,9 @@
+# AGENTS.md
+
+## Security update PRs
+
+A PR that changes a runtime dependency for security reasons (raising a version floor in `pyproject.toml` and `templates/pyproject.mustache`, for example) must also bump the package version, so it can be published without a follow-up PR.
+
+- Run `python3 scripts/update_version.py patch`. It updates both `pyproject.toml` and `openapi-generator-config.yaml`; never edit only one.
+- Don't regenerate the client as part of a security update.
+- Dev and test dependency updates don't ship to consumers and don't need a bump.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..43c994c
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+@AGENTS.md
diff --git a/openapi-generator-config.yaml b/openapi-generator-config.yaml
index 204f5be..7900bae 100644
--- a/openapi-generator-config.yaml
+++ b/openapi-generator-config.yaml
@@ -1,5 +1,5 @@
 packageName: ynab
-packageVersion: 4.4.0
+packageVersion: 4.4.1
 packageDescription: Official Python client for the YNAB API. API documentation available at https://api.ynab.com.
 licenseInfo:
   name: Apache-2.0
diff --git a/pyproject.toml b/pyproject.toml
index c641262..e0acfc1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "ynab"
-version = "4.4.0"
+version = "4.4.1"
 description = "Official Python client for the YNAB API. API documentation available at https://api.ynab.com. Generated from server specification version 1.86.0"
 authors = ["YNAB"]
 license = "Apache-2.0"