diff --git a/CHANGELOG.md b/CHANGELOG.md
index f22e4d4..8c50c6a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,23 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Upgrading from 0.3
+
+- Back up first (`sudo jarld backup`).
+- When jarld first starts, it rewrites named's configuration: options
+  move into their new fixed order, and every view gets its view key in
+  `match-clients` and `keys.conf`. It is checked with named-checkconf
+  before named reloads, like any apply. Files you changed by hand are left
+  alone; the log then says to run `jarl resync`.
+- The systemd unit changed (it allows `AF_NETLINK`). The package replaces
+  it; an override that adds `AF_NETLINK` (`systemctl edit jarl`) does no
+  harm and can be removed.
+- The database moves to schema 7 (disabled zones) as jarld starts.
+- If statistics showed a spike after views were created or changed, see
+  "Statistics" under Fixed: the bad minutes can be removed from
+  `/var/lib/jarl/stats.db` (minute rows have `res = 'm'`; the hours and
+  days that include them are `'h'` and `'d'`).
+
 ### Added
 
 - View keys: every view gets a TSIG key, `jarl-view-NAME`, at the front of
diff --git a/README.md b/README.md
index dbe7a20..1b7354e 100644
--- a/README.md
+++ b/README.md
@@ -172,7 +172,7 @@ review step.
 ## Status
 
 Version 0.3.0 is the current release, and 0.4.0 is in testing
-(0.4.0-rc.3): it adds blocking (blocklists and your own rules, like
+(0.4.0-rc.4): it adds blocking (blocklists and your own rules, like
 Pi-hole, done by named), disabling zones, server statistics and view keys. 0.3.0 added disabled records, script-friendly
 CLI output and client names in the statistics, on top of 0.2.0's DNSSEC
 signing, Porkbun support, two-factor login and view colours. Jarl is feature-complete for one server's configuration.
diff --git a/VERSION b/VERSION
index 2170870..887e927 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.4.0-rc.3
+0.4.0-rc.4