diff --git a/ChangeLog.d/mbedtls_cipher_finish_padded.txt b/ChangeLog.d/mbedtls_cipher_finish_padded.txt
new file mode 100644
index 0000000000..bf2405eb41
--- /dev/null
+++ b/ChangeLog.d/mbedtls_cipher_finish_padded.txt
@@ -0,0 +1,4 @@
+Features
+   * The new function mbedtls_cipher_finish_padded() is similar to
+     mbedtls_cipher_finish(), but makes it easier to process invalid-padding
+     conditions in constant time.