diff --git a/CHANGES b/CHANGES
index a14977d5b8..810adfc6c5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+6024.	[func]		Deprecate 'auto-dnssec'. [GL #3667]
+
 6022.	[performance]	The decompression implementation in dns_name_fromwire()
 			is now smaller and faster. [GL #3655]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index beb1e1a256..01073b21be 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -32,6 +32,9 @@ Feature Changes
 
 - None.
 
+- The option :any:`auto-dnssec` is deprecated and will be removed in 9.19.
+  Please migrate to :any:`dnssec-policy`. :gl:`#3667`
+
 - Deprecate setting the operating system limit (``coresize``, ``datasize``,
   ``files`` and ``stacksize``) from ``named.conf``.  These options should be set
   from the operating system (``ulimit``) or from the process supervisor