diff --git a/CHANGES b/CHANGES
index 8225feacac..469d17b45f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5698.	[bug]		Migrate a single key to CSK when reconfiguring a zone
+			to use 'dnssec-policy'. [GL #2857]
+
 5697.	[protocol]	SHA-1 CDS records are no longer used by dnssec-cds to
 			make DS records. Thanks to Tony Finch. [GL !2946]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 61dec80165..6900b3b1da 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -48,3 +48,6 @@ Bug Fixes
 - When following QNAME minimization, BIND could use a stale zonecut from cache 
   to resolve the query, resulting in a non-minimized query. This has been
   fixed :gl:`#2665`
+
+- Migrate a single key to CSK when reconfiguring a zone to make use of
+  'dnssec-policy' :gl:`#2857`