diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0dbf609..abd4843 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,31 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-04 — Sign in with a passkey alone `api 0.119.0` `web 0.145.0`
+
+The sign-in page now offers **Sign in with a passkey** and passkey suggestions in the email field.
+Your fingerprint, face or device PIN releases the key; no email or password is needed. Cancelling
+the prompt leaves the form ready to use.
+
+In **Settings → Security**, register a key with **Use it to sign in without a password** enabled.
+Existing discoverable passkeys can work too; if yours is not offered, register a new one with that
+switch enabled. Passwords and passkeys used as a second factor continue to work.
+
+**Settings → Platform → Sign-in** has a **Passkey sign-in** switch, on by default. The option appears
+only on a secure page using the instance's configured public hostname. Turning the switch off
+refuses new passwordless sign-ins, including prompts opened before it was turned off.
+
+Successful passkey sign-ins and key enrolment/removal are recorded in the audit log. Removing a key
+ends the other sessions it opened, including their live connections; the session removing it stays
+signed in after confirming the password. The first key enrolment also closes other sessions.
+
+Challenge budgets now count unanswered attempts correctly, and anonymous passkey answers are checked
+against the failure budget even when their challenges were opened in advance. IPv6 addresses in the
+same /64 share a budget. Expired suggestions refresh quietly and do not count as failed signatures.
+
+Update the API and web console together. The schema update adds three columns with compatible
+defaults; no new environment variable is required.
+
 ## 2026-10-01 — Remote desktop keeps up, a smaller notice, a simpler viewer `api 0.118.0` `web 0.144.0` `agent 0.30.0`
 
 **The picture keeps up.** On a large screen the agent managed 3 or 4 frames a second while anything