diff --git a/CHANGELOG.md b/CHANGELOG.md
index bdd3cbd..0d10954 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,40 @@ All notable changes to Library Desk will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0] - 2025-12-24
+
+### Added
+
+- **Maintenance Router** - New `/maintenance` endpoints for system health and cleanup
+  - `GET /maintenance/health` - Lightweight health check (detailed mode available)
+  - `POST /maintenance/cleanup/all` - Full orphan cleanup (vectors + graph)
+  - `POST /maintenance/cleanup/vectors` - Purge orphan vector chunks
+  - `POST /maintenance/cleanup/graph` - Purge orphan graph nodes
+  - `POST /maintenance/reconcile-index` - Combined cleanup + reindex missing pages
+- **Bidirectional Orphan Detection** - Cross-validate vectors and graph nodes
+  - `find_documents_without_vectors()` - Graph nodes missing vector chunks
+  - `find_chunks_without_graph_nodes()` - Vector chunks missing graph nodes
+- **Qdrant Client Methods** - Bulk operations for maintenance
+  - `scroll_all_points()` - Iterate all points with pagination
+  - `delete_by_ids()` - Batch delete by point IDs
+- **Graph Service Cleanup** - Node deletion methods
+  - `delete_document_node()` - Remove document and relationships
+  - `delete_collection_node()` - Remove collection and contained documents
+  - `get_all_document_references()` - Get all document references for validation
+- **Redis Timestamp Tracking** - `last_cleanup` timestamp for scheduler integration
+- **Memory System Plan** - Documented three-tier architecture (volatile/documents/knowledge)
+
+### Changed
+
+- **Wiki.js Authentication** - Switched from username/password to API token
+  - New `WIKI_GRAPHQL_API` environment variable for JWT token
+  - Deprecated `WIKIJS_USERNAME` and `WIKIJS_PASSWORD` (kept for backwards compatibility)
+- **Service Dependencies** - Added `VectorServiceDep` and `GraphServiceDep` type aliases
+
+### Fixed
+
+- Wiki.js client now properly handles API token auth without login flow
+
 ## [1.3.3] - 2025-12-23
 
 ### Added
diff --git a/pyproject.toml b/pyproject.toml
index 3f3d13b..9650620 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "library-desk"
-version = "1.3.3"
+version = "1.4.0"
 description = "Coordination service for The Library system - HybridRAG queries, document ingestion, entity extraction, and knowledge consolidation"
 readme = "README.md"
 requires-python = ">=3.12"