diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..4dbf131
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,47 @@
+# CHANGELOG
+
+## Table of Contents
+
+* [v0.4.0](#v040)
+* [v0.3.0](#v030)
+* [v0.2.2](#v022)
+* [v0.2.1](#v021)
+* [v0.2.0](#v020)
+
+## v0.4.0
+
+- Use sodium_malloc() for the DNS query/response buffers
+- Fix stamp properties; add --nofilter
+- Only publish the most recent certificates
+- Include the signature in SignedCert
+- cache: do not forget to include the server PK in the hash computation
+- Implement a simple cache for shared keys
+- Add support for stamps (dnscrypt-proxy 2.x), and update the documentation
+- In key rotation, old certs should be provided too, see #109.
+- fixes #111, cert/key expires in 24 hours by default for safety see discussion: https://github.com/jedisct1/dnscrypt-proxy/issues/520
+- docs: suggest user to generate short-term key pairs and use key-rotation mechanism See #111.
+
+## v0.3.0
+
+- XChaCha20 supported
+- a lot of tests added
+- and many bug fixes and improvements
+
+## v0.2.2
+
+- remove GPLv2, release under the ISC license
+- update example secret key / cert, etc
+- fix compiler/linker flags handling
+
+## v0.2.1
+
+- Rename --provider-publickey-fingerprint to --show-provider-publickey-fingerprint. It's more conventional to use a verb if you want to do some action, like gen-provider-keypair.
+- Use TCP_QUICKACK instead of TCP_NODELAY if available (Linux 2.4.4+) See https://news.ycombinator.com/item?id=10608356
+- Send a short packet with TC set if the query_len < response_len
+- Support sending server cert over tcp
+- Use the certificate timestamp as a serial number instead of a fixed serial.
+- And some other minor fixes.
+
+## v0.2.0
+
+- Import argparse sources files directly.
diff --git a/docs/releasing.md b/docs/releasing.md
new file mode 100644
index 0000000..779f6ab
--- /dev/null
+++ b/docs/releasing.md
@@ -0,0 +1,38 @@
+# Releasing
+
+## How to do a release
+
+### Write change logs into CHANGELOG.md
+
+First, generate change logs with following command:
+
+```
+git log --oneline --no-merges v<previous_version>..HEAD | sed -r 's/^\w+/-/g'
+```
+
+With some manual edits, write changes logs to CHANGELOG.md.
+
+### Update version file
+
+Update version.h file and commit with "release: bumped version to
+<version>" as comment. Then create a PULL REQUEST with title "release
+v<version>" as release PR and change logs as contents.
+
+### Push a new tag and release
+
+Create a tag with `git tag -m 'v<version>' v<version>"` command, and
+push it to remote.
+
+Go to https://github.com/cofyc/dnscrypt-wrapper/releases/new to create a
+release on github.
+
+Starting from 0.4.0, we don't attach .zip and .tar.bz2 source files in release,
+because we don't have git sub-modules anymore, simply using github source
+tarballs is enough.
+
+## Version
+
+Follow https://semver.org/.
+
+Starting from 0.4.0, we don't omit minor and patch versions if they're
+`0', see discussion in https://github.com/semver/semver/issues/237.
diff --git a/version.h b/version.h
index 7d57a17..ef57cc5 100644
--- a/version.h
+++ b/version.h
@@ -2,6 +2,6 @@
 #ifndef VERSION_H
 #define VERSION_H
 
-const char *the_version = "0.3-20.g9ddd5a1";
+const char *the_version = "0.4.0";
 
 #endif