diff --git a/CHANGES b/CHANGES
index 47756108df..200ea433f8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -25,7 +25,7 @@
 			<sysdir>/dnssec-policy.conf (usually
 			/etc/dnssec-policy.conf). [RT #43064]
 
-4451.   [cleanup]       Log more useful information if a PKCS#11 provider
+4451.	[cleanup]	Log more useful information if a PKCS#11 provider
 			library cannot be loaded. [RT #43076]
 
 4450.	[port]		Provide more nuanced HSM support which better matches
@@ -278,7 +278,7 @@
 			in a directory other than the server's working
 			directory. [RT #42527]
 
-4379.   [bug]           An INSIST could be triggered if a zone contains
+4379.	[bug]		An INSIST could be triggered if a zone contains
 			RRSIG records with expiry fields that loop
 			using serial number arithmetic. [RT #40571]
 
@@ -863,7 +863,7 @@
 4207.	[bug]		Handle class mismatches with raw zone files.
 			[RT #40746]
 
-4206.   [bug]		contrib: fixed a possible NULL dereference in
+4206.	[bug]		contrib: fixed a possible NULL dereference in
 			DLZ wildcard module. [RT #40745]
 
 4205.	[bug]		'named-checkconf -p' could include unwanted spaces
@@ -1107,7 +1107,7 @@
 
 4136.	[bug]		Stale statistics counters with the leading
 			'#' prefix (such as #NXDOMAIN) were not being
-			updated correctly. This	has been fixed. [RT #39141]
+			updated correctly. This has been fixed. [RT #39141]
 
 4135.	[cleanup]	Log expired NTA at startup. [RT #39680]