diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index dff3e040a..0fbe23262 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,6 +1,24 @@
 Changelog
 =========
 
+3.9.4
+-----
+
+Improvements:
+
+* Dependency updates (#1727, #1732, #1734, #1739).
+
+Bugfixes:
+
+* Prevent key deduplication to identify different AWS KMS keys that only differ by role, context, or profile (#1733).
+* Update part of Azure SDK which prevented decryption in some cases (#1695, #1734).
+
+Project changes:
+
+* CI dependency updates (#1730, #1738).
+* Rust dependency updates (#1728, #1731, #1735).
+
+
 3.9.3
 -----
 
diff --git a/version/version.go b/version/version.go
index 4f7c6ed9f..3b21a6cb0 100644
--- a/version/version.go
+++ b/version/version.go
@@ -12,7 +12,7 @@ import (
 )
 
 // Version represents the value of the current semantic version.
-var Version = "3.9.3"
+var Version = "3.9.4"
 
 // PrintVersion prints the current version of sops. If the flag
 // `--disable-version-check` is set, the function will not attempt