diff --git a/MANIFEST.in b/MANIFEST.in
index 0c0916b..b024c62 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,6 +1,7 @@
 include LICENSE
 include README.md
 include securedrop_proxy/VERSION
+include changelog.md
 include config-example.yaml
 include qubes/securedrop.Proxy
 include build-requirements.txt
diff --git a/README.md b/README.md
index 6130263..ee92719 100644
--- a/README.md
+++ b/README.md
@@ -48,11 +48,12 @@ the updated dependency to our pip mirror (you can request this in the PR).
 
 **Note:** These are the release guidelines for pre-production alpha releases. Production release tags must be signed with the SecureDrop release key.
 
- 1. Update versions: `./update_version.sh $new_version_number`.
+1. Update versions: `./update_version.sh $new_version_number` and add a new entry in the changelog.
 2. Commit the changes with commit message `securedrop-proxy $new_version_number` and make a PR.
 3. You should confirm via a manual debian package build and manual testing in Qubes that there are no regressions (this is limited pre-release QA).
 4. Once your PR is approved, you can add a tag and push: `git tag $new_version_number`.
 
+
 #### configuration
 
 The proxy script must be run with the path to its configuration file
diff --git a/changelog.md b/changelog.md
new file mode 100644
index 0000000..a97c319
--- /dev/null
+++ b/changelog.md
@@ -0,0 +1,28 @@
+# Changelog
+
+## 0.1.4
+
+  * Update urllib3 to version 1.24.3 or later due to CVE-2019-11324 (#35)
+  * Remove pipenv in favor of pip-tools (#33)
+
+## 0.1.3
+
+  * Updated PyYAML to 5.1 and safe loading of YAML files
+    #24 and #25
+
+## 0.1.2
+
+  * Update requirements: Remove dev requirements (#20), update wheel hashes
+    (#21)
+
+## 0.1.1-1
+
+  * Resolves venv paths in generated scripts (via dh-virtualenv)
+
+## 0.1.1
+
+  * Update requests to 2.20.0
+
+## 0.1.0
+
+  * Initial release. (Closes: #XXX)