diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5981aa8..bfb2d0f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,29 @@ All notable changes to bootintel-cli are documented here. Format follows [Keep a
 
 ## [Unreleased]
 
+## [0.4.1] — 2026-09-26 — publishable to crates.io
+
+No user-visible behaviour change, so PATCH per the policy above.
+
+### Changed
+- **The crates can now be published.** `crates/cli` carried
+  `publish = false`, present only to satisfy cargo-deny's wildcard-dep
+  check because `bootintel-detectors` was declared as a bare path
+  dependency. That dependency now carries both a path and a version:
+  cargo uses the path for local builds and the version when packaging.
+  `cargo deny check` still reports advisories, bans, licenses and
+  sources all ok, so the workaround was no longer earning its keep.
+- The release workflow gained an opt-in `publish_crates` input and a
+  `publish-crates` job. It refuses to start without
+  `CARGO_REGISTRY_TOKEN`, because a crates.io version can be yanked but
+  never reused, so a half-publish would burn the version permanently.
+  The library is published before the binary crate and the job waits for
+  index consistency in between, which is not optional: `cargo package -p
+  bootintel-cli` fails with `no matching package named
+  bootintel-detectors` otherwise.
+- Added `docs/releasing.md`, and refreshed four stale `cli-v0.3.1`
+  references in the README.
+
 ## [0.4.0] — 2026-09-25 — correctness batch: capture loss, CI gates, detector robustness
 
 Numbered 0.4.0 rather than 1.0.0. The policy above calls an exit-code
@@ -306,7 +329,8 @@ Initial release. All six subcommands live; five branch-based milestones (M1-M5)
 - PDF report download subcommand — server-side endpoint exists but no client-side wrapper yet.
 - Windows support — the Rust code compiles for Windows and the release workflow builds it, but install.sh doesn't handle Windows yet (`.ps1` installer is a follow-up).
 
-[Unreleased]: https://github.com/bootintel/cli/compare/cli-v0.4.0...HEAD
+[Unreleased]: https://github.com/bootintel/cli/compare/cli-v0.4.1...HEAD
+[0.4.1]: https://github.com/bootintel/cli/releases/tag/cli-v0.4.1
 [0.4.0]: https://github.com/bootintel/cli/releases/tag/cli-v0.4.0
 [0.3.1]: https://github.com/bootintel/cli/releases/tag/cli-v0.3.1
 [0.3.0]: https://github.com/bootintel/cli/releases/tag/cli-v0.3.0
diff --git a/Cargo.lock b/Cargo.lock
index b67cacd..bf0cb82 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -131,7 +131,7 @@ checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "bootintel-cli"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "anyhow",
  "arboard",
@@ -154,7 +154,7 @@ dependencies = [
 
 [[package]]
 name = "bootintel-detectors"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "regex",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 6a697b0..4d35cd2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,7 +19,7 @@ members = ["crates/detectors", "crates/cli"]
 resolver = "2"
 
 [workspace.package]
-version = "0.4.0"
+version = "0.4.1"
 edition = "2021"
 rust-version = "1.90"
 license = "Apache-2.0"
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 1d3da46..fa33bbd 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -19,7 +19,7 @@ path = "src/main.rs"
 # version when packaging for crates.io, which rejects a bare path dep.
 # This is what publish = false was working around; publishing
 # bootintel-detectors first makes the workaround unnecessary.
-bootintel-detectors = { path = "../detectors", version = "0.4.0" }
+bootintel-detectors = { path = "../detectors", version = "0.4.1" }
 clap = { version = "4.5", features = ["derive", "wrap_help", "env"] }
 # Shell-completion emitters for `bootintel completions <shell>`. Version
 # tracks the clap major/minor (4.5). No default features — we only use