diff --git a/CHANGELOG.md b/CHANGELOG.md
index fc304f78b..134da534a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ The following sections list the changes for unreleased.
 ## Summary
 
 * Bugfix - External storage registration used wrong config: [#2120](https://github.com/owncloud/ocis/pull/2120)
+* Enhancement - Properly configure graph-explorer client registration: [#2118](https://github.com/owncloud/ocis/pull/2118)
 * Enhancement - Use system default location to store TLS artefacts: [#2129](https://github.com/owncloud/ocis/pull/2129)
 
 ## Details
@@ -17,6 +18,13 @@ The following sections list the changes for unreleased.
 
    https://github.com/owncloud/ocis/pull/2120
 
+* Enhancement - Properly configure graph-explorer client registration: [#2118](https://github.com/owncloud/ocis/pull/2118)
+
+   The client registration in the `identifier-registration.yaml` for the graph-explorer
+   didn't contain `redirect_uris` nor `origins`. Both were added to prevent exploitation.
+
+   https://github.com/owncloud/ocis/pull/2118
+
 * Enhancement - Use system default location to store TLS artefacts: [#2129](https://github.com/owncloud/ocis/pull/2129)
 
    This used to default to the current location of the binary, which is not ideal after a first run as