diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00c8dd161..d5554cd1f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 4.0.0
+**Self-asserted token registration**
+- Nudge the vetting type more aggressively c67201bc
+- Integrate Recovery tokens in SelfService #261
+- Require step up authentication for Recovery Token create and delete actions #264
+- Support the new loa-self-asserted level of assurance #265
+- Allow expression of a preferred activation flow (vetting type) #266
+- Display the Institutional vetting type hint #268
+- Allow recovery token revocation without second factor token possession #269
+
 ## 3.5.5
 - Make the info and health endpoints available on both `/` and `/internal/` paths. 'Deprecating' the original /health and /info endpoints.
 - Give a concrete error message when a required attribute is missing