diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..baeed36
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,25 @@
+# Changelog
+
+## 1.4.0 — 2026-08-31
+
+### Added
+
+- Added `repo clone` with branch, depth, remote-name, and destination options; credentials stay in ephemeral Git configuration instead of command arguments, remotes, or repository configuration. (#13, #14).
+- Added the stoke brand system and a package file allowlist so published packages include the CLI, README, license, design guide, and vector logo without tests or generated binary assets. (#12, #16).
+- Added CI for pull requests and pushes to `main`. (#17).
+- Added `issue show`, `issue comment`, raw `--json` output for read commands, and commit-pinned `pr review --commit`. (#20).
+- Added repeatable labels to `issue create`, with label validation before issue creation. (#26, #29).
+- Added ceremony governance automation, vendored role doctrine, configuration validation, the reviewer panel, and path-based scope labels. (#30, #31).
+- Added `repo create --owner` for organization-owned repositories while preserving the authenticated-user default. (#24, #35).
+- Added `release create --asset` and `release upload`, including streamed uploads, single-asset renaming, release IDs, attached-file listings, backpressure handling, and partial-failure reporting. (#25, #37).
+- Added private Debian registry credentials without exposing them in source URLs. (#1, #38).
+
+### Changed
+
+- `auth login` now requests least-privilege scopes by default; use `--full-scopes` for the former broad set or `--scopes` for an explicit set. This is a behavior change. (#9, #19).
+- Bumped the ceremony workflow pin from 0.6.1 to 0.6.3, re-vendored all six doctrine files from that release, and updated the mirror's pin record. (#39).
+
+### Fixed
+
+- `install-apt` now fails clearly when registry metadata is absent instead of continuing into an opaque apt failure. (#18).
+- Debian installs preserve signature verification across transient failures, refuse unverifiable registries by default, and allow an HTTPS-only bypass solely through the explicit opt-in for the known sqv failure. (#1, #38).
diff --git a/changelog.d/1.md b/changelog.d/1.md
deleted file mode 100644
index 2e9b255..0000000
--- a/changelog.d/1.md
+++ /dev/null
@@ -1 +0,0 @@
-- Private apt installs keep credentials out of source URLs, refuse unverifiable registries by default, and require an explicit HTTPS-only opt-in to disable signature checks. (#1).
diff --git a/changelog.d/24.md b/changelog.d/24.md
deleted file mode 100644
index 5384946..0000000
--- a/changelog.d/24.md
+++ /dev/null
@@ -1 +0,0 @@
-- `repo create --owner` can now create organization-owned repositories while preserving the authenticated-user default. (#24).
diff --git a/changelog.d/25.md b/changelog.d/25.md
deleted file mode 100644
index e713588..0000000
--- a/changelog.d/25.md
+++ /dev/null
@@ -1 +0,0 @@
-- Release commands can now stream asset uploads, rename single assets, report partial failures, print release ids, and list attached files. (#25).
diff --git a/changelog.d/30.md b/changelog.d/30.md
deleted file mode 100644
index 7cde2f8..0000000
--- a/changelog.d/30.md
+++ /dev/null
@@ -1 +0,0 @@
-- Adopted ceremony label and review automation with a machine-readable panel and scope taxonomy. (#30).
diff --git a/package.json b/package.json
index 3598099..b3103fe 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "stoke",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "CLI for the heavy-duty forge (Forgejo)",
   "main": "src/cli.js",
   "scripts": {