diff --git a/CHANGES b/CHANGES
index 6af9ebf5a1..6df4547eb3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6239.	[func]		Deprecate the 'dnssec-must-be-secure' option.
+			[GL #3700]
+
 6238.	[cleanup]	Refactor several objects relying on dns_rbt trees
 			to instead of dns_nametree, a wrapper around dns_qp.
 			[GL !8213]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index ad06ca78b4..a57ad29ee5 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -27,7 +27,8 @@ New Features
 Removed Features
 ~~~~~~~~~~~~~~~~
 
-- None.
+- The :any:`dnssec-must-be-secure` option has been deprecated and will be
+  removed in a future release. :gl:`#4263`
 
 Feature Changes
 ~~~~~~~~~~~~~~~