diff --git a/CHANGES b/CHANGES
index 59ed14a3f3..b4b966c8e4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+6024.	[func]		Deprecate 'auto-dnssec'. [GL #3667]
+
 6023.	[func]		Remove dynamic update DNSSEC management feature.
 			[GL #3686]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 8834c61db5..e5f3b8870a 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -37,6 +37,9 @@ Feature Changes
   settings that required different values based on "workload" have been either
   removed or a sensible default has been picked.  :gl:`#3664`
 
+- The option :any:`auto-dnssec` is deprecated and will be removed in 9.19.
+  Please migrate to :any:`dnssec-policy`. :gl:`#3667`
+
 - Deprecate setting the operating system limit (``coresize``, ``datasize``,
   ``files`` and ``stacksize``) from ``named.conf``.  These options should be set
   from the operating system (``ulimit``) or from the process supervisor