diff --git a/changelogs/room_versions/newsfragments/3694.clarification b/changelogs/room_versions/newsfragments/3694.clarification
new file mode 100644
index 00000000..cc593b0a
--- /dev/null
+++ b/changelogs/room_versions/newsfragments/3694.clarification
@@ -0,0 +1 @@
+Fix auth rules to allow membership of `knock` -> `leave` in v7, v8, and v9.
\ No newline at end of file
diff --git a/content/rooms/fragments/v8-auth-rules.md b/content/rooms/fragments/v8-auth-rules.md
index 6089663f..67fb1aae 100644
--- a/content/rooms/fragments/v8-auth-rules.md
+++ b/content/rooms/fragments/v8-auth-rules.md
@@ -91,7 +91,8 @@ The rules are as follows:
         5.  Otherwise, reject.
     5.  If `membership` is `leave`:
         1.  If the `sender` matches `state_key`, allow if and only if
-            that user's current membership state is `invite` or `join`.
+            that user's current membership state is `invite`, `join`,
+            or `knock`.
         2.  If the `sender`'s current membership state is not `join`,
             reject.
         3.  If the *target user*'s current membership state is `ban`,
diff --git a/content/rooms/v7.md b/content/rooms/v7.md
index ebe1e643..424ad739 100644
--- a/content/rooms/v7.md
+++ b/content/rooms/v7.md
@@ -114,7 +114,8 @@ The rules are as follows:
         5.  Otherwise, reject.
     4.  If `membership` is `leave`:
         1.  If the `sender` matches `state_key`, allow if and only if
-            that user's current membership state is `invite` or `join`.
+            that user's current membership state is `invite`, `join`,
+            or `knock`.
         2.  If the `sender`'s current membership state is not `join`,
             reject.
         3.  If the *target user*'s current membership state is `ban`,