diff --git a/CHANGELOG.md b/CHANGELOG.md
index 87a1aaf..0ac25a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,21 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-07 — Remote desktop follows the lock screen and UAC prompts `agent 0.34.0` `web 0.150.1`
+
+A remote-desktop session no longer pauses when the person at the machine locks it or a Windows
+elevation (UAC) prompt appears. The notice now follows onto the Windows credential desktop and the
+secure screen saver as it already followed a sign-in: it is redrawn there and verified, then the
+picture and your keyboard and mouse carry on, so you can unlock the machine or answer the prompt. This
+applies to every consent profile.
+
+This is a change in what an operator can see: the lock screen and a password prompt are now streamed,
+always under the visible notice. Nothing is captured on those screens until the notice is standing on
+them. A desktop created by another program is still not followed, and there the picture pauses as
+before. The consent-mode explanation in the remote-desktop settings is updated to say so.
+
+Update the agent release image and the web console image. No API or database update is required.
+
 ## 2026-10-07 — A terminal pane built for the operator `web 0.150.0`
 
 The terminal in the remote workspace names the shell — **Windows PowerShell**, **PowerShell**,