diff --git a/.github/workflows/_build_artifacts.yml b/.github/workflows/_build_artifacts.yml
index 3323de6ae..d3504e492 100644
--- a/.github/workflows/_build_artifacts.yml
+++ b/.github/workflows/_build_artifacts.yml
@@ -154,9 +154,9 @@ jobs:
             artifact: firezone-client-headless-linux
             image_name: client
             # mark:next-headless-version
-            release_name: headless-client-1.4.0
+            release_name: headless-client-1.4.1
             # mark:next-headless-version
-            version: 1.4.0
+            version: 1.4.1
           - package: firezone-relay
             artifact: firezone-relay
             image_name: relay
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 525d03f46..bfb3589ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
           - release_name: gateway-1.4.3
             config_name: release-drafter-gateway.yml
           # mark:next-headless-version
-          - release_name: headless-client-1.4.0
+          - release_name: headless-client-1.4.1
             config_name: release-drafter-headless-client.yml
           # mark:next-gui-version
           - release_name: gui-client-1.4.1
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 650f9d88d..8b2555ee9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -42,7 +42,7 @@ jobs:
           elif [[ "${{ github.event.release.name }}" =~ headless* ]]; then
             ARTIFACT=client
             # mark:next-headless-version
-            VERSION="1.4.0"
+            VERSION="1.4.1"
           else
             echo "Shouldn't have gotten here. Exiting."
             exit 1
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 17cc1b2dc..d75e0c3be 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -2068,7 +2068,7 @@ dependencies = [
 
 [[package]]
 name = "firezone-headless-client"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "atomicwrites",
diff --git a/rust/headless-client/Cargo.toml b/rust/headless-client/Cargo.toml
index 9c9b1e9ff..b705fc1f5 100644
--- a/rust/headless-client/Cargo.toml
+++ b/rust/headless-client/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "firezone-headless-client"
 # mark:next-headless-version
-version = "1.4.0"
+version = "1.4.1"
 edition = { workspace = true }
 authors = ["Firezone, Inc."]
 license = { workspace = true }
diff --git a/scripts/Makefile b/scripts/Makefile
index 898a962ff..3eb9fc79f 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -22,14 +22,14 @@ current-apple-version = 1.3.9
 current-android-version = 1.3.7
 current-gateway-version = 1.4.2
 current-gui-version = 1.4.0
-current-headless-version = 1.3.7
+current-headless-version = 1.4.0
 
 # Tracks the next version to release for each platform
 next-apple-version = 1.4.0
 next-android-version = 1.4.0
 next-gateway-version = 1.4.3
 next-gui-version = 1.4.1
-next-headless-version = 1.4.0
+next-headless-version = 1.4.1
 
 # macOS uses a slightly different sed syntax
 ifeq ($(shell uname),Darwin)
diff --git a/website/redirects.js b/website/redirects.js
index ed504bdc4..0e0d67307 100644
--- a/website/redirects.js
+++ b/website/redirects.js
@@ -36,21 +36,21 @@ module.exports = [
     source: "/dl/firezone-client-headless-linux/latest/x86_64",
     destination:
       // mark:current-headless-version
-      "https://www.github.com/firezone/firezone/releases/download/headless-client-1.3.7/firezone-client-headless-linux_1.3.7_x86_64",
+      "https://www.github.com/firezone/firezone/releases/download/headless-client-1.4.0/firezone-client-headless-linux_1.4.0_x86_64",
     permanent: false,
   },
   {
     source: "/dl/firezone-client-headless-linux/latest/aarch64",
     destination:
       // mark:current-headless-version
-      "https://www.github.com/firezone/firezone/releases/download/headless-client-1.3.7/firezone-client-headless-linux_1.3.7_aarch64",
+      "https://www.github.com/firezone/firezone/releases/download/headless-client-1.4.0/firezone-client-headless-linux_1.4.0_aarch64",
     permanent: false,
   },
   {
     source: "/dl/firezone-client-headless-linux/latest/armv7",
     destination:
       // mark:current-headless-version
-      "https://www.github.com/firezone/firezone/releases/download/headless-client-1.3.7/firezone-client-headless-linux_1.3.7_armv7",
+      "https://www.github.com/firezone/firezone/releases/download/headless-client-1.4.0/firezone-client-headless-linux_1.4.0_armv7",
     permanent: false,
   },
   /*
diff --git a/website/src/app/api/releases/route.ts b/website/src/app/api/releases/route.ts
index 5b9dcb512..cb7369225 100644
--- a/website/src/app/api/releases/route.ts
+++ b/website/src/app/api/releases/route.ts
@@ -11,7 +11,7 @@ export async function GET(_req: NextRequest) {
     // mark:current-gui-version
     gui: "1.4.0",
     // mark:current-headless-version
-    headless: "1.3.7",
+    headless: "1.4.0",
     // mark:current-gateway-version
     gateway: "1.4.2",
   };
diff --git a/website/src/components/Changelog/Headless.tsx b/website/src/components/Changelog/Headless.tsx
index 347d572c1..8e78688cc 100644
--- a/website/src/components/Changelog/Headless.tsx
+++ b/website/src/components/Changelog/Headless.tsx
@@ -11,7 +11,8 @@ export default function Headless() {
   return (
     <Entries href={href} arches={arches} title="Linux headless">
       {/* When you cut a release, remove any solved issues from the "known issues" lists over in `client-apps`. This must not be done when the issue's PR merges. */}
-      <Unreleased>
+      <Unreleased></Unreleased>
+      <Entry version="1.4.0" date={new Date("2024-12-13")}>
         <ChangeItem pull="7350">
           Allows disabling telemetry by setting `FIREZONE_NO_TELEMETRY=true`.
         </ChangeItem>
@@ -30,7 +31,7 @@ export default function Headless() {
         <ChangeItem pull="7477">
           Improves connection setup latency by buffering initial packets.
         </ChangeItem>
-      </Unreleased>
+      </Entry>
       <Entry version="1.3.7" date={new Date("2024-11-15")}>
         <ChangeItem pull="7334">
           Fixes an issue where symmetric NATs would generate unnecessary