diff --git a/config/rector/authentication40.php b/config/rector/authentication40.php
new file mode 100644
index 0000000..a2c45af
--- /dev/null
+++ b/config/rector/authentication40.php
@@ -0,0 +1,9 @@
+<?php
+declare(strict_types=1);
+
+use Cake\Upgrade\Rector\Set\CakePHPSetList;
+use Rector\Config\RectorConfig;
+
+return static function (RectorConfig $rectorConfig): void {
+    $rectorConfig->sets([CakePHPSetList::AUTHENTICATION_40]);
+};
diff --git a/config/rector/sets/authentication40.php b/config/rector/sets/authentication40.php
new file mode 100644
index 0000000..f1440e2
--- /dev/null
+++ b/config/rector/sets/authentication40.php
@@ -0,0 +1,30 @@
+<?php
+declare(strict_types=1);
+
+use Cake\Upgrade\Rector\Rector\MethodCall\RemoveMethodCallRector;
+use Cake\Upgrade\Rector\ValueObject\RemoveMethodCall;
+use Rector\Config\RectorConfig;
+use Rector\Renaming\Rector\Name\RenameClassRector;
+
+/**
+ * @see https://github.com/cakephp/authentication/blob/4.x/docs/en/upgrade-3-to-4.rst
+ */
+return static function (RectorConfig $rectorConfig): void {
+    // URL checker class renames
+    // Note: Order matters - StringUrlChecker rename must come first to avoid
+    // CakeRouterUrlChecker -> DefaultUrlChecker -> StringUrlChecker chain
+    $rectorConfig->ruleWithConfiguration(RenameClassRector::class, [
+        // Old DefaultUrlChecker renamed to StringUrlChecker
+        'Authentication\UrlChecker\DefaultUrlChecker' => 'Authentication\UrlChecker\StringUrlChecker',
+        // CakeRouterUrlChecker renamed to DefaultUrlChecker
+        'Authentication\UrlChecker\CakeRouterUrlChecker' => 'Authentication\UrlChecker\DefaultUrlChecker',
+        // Plugin class renamed
+        'Authentication\Plugin' => 'Authentication\AuthenticationPlugin',
+    ]);
+
+    // Remove loadIdentifier() method calls from AuthenticationService
+    $rectorConfig->ruleWithConfiguration(RemoveMethodCallRector::class, [
+        new RemoveMethodCall('Authentication\AuthenticationService', 'loadIdentifier'),
+        new RemoveMethodCall('Authentication\AuthenticationServiceInterface', 'loadIdentifier'),
+    ]);
+};
diff --git a/src/Rector/Set/CakePHPSetList.php b/src/Rector/Set/CakePHPSetList.php
index 6a0b0fc..072b7dc 100644
--- a/src/Rector/Set/CakePHPSetList.php
+++ b/src/Rector/Set/CakePHPSetList.php
@@ -104,4 +104,9 @@ final class CakePHPSetList
      * @var string
      */
     public const CAKEPHP_FLUENT_OPTIONS = __DIR__ . '/../../../config/rector/sets/cakephp-fluent-options.php';
+
+    /**
+     * @var string
+     */
+    public const AUTHENTICATION_40 = __DIR__ . '/../../../config/rector/sets/authentication40.php';
 }