diff --git a/CHANGELOG.md b/CHANGELOG.md
index 062485d38900..a6ce5c28b9de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,10 +23,12 @@ IMPROVEMENTS:
    `vault -autocomplete-install` [GH-3223]
  * core: TLS cipher suites used for cluster behavior can now be set via
    `cluster_cipher_suites` in configuration [GH-3228]
- * storage/gcp: Use application default credentials if they exist [GH-3248]
  * core: The `plugin_name` can now either be specified directly as part of the
    parameter or within the `config` object when mounting a secret or auth backend
    via `sys/mounts/:path` or `sys/auth/:path` respectively [GH-3202]
+ * secret/pki: TTLs can now be specified as a string or an integer number of
+   seconds [GH-3270]
+ * storage/gcp: Use application default credentials if they exist [GH-3248]
 
 BUG FIXES: