diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fdd474d..4d1d4dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby-version: [ "3.3", "3.4" ]
+        ruby-version: [ "3.3", "3.4", "4.0" ]
         rails-version: [ "8.0", "8.1" ]
     env:
       RAILS_VERSION: ${{ matrix.rails-version }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 927f7bb..8a7e0d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- Add Ruby 4.0 to the compatibility matrix, which now covers Ruby 3.3, 3.4, and
+  4.0 against Rails 8.0 and 8.1.
+
 ## 0.9.0 - 2026-08-10
 
 - Add a browser test suite running the refresh modules against real Chromium and
diff --git a/docs/roadmap.md b/docs/roadmap.md
index e839512..8392dea 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -44,9 +44,9 @@
   gem's dependencies
 - Inline RBS generation/validation, Steep, Standard Ruby, Solid Queue's exact
   RuboCop policy, and a warning-free Brakeman scan
-- Compatibility CI across the supported span: Ruby 3.3 and 3.4 against Rails 8.0
-  and 8.1, pinned through `RAILS_VERSION` so the advertised range is verified
-  rather than assumed
+- Compatibility CI across the supported span: Ruby 3.3, 3.4, and 4.0 against
+  Rails 8.0 and 8.1, pinned through `RAILS_VERSION` so the advertised range is
+  verified rather than assumed
 - A JavaScript suite covering every browser module, run in CI with Node's test
   runner and jsdom, plus a browser suite running the same modules against real
   Chromium and a real Turbo build, with every GitHub Actions reference pinned to
@@ -86,8 +86,8 @@
 3. Add Turbo append intents and expand reconnect coverage in a full browser.
 4. Add distributed rate limits, global admission hooks, and cache-capacity
    eviction.
-5. Expand security scanning. Compatibility CI across supported Rails and Ruby
-   versions is implemented; Ruby 4.0 is not yet in the matrix.
+5. Expand security scanning beyond the Brakeman scan, such as dependency
+   auditing and secret scanning.
 6. Benchmark all workloads under documented hardware/database settings and
    publish adapter-specific adoption measurements. Throughput, synchronous
    latency, query counts, and the three reactive delivery paths are measured on