diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
index 61cc03affe..a62cca9b96 100644
--- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -1,3 +1,7 @@
 Security
-   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature
-     verification.
+   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
+     SHA3-224) on signature verification.
+
+Features
+   * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
+     certificate profile.