diff --git a/Cargo.lock b/Cargo.lock
index 786e9146..dbd943e8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3081,7 +3081,7 @@ dependencies = [
 
 [[package]]
 name = "rind"
-version = "0.3.3"
+version = "0.4.0"
 dependencies = [
  "aws-lc-rs",
  "aws-lc-sys",
@@ -3246,7 +3246,7 @@ dependencies = [
 
 [[package]]
 name = "rind-rcgen"
-version = "0.14.3"
+version = "0.14.4"
 dependencies = [
  "base64ct",
  "crabgrind 0.4.0",
@@ -3260,7 +3260,7 @@ dependencies = [
 
 [[package]]
 name = "rind-ring"
-version = "0.17.3"
+version = "0.17.4"
 dependencies = [
  "aws-lc-rs",
  "crabgrind 0.4.0",
@@ -3274,7 +3274,7 @@ dependencies = [
 
 [[package]]
 name = "rind-rustls"
-version = "0.23.3"
+version = "0.23.4"
 dependencies = [
  "crabgrind 0.4.0",
  "env_logger",
@@ -3292,7 +3292,7 @@ dependencies = [
 
 [[package]]
 name = "rind-str0m"
-version = "0.25.2"
+version = "0.25.3"
 dependencies = [
  "crabgrind 0.4.0",
  "dimpl",
diff --git a/README.md b/README.md
index 478f5d48..2eaf22be 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ ring = { package = "rind-ring", version = "0.17" }
 aws-lc-rs = { package = "rind-aws-lc-rs", version = "1" }
 
 # Or use rind's own API.
-rind = "0.3"
+rind = "0.4"
 ```
 
 ### With rustls
@@ -143,7 +143,7 @@ and wipes the adapter's own copies of secrets.
 
