diff --git a/CHANGELOG.md b/CHANGELOG.md
index a9a584a29..ea970ab9b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## v5.4.4 - 2026-10-29
+
+**Proxy identity hardening**
+
+* Preserve the derived upstream `X-Real-IP` after hop-by-hop header stripping. A client can no longer remove that header with `Connection: X-Real-IP`, including duplicate or mixed-case nominations and WebSocket upgrades.
+* Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
+* Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: [#3200](https://github.com/labstack/echo/pull/3200).
+
+v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.
 
 ## v5.4.0 - 2026-09-27
 
diff --git a/version.go b/version.go
index 9d6b7203b..b05b42859 100644
--- a/version.go
+++ b/version.go
@@ -5,5 +5,5 @@ package echo
 
 const (
 	// Version of Echo
-	Version = "5.4.3"
+	Version = "5.4.4"
 )