diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb9796d..1055216 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,6 +50,13 @@ This project uses calendar versioning: `YY.N-stage` (e.g. `26.0-alpha` = 2026, r
   full.
 - **Apps page after an API restart** redirects to `/login` instead of
   showing an empty app list.
+- **32-bit UEFI machines** (Atom Bay Trail / Cherry Trail) get Limine
+  instead of systemd-boot: Arch has no ia32 systemd-boot and archinstall's
+  GRUB path hardcodes `x86_64-efi`, so these boxes installed but didn't boot.
+- **Force-HTTPS redirect** only covers `<hostname>.local` / `<hostname>` and
+  is a 302. The old 301 for every host sent devices that use the IP to a
+  TLS handshake that can't succeed, and stayed cached after HTTPS was
+  turned off. Self-update migrates the old snippet.
 
 - **Self-update starts newly added timers immediately and links units
   through `current`.** `_link_new_units()` enabled a timer a release
@@ -68,6 +75,9 @@ This project uses calendar versioning: `YY.N-stage` (e.g. `26.0-alpha` = 2026, r
   password hint explains it's also the SSH/console password, names are
   lowercased instead of rejected, system account names are refused.
 - Live console banner says a network cable with internet is required.
+- ISO builds pin archinstall (4.4-1, sha256-checked from the Arch archive)
+  instead of taking whatever the repos ship that day; the build fails
+  clearly when Arch's Python moves on. Bump steps in `iso/README.md`.
 
 ## [26.20-alpha] - 2026-08-25