diff --git a/CHANGELOG.md b/CHANGELOG.md
index abd4843..fc2f64b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,22 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-07 — Clearer second-factor sign-in `web 0.146.0`
+
+The second-factor screen now shows that your password is verified, highlights the active method,
+and keeps other methods behind **Use another method**. Security verification and first-time setup
+have their own headings and instructions.
+
+Six-digit codes are easier to read, accept pasted spaces and separators, and still support browser
+autofill. Email codes are sent when you ask for one, with a 60-second wait before resending. A failed
+request keeps your code ready to retry; a cancelled security-key prompt keeps other methods available.
+
+Keyboard focus follows method changes, and French and German buttons wrap on small screens. Setting
+up an authenticator app shows the QR instructions before focusing the code, and completing account
+setup now opens the console.
+
+Update the web console only. No API update or database migration is required.
+
 ## 2026-10-04 — Sign in with a passkey alone `api 0.119.0` `web 0.145.0`
 
 The sign-in page now offers **Sign in with a passkey** and passkey suggestions in the email field.