From 898f0ee3cf44fead2d4e9596845df65dcc23c58e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Mon, 4 Sep 2023 13:11:49 +0200
Subject: [PATCH] Add CHANGES and release note for [GL #4263]

---
 CHANGES                     | 3 +++
 doc/notes/notes-current.rst | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 6af9ebf5a1..6df4547eb3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6239.	[func]		Deprecate the 'dnssec-must-be-secure' option.
+			[GL #3700]
+
 6238.	[cleanup]	Refactor several objects relying on dns_rbt trees
 			to instead of dns_nametree, a wrapper around dns_qp.
 			[GL !8213]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index ad06ca78b4..a57ad29ee5 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -27,7 +27,8 @@ New Features
 Removed Features
 ~~~~~~~~~~~~~~~~
 
-- None.
+- The :any:`dnssec-must-be-secure` option has been deprecated and will be
+  removed in a future release. :gl:`#4263`
 
 Feature Changes
 ~~~~~~~~~~~~~~~