diff --git a/ChangeLog.d/rng-cloning.txt b/ChangeLog.d/rng-cloning.txt
index 71ef04e942..e285159f44 100644
--- a/ChangeLog.d/rng-cloning.txt
+++ b/ChangeLog.d/rng-cloning.txt
@@ -4,3 +4,10 @@ Features
      psa_random_deplete() to force a reseed on the next random generator call.
    * Applications can call psa_random_set_prediction_resistance() to toggle
      prediction resistance in the PSA random generator.
+
+Security
+   * Applications running in environments where the application state is
+     cloned () should arrange to reseed the random generator using one
+     of the new functions psa_random_reseed() or psa_random_deplete().
+     CVE-2026-25835
+