diff --git a/CHANGES b/CHANGES
index 25a780955f..d7939eb001 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+5613.	[bug]		It was possible to write an invalid transaction header
+			in the journal file for a managed-keys database after
+			upgrading. This has been fixed. Invalid headers in
+			existing journal files are detected and named is able
+			to recover from them. [GL #2600]
+
 5611.	[func]		Set "stale-answer-client-timeout" to "off" by default.
 			[GL #2608]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index c9a3ff5f92..585c9fdeed 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -73,3 +73,9 @@ Bug Fixes
   recursion for a client query completed when ``named`` was about to look for
   a stale answer, an assertion could fail in ``query_respond()``, resulting in
   a crash. This has been fixed. [GL #2594]
+
+- After upgrading to the previous release, journal files for trust anchor
+  databases (e.g., ``managed-keys.bind.jnl``) could be left in a corrupt
+  state. (Other zone journal files were not affected.) This has been
+  fixed. If a corrupt journal file is detected, ``named`` can now recover
+  from it. [GL #2600]