diff --git a/CHANGELOG.md b/CHANGELOG.md
index 73da9dd..ce57437 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## v3.10.4 (2026-05-25)
+
+**Security: OAuth Secrets Editor + Import JSON**
+
+### Security
+- **All hardcoded OAuth secrets removed from source code and git history**
+- OAuth client IDs and secrets now stored locally in `~/.config/codex-launcher/oauth-secrets.json`
+- Git history rewritten to scrub all leaked credentials (0 matches verified)
+- Pre-push hook blocks any future commit containing secrets
+- All old Gitea releases deleted (contained leaked secrets in .deb files)
+
+### New Features
+- **OAuth Secrets editor** in GUI — "OAuth Secrets" button in header bar
+- **Import JSON** button — import `client_secret_*.json` downloaded from Google Cloud Console
+- Supports both `"installed"` and `"web"` JSON formats from Google
+
+### Antigravity Fix (from v3.10.3)
+- Antigravity REST API uses slug IDs, not display names
+- Verified all model IDs with live API testing
+
 ## v3.10.3 (2026-05-25)
 
 **Fix Antigravity 404 Errors — Verified REST Model IDs**
diff --git a/codex-launcher_3.10.4_all.deb b/codex-launcher_3.10.4_all.deb
new file mode 100644
index 0000000..e6982ad
Binary files /dev/null and b/codex-launcher_3.10.4_all.deb differ
diff --git a/install.sh b/install.sh
index 04d7c3a..4b6631a 100755
--- a/install.sh
+++ b/install.sh
@@ -3,11 +3,11 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
-if [ -f "$SCRIPT_DIR/codex-launcher_3.10.3_all.deb" ]; then
-    echo "Installing codex-launcher_3.10.3_all.deb ..."
-    sudo dpkg -i "$SCRIPT_DIR/codex-launcher_3.10.3_all.deb"
+if [ -f "$SCRIPT_DIR/codex-launcher_3.10.4_all.deb" ]; then
+    echo "Installing codex-launcher_3.10.4_all.deb ..."
+    sudo dpkg -i "$SCRIPT_DIR/codex-launcher_3.10.4_all.deb"
     echo ""
-    echo "Installed v3.10.3 via .deb package."
+    echo "Installed v3.10.4 via .deb package."
     echo "  translate-proxy.py   -> /usr/bin/translate-proxy.py"
     echo "  codex-launcher-gui   -> /usr/bin/codex-launcher-gui"
     echo "  cleanup-codex-stale  -> /usr/bin/cleanup-codex-stale.sh"