diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d15d08..a449d9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,42 @@ This project uses [Semantic Versioning] and generally follows the conventions of
 
 Important planned changes not yet bundled up will be listed here.
 
+## [0.4.1] - 2023-01-15
+
+Allowlist support.
+
+### Added
+
+- Allowlists just remove blocks from merged list before push. (a25773f)
+- Added helper submodule for testing utils (bf48a96)
+- Added basic tests of allowlist config args. (a3d3571)
+- Added test cases for cmdline parsing. (11accf3)
+- Added test cases for configfile parsing. (11accf3)
+- Added documentation on allowlists. (26f5464)
+- Fixed bug in how DomainBlock defaults handle reject_media, reject_reports. (6d4e18b)
+- Added support for allowlists. Updated docstring for merge_blocklists() (7a31c33)
+- Added DomainBlock type hint to update_known_block(). (69c28f1)
+- Use ._asdict() to get info to pass to add block API call. (69c28f1)
+
+### Changed
+
+- Updated README to explain allowlist mechanism. (dc4bbd7)
+- Edited sample config to better explain URL source (9bd7914)
+- Restructured argparsing for easier testing. (11accf3)
+- str2bool() now converts '' to False. Added some extra debug logging of blocklist parsing. (894b133)
+- Updated documentation to explain need for `admin:read` access to fetch followers stats. (2cec9e1)
+- Aligned API call rate limit with server default. (55dad3f)
+
+### Removed
+
+- Remove implied setting of reject_media/reports if severity is set to 'suspend'. (3aa2e37)
+
+### Fixed
+
+- Fixed bug: mergeplan in config file was ignored. Reported in #22 (11accf3)
+- Fixed bug in _asdict() of severity level. (9817c99)
+- Fix DomainBlock.id usage during __iter__() (a718af5)
+
 ## [0.4.0] - 2023-01-13
 
 Substantial changes to better support multiple blocklist formats
@@ -85,6 +121,8 @@ Substantial changes to better support multiple blocklist formats
 [semantic versioning]: https://semver.org/spec/v2.0.0.html
 
 <!-- Versions -->
-[unreleased]: https://github.com/eigenmagic/fediblockhole/compare/v0.3.0...HEAD
-[0.3.0]: https://github.com/eigenmagic/fediblockhole/releases/tag/v0.2.1
+[unreleased]: https://github.com/eigenmagic/fediblockhole/compare/v0.4.1...HEAD
+[0.4.1]: https://github.com/eigenmagic/fediblockhole/releases/tag/v0.4.1
+[0.4.0]: https://github.com/eigenmagic/fediblockhole/releases/tag/v0.4.0
+[0.3.0]: https://github.com/eigenmagic/fediblockhole/releases/tag/v0.3.0
 [0.2.1]: https://github.com/eigenmagic/fediblockhole/releases/tag/v0.2.1
\ No newline at end of file
diff --git a/etc/sample.fediblockhole.conf.toml b/etc/sample.fediblockhole.conf.toml
index 5190d25..e377e97 100644
--- a/etc/sample.fediblockhole.conf.toml
+++ b/etc/sample.fediblockhole.conf.toml
@@ -21,6 +21,13 @@ blocklist_url_sources = [
 
 ]
 
+## These global allowlists override blocks from blocklists
+# These are the same format and structure as blocklists, but they take precedence
+allowlist_url_sources = [
+  { url = 'https://raw.githubusercontent.com/eigenmagic/fediblockhole/main/samples/demo-allowlist-01.csv', format = 'csv' },
+  { url = 'https://raw.githubusercontent.com/eigenmagic/fediblockhole/main/samples/demo-allowlist-02.csv', format = 'csv' },
+]
+
 # List of instances to write blocklist to
 blocklist_instance_destinations = [
   # { domain = 'eigenmagic.net', token = '<read_write_token>', max_followed_severity = 'silence'},
diff --git a/samples/demo-allowlist-01.csv b/samples/demo-allowlist-01.csv
new file mode 100644
index 0000000..6ee7744
--- /dev/null
+++ b/samples/demo-allowlist-01.csv
@@ -0,0 +1,3 @@
+"domain","severity","private_comment","public_comment","reject_media","reject_reports","obfuscate"
+"eigenmagic.net","noop","Never block me","Only the domain field matters",False,False,False
+"example.org","noop","Never block me either","The severity is ignored as are all other fields",False,False,False
diff --git a/samples/demo-allowlist-02.csv b/samples/demo-allowlist-02.csv
new file mode 100644
index 0000000..3aaef19
--- /dev/null
+++ b/samples/demo-allowlist-02.csv
@@ -0,0 +1,2 @@
+"domain","private_comment"
+"example.org","The private comment won't get loaded, but can be handy to leave yourself a note."
diff --git a/tests/test_allowlist.py b/tests/test_allowlist.py
index e632361..902b301 100644
--- a/tests/test_allowlist.py
+++ b/tests/test_allowlist.py
@@ -13,7 +13,7 @@ def test_cmdline_allow_removes_domain():
 
     merged = {
         'example.org': DomainBlock('example.org'),
-        'example2.org': DomainBlock('example.org'),
+        'example2.org': DomainBlock('example2.org'),
         'removeme.org': DomainBlock('removeme.org'),
         'keepblockingme.org': DomainBlock('keepblockingme.org'),
     }
@@ -34,7 +34,7 @@ def test_allowlist_removes_domain():
 
     merged = {
         'example.org': DomainBlock('example.org'),
-        'example2.org': DomainBlock('example.org'),
+        'example2.org': DomainBlock('example2.org'),
         'removeme.org': DomainBlock('removeme.org'),
         'keepblockingme.org': DomainBlock('keepblockingme.org'),
     }
@@ -47,3 +47,30 @@ def test_allowlist_removes_domain():
 
     with pytest.raises(KeyError):
         merged['removeme.org']
+
+def test_allowlist_removes_tld():
+    """Test that an item in an allowlist removes entries from merged
+    """
+    conf = shim_argparse()
+
+    merged = {
+        '.cf': DomainBlock('.cf'),
+        'example.org': DomainBlock('example.org'),
+        '.tk': DomainBlock('.tk'),
+        'keepblockingme.org': DomainBlock('keepblockingme.org'),
+    }
+
+    allowlists = {
+        'list1': [
+            DomainBlock('.cf', 'noop'), 
+            DomainBlock('.tk', 'noop'), 
+        ]
+    }
+    
+    merged = apply_allowlists(merged, conf, allowlists)
+
+    with pytest.raises(KeyError):
+        merged['.cf']
+
+    with pytest.raises(KeyError):
+        merged['.tk']
\ No newline at end of file