diff --git a/scripts/CHANGELOG.md b/scripts/CHANGELOG.md
index 4769c24..86ccf7f 100644
--- a/scripts/CHANGELOG.md
+++ b/scripts/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Felhom scripts — Changelog
 
+## manifest_bearer_gate.py — new gate: no bearer-shaped literals in manifests/ (2026-07-13)
+
+Part of the hub v0.53.0 bearer de-git. Greps every `manifests/*.yaml` for 64-hex literals
+(the `openssl rand -hex 32` shape all felhom bearer/API keys use), comments included; exit 1 on
+any hit. `felhom.secret.yaml`'s pre-existing committed secrets (umami APP_SECRET is 64-hex)
+print as a visible non-fatal KNOWN-BACKLOG line until that file's own de-git (secrets.md
+backlog). Run after ANY manifests/ change. Named "bearer" not "secret" — the repo `.gitignore`
+`*secret*` pattern silently un-tracks any "secret"-named file (learned the hard way: the gate's
+first landing never reached git). Red-proven: reintroducing a 64-hex literal → exit 1.
+
 ## felhom-host-install v1.15.0 — DR-tier-by-default: uniform DR plumbing on every install (2026-07-12)
 
 Sweeps the DRILL-day0-vm-2026-07-12 installer findings so the next Day-0 runs the drill's §5