diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4402b5..73dc5e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,11 @@ Note that 0.3.3 was never released; 0.3.4 follows 0.3.2.
 
 ## [Unreleased]
 
+0.5.0 contains breaking changes; read
+[Migrating to 0.5.0](https://fastapi-cachex.readthedocs.io/en/stable/MIGRATING_0_5/)
+before upgrading. Sessions and OAuth state, deprecated in 0.4.0, are removed,
+and the dependency floors are lower. 0.4.1 is the last 0.4.x release.
+
 ## [0.4.1] - 2026-10-03
 
 ### Changed
diff --git a/CLAUDE.md b/CLAUDE.md
index 1322df6..f1236c0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@ Guidance for Claude Code in this repository. It lists only what the code, `pypro
 
 ## Project
 
-`fastapi_cachex` (PyPI `fastapi-cachex`): HTTP caching, application cache and a distributed lock for FastAPI, on pluggable backends (memory, Redis, Memcached). The 0.4 line is current (0.4.0 released 2026-10-02). `release.yml` releases only from `master`, so `master` stays 0.4.x-compatible: merging breaking 0.5.0 work (milestone `0.5.0`) ends 0.4.x patch releases. 0.5.0 removes sessions and OAuth state (`fastapi_cachex.session`, `fastapi_cachex.state`, deprecated in 0.4.0 by #420; removed by #421); `docs/MIGRATING_0_5.md` covers the move.
+`fastapi_cachex` (PyPI `fastapi-cachex`): HTTP caching, application cache and a distributed lock for FastAPI, on pluggable backends (memory, Redis, Memcached). `master` carries 0.5.0, so 0.4.x gets no further releases (0.4.1, 2026-10-03, was the last); `release.yml` releases only from `master`. 0.5.0 removes sessions and OAuth state (`fastapi_cachex.session`, `fastapi_cachex.state`, deprecated in 0.4.0 by #420; removed by #421); `docs/MIGRATING_0_5.md` covers the move. Merging breaking work for the next minor ends 0.5.x patch releases the same way.
 
 ## Commands
 
diff --git a/SECURITY.md b/SECURITY.md
index 35a9a32..de65578 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -3,15 +3,17 @@
 ## Supported versions
 
 Security fixes are released for the latest release line only, currently
-0.4.x. Upgrade to the newest 0.4.x release before reporting, and check whether
+0.5.x. Upgrade to the newest 0.5.x release before reporting, and check whether
 the problem is still there.
 
 | Version           | Supported |
 |-------------------|-----------|
-| Latest 0.4.x      | Yes       |
-| 0.3.9 and older   | No        |
+| Latest 0.5.x      | Yes       |
+| 0.4.1 and older   | No        |
 
-A fix ships as a new 0.4.x patch release; earlier releases are not patched.
+A fix ships as a new 0.5.x patch release; earlier releases are not patched.
+0.4.x gets no further releases: move to 0.5.x with
+[Migrating to 0.5.0](https://fastapi-cachex.readthedocs.io/en/stable/MIGRATING_0_5/).
 
 ## Reporting a vulnerability
 
@@ -50,7 +52,7 @@ guaranteed response times. What you can expect:
 - An acknowledgement once a maintainer has read the report, and a follow-up
   after it has been looked into, saying whether it is being treated as a
   vulnerability.
-- If it is, a fix in a new 0.4.x patch release, followed by a published GitHub
+- If it is, a fix in a new 0.5.x patch release, followed by a published GitHub
   security advisory that credits you, unless you prefer not to be named.
 - Questions in the advisory thread if the report needs more detail.