diff --git a/.changelog/5430.trivial.md b/.changelog/5430.trivial.md
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/.changelog/5436.feature.md b/.changelog/5436.feature.md
deleted file mode 100644
index 2cfcf5f5898..00000000000
--- a/.changelog/5436.feature.md
+++ /dev/null
@@ -1,4 +0,0 @@
-go/consensus/roothash: Filter executor commitments by runtime ID
-
-Compute executor committee workers no longer have to verify the signatures
-of observed commitments simply to identify them as invalid.
diff --git a/.changelog/5438.bugfix.2.md b/.changelog/5438.bugfix.2.md
deleted file mode 100644
index 97da869af33..00000000000
--- a/.changelog/5438.bugfix.2.md
+++ /dev/null
@@ -1 +0,0 @@
-go/worker/compute: Bound batch execution time
diff --git a/.changelog/5438.bugfix.md b/.changelog/5438.bugfix.md
deleted file mode 100644
index 72a6b617761..00000000000
--- a/.changelog/5438.bugfix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-go/runtime/host/sandbox: Release lock before calling into runtime
-
-Similar to how this is handled in the multi runtime host, we need to
-release the lock before calling into the runtime as otherwise this could
-lead to a deadlock in certain situations.
diff --git a/.changelog/5442.bugfix.md b/.changelog/5442.bugfix.md
deleted file mode 100644
index fcdcc7b9a40..00000000000
--- a/.changelog/5442.bugfix.md
+++ /dev/null
@@ -1 +0,0 @@
-go/runtime/host/protocol/connection: Cancel call if connection is closed
diff --git a/.punch_version.py b/.punch_version.py
index 42c8b12965d..b199baf9d75 100644
--- a/.punch_version.py
+++ b/.punch_version.py
@@ -1,3 +1,3 @@
 year = '23'
 minor = 0
-micro = 3
+micro = 4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad90e1bad57..27f3e8d937d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,37 @@ The format is inspired by [Keep a Changelog].
 
 <!-- TOWNCRIER -->
 
+## 23.0.4 (2023-11-14)
+
+| Protocol          | Version   |
+|:------------------|:---------:|
+| Consensus         | 7.0.0     |
+| Runtime Host      | 5.1.0     |
+| Runtime Committee | 5.0.0     |
+
+### Features
+
+- go/consensus/roothash: Filter executor commitments by runtime ID
+  ([#5436](https://github.com/oasisprotocol/oasis-core/issues/5436))
+
+  Compute executor committee workers no longer have to verify the signatures
+  of observed commitments simply to identify them as invalid.
+
+### Bug Fixes
+
+- go/runtime/host/sandbox: Release lock before calling into runtime
+  ([#5438](https://github.com/oasisprotocol/oasis-core/issues/5438))
+
+  Similar to how this is handled in the multi runtime host, we need to
+  release the lock before calling into the runtime as otherwise this could
+  lead to a deadlock in certain situations.
+
+- go/worker/compute: Bound batch execution time
+  ([#5438](https://github.com/oasisprotocol/oasis-core/issues/5438))
+
+- go/runtime/host/protocol/connection: Cancel call if connection is closed
+  ([#5442](https://github.com/oasisprotocol/oasis-core/issues/5442))
+
 ## 23.0.3 (2023-11-08)
 
 | Protocol          | Version   |