diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0770941c39..4928c47675 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,13 +12,16 @@ CHANGES:
    Vault's core; however, this can now be explicitly disabled with the new
    `token_no_default_policy` field.
  * auth/approle: `bound_cidr_list` is no longer returned when reading a role
+ * auth/approle: `token_type` no longer allows `default-service` or
+   `default-batch` to be set; they didn't really make sense anyways as that's
+   only meant when mount-tuning to indicate what to do if `default` is chosen.
  
  FEATURES:
 
  * **Vault API explorer**: The Vault UI now includes an embedded API explorer 
    where you can browse the endpoints avaliable to you and make requests. To try
    it out, open the Web CLI and type `api`.
-   
+
 IMPROVEMENTS:
 
  * agent: Allow EC2 nonce to be passed in [GH-6953]