diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 4c313f9..4918b25 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.4.0"
+  ".": "1.4.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c07f926..10ff849 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.4.1](https://github.com/rubykatzen/flightdeck/compare/v1.4.0...v1.4.1) (2026-10-10)
+
+
+### Bug Fixes
+
+* **rybbit:** grant clickhouse access_management for rybbit_query provisioning ([#226](https://github.com/rubykatzen/flightdeck/issues/226)) ([dab6a77](https://github.com/rubykatzen/flightdeck/commit/dab6a7763473afcbbac43d21fbfabc8187612d15))
+
 ## [1.4.0](https://github.com/rubykatzen/flightdeck/compare/v1.3.1...v1.4.0) (2026-10-10)
 
 
diff --git a/README.md b/README.md
index 6aa27f3..8d15767 100644
--- a/README.md
+++ b/README.md
@@ -293,12 +293,12 @@ Builds a zip archive from caller-selected paths, rejects runtime state and env f
 steps:
   - uses: actions/checkout@v7
     with:
-      ref: v1.4.0
-  - uses: rubykatzen/flightdeck/.github/actions/build-bundle@v1.4.0
+      ref: v1.4.1
+  - uses: rubykatzen/flightdeck/.github/actions/build-bundle@v1.4.1
     with:
       paths: apps
       bundle-name: flightdeck-apps.zip
-      release-tag: v1.4.0
+      release-tag: v1.4.1
       token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
@@ -318,10 +318,10 @@ A thin defaults wrapper around `build-bundle`: `paths` defaults to `apps`, `bund
 steps:
   - uses: actions/checkout@v7
     with:
-      ref: v1.4.0
-  - uses: rubykatzen/flightdeck/.github/actions/build-apps-bundle@v1.4.0
+      ref: v1.4.1
+  - uses: rubykatzen/flightdeck/.github/actions/build-apps-bundle@v1.4.1
     with:
-      release-tag: v1.4.0
+      release-tag: v1.4.1
       token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
@@ -351,7 +351,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: rubykatzen/flightdeck/.github/actions/deploy@v1.4.0
+      - uses: rubykatzen/flightdeck/.github/actions/deploy@v1.4.1
         id: deploy
         with:
           target-manifest: targets/mainframe.yml                          # required, path in this repository
@@ -362,7 +362,7 @@ jobs:
           # tailscale-oauth-secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}    # required only if tailscale-oauth-client-id is set
           # tailscale-tags: tag:ci                                          # default: tag:ci
       - name: Notify Telegram
-        uses: rubykatzen/baseline/.github/actions/send-telegram-message@v1.4.0
+        uses: rubykatzen/baseline/.github/actions/send-telegram-message@v1.4.1
         with:
           message: ${{ steps.deploy.outputs.telegram-message }}
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
@@ -372,7 +372,7 @@ jobs:
 
 <!-- x-release-please-end -->
 
-The `@v1.4.0` pin on the `uses:` line only controls which ref this action's own code runs at. `target-manifest`'s own `app_refs` entries are separate and don't have to match it. <!-- x-release-please-version -->
+The `@v1.4.1` pin on the `uses:` line only controls which ref this action's own code runs at. `target-manifest`'s own `app_refs` entries are separate and don't have to match it. <!-- x-release-please-version -->
 
 #### `deploy.yml`