diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6645b4..6d5b5bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,40 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
 
 ## Unreleased
 
+### Added
+
+- **Settings → Security shows the hub's auth policy.** New panel
+  backed by the hub's read-only `AuthStatus` RPC: active token
+  validator (static / JWT-RS256 with issuer, audience and JWKS
+  source), anonymous-access warning, and per-token cards with
+  scope grants, env-var presence and rate limits — T4/T5 security
+  administration finally visible outside YAML. Non-admin tokens
+  get a localized denied story instead of an error.
+- **Permanent accessibility + responsive test gates.** Every page
+  must pass WCAG text contrast and labeled-tap-target guidelines
+  in both themes (`test/a11y_test.dart`) and lay out without
+  overflow from 800 to 1920 px (`test/responsive_test.dart`).
+
+### Fixed
+
+- **Light theme accent was below WCAG contrast.** Filled buttons
+  and the active sidebar label rendered white-on-sky-500 (2.8:1);
+  the light scheme now uses sky-700 (~5.9:1). FABs follow the
+  same accent instead of Material 3's tonal default.
+- **Audit page at narrow window widths.** The app-bar filter chips
+  collapse into a checkmark menu below 900 px, and the live-status
+  bar shrinks gracefully (copyable disconnect error gets the full
+  row width).
+- **Consistent formal address in German.** ~20 strings still used
+  du-forms next to the Sie-forms on welcome/setup; the audit
+  event-type chip "Step" is now "Schritt"; the doctor page's event
+  count pluralises correctly ("1 Ereignis") in both languages.
+- **Stored tokens reached the wrong directory.** `~/.fai/` rename
+  leftovers: the hub-auth token and registry token were read from /
+  written to `~/.fai/` while the hub reads `~/.chain/` — a stored
+  registry token never reached the hub. Today-stories and UI texts
+  still advertising the retired `.fai` bundle extension fixed too.
+
 ### Fixed (wizard live-run findings 2026-07-14)
 
 Field test of the setup wizard surfaced three trust breaks in one