diff --git a/CHANGELOG.md b/CHANGELOG.md
index 60d2a46..984014a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5503,3 +5503,5 @@ client, signing, or storage/backup orchestration yet (later slices).
   read-only `--selftest` against the demo host with TLS fingerprint pinning.
 - The 16-privilege `FelhomAgent` role + privsep token (role on **both** user and
   token) is provisioned out-of-band; the agent only consumes the token.
+
+<!-- R-421 sweep: this repo cites R-421; the row landed in felhom.eu 2d88776. -->