diff --git a/CHANGELOG.md b/CHANGELOG.md
index d84370c..2257a07 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,13 @@
 
 ## Unreleased
 
+## 0.4.0
+
 - Add offline scope evidence for classic `products/update` and `orders/create` subscriptions in `shopify.app.toml`, with separate EVIDENCED, NOT EVIDENCED, and UNKNOWN results from Shopify Events.
 - Expose classic webhook evidence counts in human, JSON, SARIF, and GitHub Action outputs without including destinations or filter values.
-- Require Node.js 22 or newer for the CLI, test Node.js 22 and 24 in CI, and update GraphQL.js to 17.0.2. This drops Node.js 20 CLI support.
+- Upgrade GraphQL.js to 17.0.2.
+- Breaking: require Node.js 22 or newer for the CLI; Node.js 20 is no longer supported. The Action remains on Node.js 24; CI tests Node.js 22 and 24 plus the required Node.js 20 check.
+- Map `write_marketplace_orders` to its implied marketplace read scope for `orders/create`, while preserving UNKNOWN results and optional-scope uncertainty.
 - Correct the standalone GraphQL document support note and refresh the immutable Action example to the v0.3.0 commit.
 
 ## 0.3.0
diff --git a/dist/index.cjs b/dist/index.cjs
index 0a196c0..fca67db 100644
--- a/dist/index.cjs
+++ b/dist/index.cjs
@@ -2034,7 +2034,7 @@ var import_node_path3 = __toESM(require("node:path"), 1);
 var import_node_crypto = require("node:crypto");
 
 // src/version.js
-var TOOL_VERSION = "0.3.0";
+var TOOL_VERSION = "0.4.0";
 
 // src/analyzer/index.js
 var import_node_fs2 = __toESM(require("node:fs"), 1);
diff --git a/package-lock.json b/package-lock.json
index f4c3c8e..23a3446 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "shopify-scope-guard",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shopify-scope-guard",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "MIT",
       "dependencies": {
         "@iarna/toml": "^2.2.5",
diff --git a/package.json b/package.json
index d00307a..0a54aa6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "shopify-scope-guard",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Review Shopify app OAuth and API access scopes against static repository evidence with a CLI and GitHub Action.",
   "type": "module",
   "bin": {
diff --git a/src/version.js b/src/version.js
index 4687ae8..6cd6d11 100644
--- a/src/version.js
+++ b/src/version.js
@@ -1,2 +1,2 @@
 // Generated from package.json.
-export const TOOL_VERSION = "0.3.0";
+export const TOOL_VERSION = "0.4.0";