diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f358909..e9a62a87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [4.0.0](https://github.com/awslabs/fhir-works-on-aws-deployment/compare/v3.1.0...v4.0.0) (2021-08-18)
+
+
+### ⚠ BREAKING CHANGES
+
+* The Cognito `IdToken` is now used instead of the `AccessToken` to authorize requests.
+
+Multi-tenancy itself is not a breaking change, you can continue to use FHIR works on single-tenant mode 
+by not using the `enableMultiTenancy` flag. 
+  
+However, note that updating an existing (single-tenant) stack to enable multi-tenancy is a breaking change. Multi-tenant 
+deployments use a different data partitioning strategy that renders the old, single-tenant, data inaccessible. 
+
+### Features
+
+* Implement multi-tenancy and group export ([#416](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/416)) ([a9aebcc](https://github.com/awslabs/fhir-works-on-aws-deployment/commit/a9aebcc182255d305327463b1b2e0f7a463bad95)), closes [#348](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/348) [#347](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/347) [#367](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/367) [#381](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/381) [#387](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/387) [#384](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/384) [#389](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/389) [#392](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/392) [#397](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/397) [#393](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/393) [#398](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/398) [#399](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/399) [#400](https://github.com/awslabs/fhir-works-on-aws-deployment/issues/400)
+  
+  Multi-tenancy allows a single `fhir-works-on-aws` stack to serve as multiple FHIR servers for different tenants.
+  Check out our [multi-tenancy documentation](USING_MULTI_TENANCY.md) for more details.
+
 ## [3.1.0](https://github.com/awslabs/fhir-works-on-aws-deployment/compare/v3.0.0...v3.1.0) (2021-08-17)
 
 ### Features
diff --git a/package.json b/package.json
index 0426f588..86875f14 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fhir-works-on-aws-deployment",
-  "version": "3.1.0",
+  "version": "4.0.0",
   "description": "FHIR Works on AWS deployment",
   "stackname": "fhir-works-on-aws-deployment",
   "main": "src/index.ts",
diff --git a/serverless.yaml b/serverless.yaml
index 3c5724c3..9870f721 100644
--- a/serverless.yaml
+++ b/serverless.yaml
@@ -54,7 +54,7 @@ provider:
       !Join ['', ['https://', !Ref UserPoolDomain, !Sub '.auth.${AWS::Region}.amazoncognito.com/oauth2']]
     EXPORT_RESULTS_BUCKET: !Ref BulkExportResultsBucket
     EXPORT_RESULTS_SIGNER_ROLE_ARN: !GetAtt ExportResultsSignerRole.Arn
-    CUSTOM_USER_AGENT: 'AwsLabs/SO0128/3.0.0'
+    CUSTOM_USER_AGENT: 'AwsLabs/SO0128/4.0.0'
     VALIDATOR_LAMBDA_ALIAS:
       !If
         - isUsingHapiValidator