diff --git a/CHANGELOG.md b/CHANGELOG.md
index af9b74c..10ade41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,13 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-#### Packaging and Deployment
-
-- Arch Linux AUR packaging for `fips` (release) and `fips-git`
-  (development) packages with sysusers.d/tmpfiles.d integration
-  ([#21](https://github.com/jmcorgan/fips/pull/21),
-  [@dskvr](https://github.com/dskvr))
-
 #### Bluetooth Transport
 
 - Bluetooth Low Energy (BLE) L2CAP Connection-Oriented Channel transport
@@ -27,6 +20,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cross-probe tie-breaker using deterministic NodeAddr comparison
 - Connection pool with configurable capacity and eviction
 
+#### Packaging and Deployment
+
+- Linux release artifact workflow: builds x86_64 and aarch64 tarballs
+  and `.deb` packages on `v*` tag push, with SHA-256 checksums
+- AUR publish workflow for tagged stable releases
+- Arch Linux AUR packaging for `fips` (release) and `fips-git`
+  (development) packages with sysusers.d/tmpfiles.d integration
+  ([#21](https://github.com/jmcorgan/fips/pull/21),
+  [@dskvr](https://github.com/dskvr))
+
 ### Fixed
 
 - Control socket path detection in fipsctl and fipstop now checks for
@@ -35,6 +38,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   error instead of a misleading "No such file" fallback to
   `$XDG_RUNTIME_DIR` ([#30](https://github.com/jmcorgan/fips/issues/30),
   reported by [@Sebastix](https://github.com/Sebastix))
+- OpenWrt ipk build excluded BLE feature that requires D-Bus, which is
+  unavailable on OpenWrt targets
+- IPv6 routing policy rule added at TUN setup to protect `fd00::/8`
+  from interception by Tailscale's table 52 default route
 
 ## [0.2.0] - 2026-03-22