 ```toml
 [dependencies]
-rind = { version = "0.3", features = ["wipe"] }
+rind = { version = "0.4", features = ["wipe"] }
 ```
 
 ## Data-independent timing
diff --git a/rind-aws-lc-rs/Cargo.toml b/rind-aws-lc-rs/Cargo.toml
index a5eedd34..b0e1c623 100644
--- a/rind-aws-lc-rs/Cargo.toml
+++ b/rind-aws-lc-rs/Cargo.toml
@@ -39,7 +39,7 @@ unstable = []
 wipe = ["rind/wipe"]
 
 [dependencies]
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 untrusted = "0.7.1"
 zeroize = "1.9"
 
diff --git a/rind-dart/Cargo.toml b/rind-dart/Cargo.toml
index a82ccf89..5f40f318 100644
--- a/rind-dart/Cargo.toml
+++ b/rind-dart/Cargo.toml
@@ -17,7 +17,7 @@ name = "rind_dart"
 crate-type = ["cdylib"]
 
 [dependencies]
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 
 [dev-dependencies]
 # Requests reach valgrind only once `rind/__ctgrind` turns on crabgrind's default
diff --git a/rind-dimpl/Cargo.toml b/rind-dimpl/Cargo.toml
index 68ec25d6..c0aa6032 100644
--- a/rind-dimpl/Cargo.toml
+++ b/rind-dimpl/Cargo.toml
@@ -15,7 +15,7 @@ readme = "README.md"
 # Without it a custom provider cannot enforce that, and it adds only the DER
 # parsers this crate already needs to read certificates.
 dimpl = { version = "0.9", default-features = false, features = ["_crypto-common"] }
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 x509-cert = { version = "0.3", default-features = false }
 
 [dev-dependencies]
diff --git a/rind-jsonwebtoken/Cargo.toml b/rind-jsonwebtoken/Cargo.toml
index c0385436..25868772 100644
--- a/rind-jsonwebtoken/Cargo.toml
+++ b/rind-jsonwebtoken/Cargo.toml
@@ -10,7 +10,7 @@ rust-version.workspace = true
 readme = "README.md"
 
 [dependencies]
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 jsonwebtoken = { version = "11.1", default-features = false }
 pkcs1 = { version = "0.7.5", default-features = false, features = ["alloc"] }
 
diff --git a/rind-object-store/Cargo.toml b/rind-object-store/Cargo.toml
index fa2e26e2..4d58cd8c 100644
--- a/rind-object-store/Cargo.toml
+++ b/rind-object-store/Cargo.toml
@@ -13,7 +13,7 @@ readme = "README.md"
 # object_store exposes its CryptoProvider only with a cloud backend enabled;
 # gcp-base is the one that adds no dependencies beyond the shared cloud-base.
 object_store = { version = "0.14", default-features = false, features = ["gcp-base"] }
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 rustls-pki-types = { version = "1.9", default-features = false, features = ["std"] }
 
 [dev-dependencies]
diff --git a/rind-python/Cargo.toml b/rind-python/Cargo.toml
index 078bf967..3974e2bd 100644
--- a/rind-python/Cargo.toml
+++ b/rind-python/Cargo.toml
@@ -21,7 +21,7 @@ test = false
 doctest = false
 
 [dependencies]
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 # The stable ABI from 3.11, the oldest CPython still supported and the first
 # whose stable ABI has the buffer protocol, so one wheel per platform covers
 # every CPython since.
diff --git a/rind-rcgen/Cargo.toml b/rind-rcgen/Cargo.toml
index 12924c69..dcf7f57b 100644
--- a/rind-rcgen/Cargo.toml
+++ b/rind-rcgen/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-rcgen"
-version = "0.14.3"
+version = "0.14.4"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -22,7 +22,7 @@ zeroize = []
 [dependencies]
 base64ct = { version = "1.8", optional = true, features = ["alloc"] }
 rcgen = { version = "0.14", default-features = false }
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 rustls-pki-types = "1.12"
 zeroize = "1.9"
 
diff --git a/rind-ring/Cargo.toml b/rind-ring/Cargo.toml
index 29564e26..dfa1a068 100644
--- a/rind-ring/Cargo.toml
+++ b/rind-ring/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-ring"
-version = "0.17.3"
+version = "0.17.4"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -26,7 +26,7 @@ dev_urandom_fallback = []
 std = ["alloc"]
 
 [dependencies]
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 untrusted = "0.9"
 
 [dev-dependencies]
diff --git a/rind-rustls/Cargo.toml b/rind-rustls/Cargo.toml
index f67e2d8f..fcd40353 100644
--- a/rind-rustls/Cargo.toml
+++ b/rind-rustls/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-rustls"
-version = "0.23.3"
+version = "0.23.4"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -10,7 +10,7 @@ rust-version.workspace = true
 readme = "README.md"
 
 [dependencies]
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 rustls = { version = "0.23.20", default-features = false, features = ["std", "tls12"] }
 
 [dev-dependencies]
diff --git a/rind-str0m/Cargo.toml b/rind-str0m/Cargo.toml
index 71032beb..106c7d92 100644
--- a/rind-str0m/Cargo.toml
+++ b/rind-str0m/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind-str0m"
-version = "0.25.2"
+version = "0.25.3"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "Apache-2.0 OR ISC OR MIT-0"
@@ -12,7 +12,7 @@ readme = "README.md"
 [dependencies]
 dimpl = { version = "0.9", default-features = false }
 rcgen = { version = "0.14", default-features = false }
-rind = { version = "0.3.2", path = "../rind" }
+rind = { version = "0.4.0", path = "../rind" }
 rind-dimpl = { version = "0.9.3", path = "../rind-dimpl" }
 rind-rcgen = { version = "0.14.3", path = "../rind-rcgen" }
 # Its default features compile aws-lc-rs.
diff --git a/rind/Cargo.toml b/rind/Cargo.toml
index 8710622b..fa3c4bfa 100644
--- a/rind/Cargo.toml
+++ b/rind/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rind"
-version = "0.3.3"
+version = "0.4.0"
 edition = "2024"
 repository = "https://github.com/moq-dev/rind"
 license = "(Apache-2.0 OR ISC OR MIT-0) AND (Apache-2.0 OR ISC OR MIT) AND Apache-2.0 AND ISC AND BSD-3-Clause"