diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 525eb75..4348f50 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -32,7 +32,7 @@ jobs:
           echo "✓ Unreleased changelog has content"
 
       - name: Validate CHANGELOG.md is Keep a Changelog compliant
-        uses: ConfiguredThings/validate-changelog-action@v2
+        uses: ConfiguredThings/validate-changelog-action@v4
 
       - run: npm run build
       - run: npm run lint
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b6da608..e9ced33 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,7 +58,7 @@ jobs:
           echo "✓ Comparison link found for $VERSION"
 
       - name: Validate CHANGELOG.md is Keep a Changelog compliant
-        uses: ConfiguredThings/validate-changelog-action@v2
+        uses: ConfiguredThings/validate-changelog-action@v4
 
       - uses: actions/setup-java@v6
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 52f8def..87c5132 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `npm run lint` crashed outright under `typescript@7` (a `TypeError` inside `typescript-eslint`'s `typescript-estree`), which had been masking two real `prettier/prettier` formatting errors in `docs-site/src/components/GrammarDropZone.tsx` and `src/cli/rdp-gen.ts`. Now that the `typescript` downgrade lets lint actually run, ran `eslint --fix` to clear both.
 - `CHANGELOG.md` ended up with two separate `### Fixed` subsections under `## [Unreleased]` after two PRs landed back to back, each adding its own — exactly the duplicate-subsection mistake the new linter (above) is meant to catch. Merged them into one.
 
+### Changed
+
+- Bump `ConfiguredThings/validate-changelog-action` from 2 to 4
+
 ## [0.7.0] - 2026-04-20
 
 ### Added