diff --git a/CHANGELOG.md b/CHANGELOG.md
index c047c5c..00084ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,8 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
   prompt resolution, and per-form portrait/reference assets.
 
 ### Changed
+- **API Key Handoff Cache Policy.** Settings and explicit external-key regeneration responses now send `no-store`
+  headers so browser and intermediary caches cannot retain the client-visible access-key handoff.
 - **API Boundary Hardening.** External API authentication is enabled by default, request and mutation limits are
   enforced, and settings responses redact provider credentials for non-browser callers.
 - **Server-side Provider Credentials.** Provider keys are now masked even for same-origin Settings responses, are