diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d5b5bc..3548901 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,13 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
 
 ### Fixed
 
+- **Auth-rejected hub no longer reported as "unreachable".** With
+  token auth active, a wrong or rotated token got UNAUTHENTICATED
+  from a perfectly reachable hub, but the sustained-failure banner
+  said "can't reach the hub" — pointing the operator at the
+  endpoint instead of the token. The shell now probes with the
+  SDK's failure-kind-aware `probe()` and switches the banner to
+  "rejected the sign-in — check the access token" (key-off icon).
 - **Light theme accent was below WCAG contrast.** Filled buttons
   and the active sidebar label rendered white-on-sky-500 (2.8:1);
   the light scheme now uses sky-700 (~5.9:1). FABs follow the