diff --git a/changelog/unreleased/ocis-root-config.md b/changelog/unreleased/ocis-root-config.md
new file mode 100644
index 000000000..4261d2bd7
--- /dev/null
+++ b/changelog/unreleased/ocis-root-config.md
@@ -0,0 +1,7 @@
+Change: Move ocis default config to root level
+
+Tags: ocis
+
+We moved the tracing config to the `root` flagset so that they are parsed on all commands. We also introduced a `JWTSecret` flag in the root flagset, in order to apply a common default JWTSecret to all services that have one.
+
+https://github.com/owncloud/ocis/pull/842