diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ec01378c5..08da739847 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ The following sections list the changes for unreleased.
 
 ## Summary
 
+* Enhancement - Support spec violating AD FS access token issuer: [#7138](https://github.com/owncloud/ocis/pull/7138)
 * Enhancement - Bump Reva: [#7138](https://github.com/owncloud/ocis/pull/7138)
 * Enhancement - Keyword Query Language (KQL) search syntax support: [#7043](https://github.com/owncloud/ocis/pull/7043)
 * Enhancement - SSE for messaging: [#6992](https://github.com/owncloud/ocis/pull/6992)
@@ -13,6 +14,13 @@ The following sections list the changes for unreleased.
 
 ## Details
 
+* Enhancement - Support spec violating AD FS access token issuer: [#7138](https://github.com/owncloud/ocis/pull/7138)
+
+   AD FS `/adfs/.well-known/openid-configuration` has an optional `access_token_issuer`
+   which, in violation of the OpenID Connect spec, takes precedence over `issuer`.
+
+   https://github.com/owncloud/ocis/pull/7138
+
 * Enhancement - Bump Reva: [#7138](https://github.com/owncloud/ocis/pull/7138)
 
    Bumps reva version