diff --git a/CHANGELOG.md b/CHANGELOG.md
index 875a622..25c4d79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   in the JSON feed, and can be consumed by a front-end to emit
   `<meta name="fediverse:creator">` on rendered pages. Per-post values
   override the site default.
+- `has_next` and `has_prev` boolean flags in the paginated
+  `/api/volumen/posts` response so clients can navigate pages without
+  computing boundaries themselves.
+- Distinct `"draft"` error code in `/api/volumen/posts/:slug` when the post
+  exists but is a draft, replacing the generic `"not_found"`.
+- `just lint` recipe for standalone RuboCop checks and `just fmt` for
+  auto-fixing lint issues.
+- `config.toml.example` template for local development; `config.toml` is
+  now gitignored.
+
+### Changed
+
+- Memoize `published_posts` within a single request so repeated calls
+  (posts list, tags, feeds, sitemap) reuse the cached result.
+- `Store#all` cache now invalidates on individual file mtime changes, not
+  just on the content directory mtime. Manual edits and `git pull` are
+  detected without a restart.
+- `Cache-Control: public, max-age=60` header on all public API responses
+  for browser and CDN caching.
+- Extract feed and sitemap generation into a dedicated `FeedHelpers` module,
+  reducing `Server` from ~500 to ~420 lines.
+
+### Security
+
+- **Content-Security-Policy** header on all `/admin/*` responses:
+  `default-src 'self'`, `script-src 'self' 'unsafe-inline'`,
+  `style-src 'self' 'unsafe-inline'`, `img-src 'self' data:`,
+  `frame-ancestors 'none'`.
+- File uploads are rejected (HTTP 413) when exceeding **10 MB**
+  (`MAX_UPLOAD_BYTES`).
+- File uploads are rejected (HTTP 415) unless the MIME type is one of
+  JPEG, PNG, GIF, WebP, AVIF, or SVG (`ALLOWED_UPLOAD_TYPES`).
 
 ## [0.2.0] — 2026-06-25