diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ac26f1ab..66ad6e64c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,7 @@ BUG FIXES:
  * server: Reject non-TLS clients when TLS enabled [GH-2525]
  * server: Fix a panic in plan evaluation with partial failures and all_at_once
    set [GH-2544]
+ * server/vault: Fix Vault Client panic when given nonexistant role [GH-2648]
 
 ## 0.5.6 (March 31, 2017)