diff --git a/MANIFEST.in b/MANIFEST.in
index ac0e29fcb..afc1809d9 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -2,6 +2,7 @@ include build-requirements.txt
 include requirements.txt
 include README.md
 include LICENSE
+include changelog.md
 include setup.py
 include files/alembic.ini
 include files/client.ini
@@ -10,6 +11,6 @@ include files/securedrop-client.desktop
 
 recursive-include alembic *
 recursive-include securedrop_client *
-	
+
 recursive-exclude alembic *.pyc
 recursive-exclude securedrop_client *.pyc
diff --git a/README.md b/README.md
index 1c927842d..cfcc01bd7 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,7 @@ release. The above mentioned autogenerate command will not do this for you.
 **Note:** These are the release guidelines for pre-production alpha releases. Production release tags must
 be signed with the SecureDrop release key.
 
-1. Update versions: `./update_version.sh $new_version_number`.
+1. Update versions: `./update_version.sh $new_version_number` and add a new entry in the changelog.
 2. Commit the changes with commit message `securedrop-client $new_version_number` and make a PR.
 3. You should confirm via a manual debian package build and manual testing in Qubes that there are no regressions (this is limited pre-release QA).
 4. Once your PR is approved, you can add a tag and push: `git tag $new_version_number`.
diff --git a/changelog.md b/changelog.md
new file mode 100644
index 000000000..422dfba6e
--- /dev/null
+++ b/changelog.md
@@ -0,0 +1,61 @@
+# Changelog
+
+## 0.0.8
+
+  * Update SDK to 0.0.10, urllib to 1.24.3, and SQLAlchemy to 1.3.3 (#424)
+  * Remove pipenv in favor of pip-tools (#372)
+
+## 0.0.7
+
+  * Update securedrop-sdk to 0.0.8 (#357)
+
+## 0.0.6
+
+  * Long lived threads are now de-authenticated on logout (#179)
+  * updated requirements based on newly built wheels (#177)
+  * Application no longer crashes when source collection is deleted on web
+    interface (#176)
+  * Improved input validation for login panel (#169)
+  * Delete submissions on disk when deleted from server (#168)
+  * Escape HTML in messages (#164)
+  * Source list displayed by last_updated value (#158)
+  * Show attachment icon when document count is greater than zero (#157)
+  * Disable refresh when API call in progress (#154)
+  * Fix crash in offline mode (#150)
+  * Developer environment fixes (#148, #149, #152)
+
+## 0.0.5-1
+
+  * Package updated to apt-test-qubes did not include securedrop-sdk 0.4
+
+## 0.0.5
+
+  * Standardize dev env (#145)
+  * Update securedrop-proxy to 0.0.4
+
+## 0.0.4
+
+  * Adds .desktop shortcut.
+
+## 0.0.3
+
+  * Fix and squash migrations (#129).
+  * Don't hide two factor code while typing (#131).
+  * Remove placeholder text from source list (#134).
+
+## 0.0.2-1
+
+  * Resolves venv paths in generated scripts (via dh-virtualenv)
+
+## 0.0.2
+
+  * Enable decryption and viewing of replies (#114).
+  * Enable decryption and viewing of messages (#99).
+  * Enable decryption and opening of files in a DispVM (#113).
+  * Add status bar on bottom of application (#65).
+  * Prevent concurrent application launches (#54).
+  * Enable starring/unstarring of sources (#50).
+
+## 0.0.1
+
+  * Initial release.