diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62814fe..2641528 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 4.0.4 - 2026-11-14
+
+### Fixed
+
+- Skip Composer virion preparation when building DevTools itself while keeping locked Composer packages available as configured build assets.
+- Accept full-SHA-pinned first-party GitHub Actions while continuing to require checkout credentials to be disabled.
+
 ## 4.0.3 - 2026-11-12
 
 ### Fixed
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 8b25184..52e43b7 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,16 +1,11 @@
-# DevTools 4.0.3
+# DevTools 4.0.4
 
-DevTools 4.0.3 hardens path validation, background build failures and localized diagnostics without changing the public command or manifest contracts.
+DevTools 4.0.4 fixes Composer dependency preparation when DevTools builds itself in automated workflows.
 
 ## Fixed
 
-- Preserve worker identifiers and typed responses when background jobs fail.
-- Keep source paths, Windows roots, locale identifiers and Composer PHP constraints intact across build and validation flows.
-- Reject unsafe virion paths, reserved Windows device names, duplicate manifest sections and external project paths.
-- Improve namespace reference detection for dynamic strings, reflection properties and compound function guards.
-- Preserve extracted files during rollback and create valid empty ZIP archives.
-- Localize diagnostics consistently across the CLI, workers, runtime loader and all 14 supported locales.
-- Clarify validation failures for PHPStan, YAML linting and unsupported PHP constraints.
+- Keep DevTools' locked Composer packages available as build assets without treating them as virions during its own build.
+- Accept full-SHA-pinned first-party GitHub Actions while requiring checkout credentials to remain disabled.
 
 ## Compatibility
 
@@ -19,8 +14,7 @@ DevTools 4.0.3 hardens path validation, background build failures and localized
 
 ## Upgrading
 
-- Replace `plugins/DevTools.phar` and restart the server.
-- No manifest or workflow changes are required for supported projects.
-- Projects using the existing DevTools workflows do not need configuration changes.
+- Projects using Composer-prepared BedrockNexus workflows should update to this release to build DevTools correctly.
+- Other projects do not need configuration changes.
 
 The release tag and checksum manifest are signed with the maintainer's GPG key. Verify `SHA256SUMS.txt.asc` before checking the downloaded assets against `SHA256SUMS.txt`.
diff --git a/composer.json b/composer.json
index 033fff9..0788955 100644
--- a/composer.json
+++ b/composer.json
@@ -52,7 +52,7 @@
     },
     "extra": {
         "devtools": {
-            "release-version": "4.0.3"
+            "release-version": "4.0.4"
         }
     },
     "support": {
diff --git a/composer.lock b/composer.lock
index a6e6866..1dbf8ac 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "95fa758d3a1a2ef9784f3769fc377c71",
+    "content-hash": "87ffb6aa7dcd41bcfad38b61d02d4bea",
     "packages": [
         {
             "name": "nikic/php-parser",
diff --git a/plugin.yml b/plugin.yml
index 6ff839f..68c1cf3 100644
--- a/plugin.yml
+++ b/plugin.yml
@@ -1,5 +1,5 @@
 name: DevTools
-version: 4.0.3
+version: 4.0.4
 main: AxolotlBucketLabs\DevTools\DevTools
 api: 5.0.0
 load: STARTUP
diff --git a/tests/Validation/RepositoryMetadataTest.php b/tests/Validation/RepositoryMetadataTest.php
index 140d6d5..9cf1963 100644
--- a/tests/Validation/RepositoryMetadataTest.php
+++ b/tests/Validation/RepositoryMetadataTest.php
@@ -19,7 +19,7 @@
 
 final class RepositoryMetadataTest extends TestCase
 {
-	private const VERSION = '4.0.3';
+	private const VERSION = '4.0.4';
 	private const COMPATIBILITY_BUILDER_VERSION = '4.0.3';
 	private const PHP_ACTION_VERSION = '1.0.0';