diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..6142d1b
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+## 0.4.1 - 2026-09-30
+
+### Fixed
+
+- Encode non-Latin-1 route metadata before placing it in the `x-askr-head`
+  response header, preventing HTTP 500 responses for Unicode titles and
+  descriptions.
+- Percent-encode Unicode redirect locations while preserving existing percent
+  escapes, so internationalized paths produce valid `Location` headers.
diff --git a/package-lock.json b/package-lock.json
index cff42bc..1f15347 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@askrjs/server",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@askrjs/server",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@askrjs/auth": ">=0.4.0 <0.5.0",
diff --git a/package.json b/package.json
index ca79175..ba6abbe 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/server",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Transport-neutral HTTP application core built on Web Request and Response",
   "keywords": [
     "askr",