diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 8eb3251..39e85a1 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -26,7 +26,7 @@
   "modules/aws-route53-zones": "0.1.0",
   "modules/aws-mongodbatlas-access": "0.1.0",
   "modules/aws-centralized-logging": "0.1.0",
-  "modules/aws-waf": "0.3.0",
+  "modules/aws-waf": "0.4.0",
   "modules/aws-elasticsearch": "0.1.0",
   "modules/aws-msk-apache-kafka-cluster-master": "0.2.2",
   "modules/aws-guardduty-master": "0.1.0",
diff --git a/modules/aws-waf/CHANGELOG.md b/modules/aws-waf/CHANGELOG.md
index 0f9c544..10499a6 100644
--- a/modules/aws-waf/CHANGELOG.md
+++ b/modules/aws-waf/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.4.0](https://github.com/kloia/platform-modules/compare/aws-waf-v0.3.0...aws-waf-v0.4.0) (2026-09-02)
+
+
+### Features
+
+* **aws-waf,aws-shield:** add Anti-DDoS rule overrides + Shield subscription ([#338](https://github.com/kloia/platform-modules/issues/338)) ([d8a23b2](https://github.com/kloia/platform-modules/commit/d8a23b26493e9b8575274678feaa5b0af1c398f8))
+
 ## [0.3.0](https://github.com/kloia/platform-modules/compare/aws-waf-v0.2.0...aws-waf-v0.3.0) (2026-06-18)
 
 
diff --git a/modules/aws-waf/versions.tf b/modules/aws-waf/versions.tf
index 683404e..752c4ad 100644
--- a/modules/aws-waf/versions.tf
+++ b/modules/aws-waf/versions.tf
@@ -3,7 +3,7 @@ terraform {
     aws = {
       source = "hashicorp/aws"
       # rule_action_override + managed_rule_group_configs.aws_managed_rules_anti_ddos_rule_set
-      # require v6.1.0 (https://github.com/hashicorp/terraform-provider-aws/blob/v6.1.0/CHANGELOG.md,
+      # require v0.4.0 (https://github.com/hashicorp/terraform-provider-aws/blob/v0.4.0/CHANGELOG.md,
       # PR #43149). Callers not using those fields still work on older 6.x,
       # but pinning here prevents a stale lock file from silently resolving
       # a provider that predates this schema.