diff --git a/CHANGES b/CHANGES
index d3fb3e5c50..d4d9606b44 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
+			an NSEC3 incapable DNSSEC algorithm using KASP the zone
+			could sometimes be incompletely signed. [GL #3937]
+
 6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
 			catalog zone structure to avoid a race between the
 			dns__catz_update_cb() and dns_catz_dbupdate_callback()