diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff8b9a2..d3536f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,15 @@
+3.4.6
+=====
+
+* (deprecation) Deprecate `DoctrineChangeChecker`.
+
+
+3.4.5
+=====
+
+* (internal) Add tests for `AbilitiesVoter`.
+
+
 3.4.4
 =====
 
diff --git a/UPGRADE.md b/UPGRADE.md
index 2e3c6fa..82022f6 100644
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -3,6 +3,7 @@
 
 * Passing a `bool` to the constructor of `ApiResponse` was removed, pass a status code instead.
 * The method `ApiResponse::withStatusCode()` was removed. Pass the status code in the constructor instead.
+* `DoctrineChangeChecker` was removed. There is no direct replacement.
 
 
 2.x to 3.0
diff --git a/src/Doctrine/DoctrineChangeChecker.php b/src/Doctrine/DoctrineChangeChecker.php
index ce0e275..386be69 100644
--- a/src/Doctrine/DoctrineChangeChecker.php
+++ b/src/Doctrine/DoctrineChangeChecker.php
@@ -6,13 +6,25 @@
 use Doctrine\Persistence\ManagerRegistry;
 use Torr\Rad\Exception\Doctrine\InvalidDoctrineChangeCheckException;
 
+/**
+ * @deprecated this class is deprecated and will be removed in v4
+ */
 final readonly class DoctrineChangeChecker
 {
+	// TODO remove in v4
 	/**
 	 */
 	public function __construct (
 		private ManagerRegistry $managerRegistry,
-	) {}
+	)
+	{
+		trigger_deprecation(
+			"21torr/rad",
+			"3.4.6",
+			"Using %s is deprecated and will be removed in v4.",
+			self::class,
+		);
+	}
 
 	/**
 	 * Determines whether any content globally in any of the entities (or the entities themselves)
diff --git a/tests/Doctrine/DoctrineChangeCheckerTest.php b/tests/Doctrine/DoctrineChangeCheckerTest.php
index 2b4296a..73ef6c4 100644
--- a/tests/Doctrine/DoctrineChangeCheckerTest.php
+++ b/tests/Doctrine/DoctrineChangeCheckerTest.php
@@ -6,6 +6,7 @@
 use Doctrine\ORM\UnitOfWork;
 use Doctrine\Persistence\ManagerRegistry;
 use PHPUnit\Framework\TestCase;
+use Symfony\Bridge\PhpUnit\ExpectDeprecationTrait;
 use Torr\Rad\Doctrine\DoctrineChangeChecker;
 
 /**
@@ -13,6 +14,8 @@
  */
 final class DoctrineChangeCheckerTest extends TestCase
 {
+	use ExpectDeprecationTrait;
+
 	/**
 	 *
 	 */
@@ -51,6 +54,8 @@ public static function provideLargeEntityChanges () : iterable
 
 	/**
 	 * @dataProvider provideLargeEntityChanges
+	 *
+	 * @group legacy
 	 */
 	public function testLargeEntityChanges (
 		bool $expected,
@@ -92,7 +97,10 @@ public function testLargeEntityChanges (
 			->method("getManager")
 			->willReturn($entityManager);
 
+		$this->expectDeprecation("Since 21torr/rad 3.4.6: Using Torr\\Rad\\Doctrine\\DoctrineChangeChecker is deprecated and will be removed in v4.");
+		// @phpstan-ignore-next-line
 		$checker = new DoctrineChangeChecker($registry);
+		// @phpstan-ignore-next-line
 		self::assertSame($expected, $checker->hasContentChanged());
 	}
 
@@ -114,6 +122,8 @@ public static function provideChangesets () : iterable
 
 	/**
 	 * @dataProvider provideChangesets
+	 *
+	 * @group legacy
 	 */
 	public function testChangesets (
 		bool $expected,
@@ -158,7 +168,10 @@ public function testChangesets (
 			->method("getManager")
 			->willReturn($entityManager);
 
+		$this->expectDeprecation("Since 21torr/rad 3.4.6: Using Torr\\Rad\\Doctrine\\DoctrineChangeChecker is deprecated and will be removed in v4.");
+		// @phpstan-ignore-next-line
 		$checker = new DoctrineChangeChecker($registry);
+		// @phpstan-ignore-next-line
 		self::assertSame($expected, $checker->hasContentChanged());
 	}
 }
diff --git a/tests/Security/AbilitiesVoterTest.php b/tests/Security/AbilitiesVoterTest.php
new file mode 100644
index 0000000..8d7bc94
--- /dev/null
+++ b/tests/Security/AbilitiesVoterTest.php
@@ -0,0 +1,73 @@
+<?php declare(strict_types=1);
+
+namespace Tests\Torr\Rad\Security;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+use Symfony\Component\Security\Core\Role\RoleHierarchy;
+use Symfony\Component\Security\Core\User\InMemoryUser;
+use Torr\Rad\Security\AbilitiesVoter;
+
+/**
+ * @internal
+ */
+final class AbilitiesVoterTest extends TestCase
+{
+	/**
+	 *
+	 */
+	public function testVoteGrantedForReachableAbility () : void
+	{
+		$token = $this->createToken(["ROLE_ADMIN"]);
+		$roleHierarchy = new RoleHierarchy(["ROLE_ADMIN" => ["CAN_VIEW_DASHBOARD"]]);
+		$voter = new AbilitiesVoter($roleHierarchy);
+
+		self::assertSame(
+			VoterInterface::ACCESS_GRANTED,
+			$voter->vote($token, null, ["CAN_VIEW_DASHBOARD"]),
+		);
+	}
+
+	/**
+	 *
+	 */
+	public function testVoteDeniedForMissingAbility () : void
+	{
+		$token = $this->createToken(["ROLE_USER"]);
+		$roleHierarchy = new RoleHierarchy([]);
+		$voter = new AbilitiesVoter($roleHierarchy);
+
+		self::assertSame(
+			VoterInterface::ACCESS_DENIED,
+			$voter->vote($token, null, ["CAN_EDIT_USERS"]),
+		);
+	}
+
+	/**
+	 *
+	 */
+	public function testVoteAbstainsForNonCanAttribute () : void
+	{
+		$token = $this->createToken(["ROLE_USER"]);
+		$roleHierarchy = new RoleHierarchy([]);
+		$voter = new AbilitiesVoter($roleHierarchy);
+
+		self::assertSame(
+			VoterInterface::ACCESS_ABSTAIN,
+			$voter->vote($token, null, ["ROLE_USER"]),
+		);
+	}
+
+	/**
+	 *
+	 */
+	private function createToken (array $roles) : UsernamePasswordToken
+	{
+		return new UsernamePasswordToken(
+			new InMemoryUser("test", null, $roles),
+			"main",
+			$roles,
+		);
+	}
+}