diff --git a/CHANGELOG.md b/CHANGELOG.md
index e93778c..5feb209 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## [0.5.1] — 2026-10-26
 
 - build: axum-only activitypub_federation, rustls-ring only — drops actix-web and aws-lc from consumers' builds
+- k-ap installs the rustls `ring` CryptoProvider as the process default (once) when an `ApFederationConfig` is built or a lookup/backfill client is created. Hosts that want a different provider, or that call `CryptoProvider::install_default().expect(..)`, must install theirs before constructing `ApFederationConfig`. Hosts building their own reqwest client with `rustls-no-provider` before k-ap must install a provider themselves.
 
 ## [0.5.0] — 2026-07-25