diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4e8805..8a0ddea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,15 @@ This project uses calendar versioning: `YY.N-stage` (e.g. `26.0-alpha` = 2026, r
 
 ### Added
 
+- **Furtka Gateway: apps reachable from the internet** (behind NAT/CGNAT,
+  no port forwarding). Settings → *Furtka Gateway*: enter the gateway URL
+  and registration token, the box registers and keeps a WireGuard tunnel to
+  a [furtka-gateway](https://forgejo.sourcegate.online/robert/furtka-gateway)
+  server (Traefik + wg-easy + control plane). Apps → ⋯ → *Expose to
+  Internet* publishes an app under its own hostname with Let's Encrypt;
+  *Stop exposing* takes it down again. Only apps whose manifest declares
+  `internet.viable: true` can be exposed. Client in `furtka/gateway.py` +
+  `furtka/wireguard.py`, CLI `furtka gateway …`.
 - **New logo: Mark M** (a lowercase *f* cut out of an arched gate), winner of
   the furtka.org vote (29 of 42 votes). It is now in the website header,
   favicon and share card, the installer header and tab icon, the on-box UI