diff --git a/CHANGES b/CHANGES
index a57db6aaed..b8c7db017e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,11 +1,10 @@
 5408.	[protocol]	Print Extended DNS Errors if present in OPT record.
 			[GL #1835]
 
-5407.	[func]		The zone timers are now exported to the statistics
-			channel.  Thanks to Paul Frieden, Verizon Media.
-			[GL #1232]
+5407.	[func]		Zone timers are now exported via statistics channel.
+			Thanks to Paul Frieden, Verizon Media. [GL #1232]
 
-5406.	[func]		Added a new logging category "rpz-passthru". It allows
+5406.	[func]		Added a new logging category, "rpz-passthru". It allows
 			RPZ passthru actions to be logged into a separate
 			channel. [GL #54]
 
@@ -17,12 +16,12 @@
 			success if errors were found in one view but not in a
 			subsequent one. [GL #1807]
 
-5403.	[func]		Don't set udp recv/send buffer sizes, sockets will
-			use system defaults. [GL #1713]
+5403.	[func]		Do not set UDP receive/send buffer sizes - use system
+			defaults. [GL #1713]
 
-5402.	[bug]		Enable SO_REUSEADDR on all platforms, and either
-			SO_REUSEPORT_LB on FreeBSD, or SO_REUSEPORT on Linux.
-			[GL !3365]
+5402.	[bug]		On FreeBSD, use SO_REUSEPORT_LB instead of SO_REUSEPORT.
+			Enable use of SO_REUSEADDR on all platforms which
+			support it. [GL !3365]
 
 5401.	[bug]		The number of input queues allocated during dnstap
 			initialization was too low, which could prevent some
@@ -34,53 +33,57 @@
 5399.	[func]		Add engine support to OpenSSL ECDSA implementation.
 			[GL #1534]
 
-5398.	[bug]		Named could fail to restart if a zone added with
-			'rndc addzone' contained a double quote (\") in
-			its name.  [GL #1695]
+5398.	[bug]		Named could fail to restart if a zone with a double
+			quote (") in its name was added with 'rndc addzone'.
+			[GL #1695]
 
 5397.	[func]		Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
 			Thanks to Aaron Thompson. [GL !3326]
 
-5396.	[func]		Use UV_UDP_RECVMMSG flag to enable recvmmsg support in
-			libuv >= 1.37. [GL #1797]
+5396.	[func]		When necessary (i.e. in libuv >= 1.37), use the
+			UV_UDP_RECVMMSG flag to enable recvmmsg() support in
+			libuv. [GL #1797]
 
 5395.	[placeholder]
 
-5394.	[cleanup]	Don't change effective uid/gid in named_os_openfile()
-			if named is already running under specified uid/gid.
-			[GL #1042] [GL #1090]
+5394.	[cleanup]	Named formerly attempted to change the effective UID and
+			GID in named_os_openfile(), which could trigger a
+			spurious log message if they were already set to the
+			desired values. This has been fixed. [GL #1042]
+			[GL #1090]
 
-5393.	[cleanup]	Unused or redundant APIs were removed from libirs.
+5393.	[cleanup]	Unused and/or redundant APIs were removed from libirs.
 			[GL #1758]
 
 5392.	[bug]		It was possible for named to crash during shutdown
 			or reconfiguration if an RPZ zone was still being
 			updated. [GL #1779]
 
-5391.	[func]		The BIND 9 build system has been changed to use the
-			usual stack of autoconf+automake+libtool.  If building
-			from the git repository run "autoreconf -fi" first.
+5391.	[func]		The BIND 9 build system has been changed to use a
+			typical autoconf+automake+libtool stack. When building
+			from the Git repository, run "autoreconf -fi" first.
 			[GL #4]
 
 5390.	[placeholder]
 
-5389.	[bug]		Finish the PKCS#11 code cleanup, fix couple of smaller
+5389.	[bug]		Finish PKCS#11 code cleanup, fix a couple of smaller
 			bugs and use PKCS#11 v3.0 EdDSA macros and constants.
 			Thanks to Aaron Thompson. [GL !3391]
 
-5388.	[func]		Reject AXFR streams where the message id is not
+5388.	[func]		Reject AXFR streams where the message ID is not
 			consistent. [GL #1674]
 
 5387.	[placeholder]
 
-5386.	[cleanup]	Address Coverity warnings in keymgr.c [GL #1737]
+5386.	[cleanup]	Address Coverity warnings in lib/dns/keymgr.c.
+			[GL #1737]
 
 5385.	[func]		Make ISC rwlock implementation the default again.
 			[GL #1753]
 
-5384.	[bug]		With dnssec-policy, inline-signing was implicitly set
-			to yes.  Change and only set inline-signing to yes
-			if the zone is not dynamic. [GL #1709]
+5384.	[bug]		With "dnssec-policy" in effect, "inline-signing" was
+			implicitly set to "yes". Now "inline-signing" is only
+			set to "yes" if the zone is not dynamic. [GL #1709]
 
 	--- 9.17.1 released ---