diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56afc1b4..f26cf805 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,19 @@ High-level, user-facing catalog changes by month: new templates and notable vers
 
 ## 2026-08
 
+- **Every template now deploys into a GVC you already have.** Eleven templates used to create their own; none do. This closes a data-loss path: a chart that creates a GVC and later stops declaring it makes `helm upgrade` prune it — and deleting a GVC takes **every workload, volumeset and identity inside**, in about six seconds, while printing `upgraded successfully`. Each converted template now refuses that upgrade at render time. **If you run any 1.x/2.x release listed below, do not `helm upgrade` onto the new major** — install it as a new release against an existing GVC, move your data across, then remove the old release. Each README carries the migration steps
+- **cpln-advisor 2.0.0** — no longer creates a GVC. This one mattered most: 1.0.0 named the GVC it created after the one you installed into, so it **adopted your existing GVC** — and `helm uninstall` would then have deleted it along with every unrelated workload in it. Also fixes placement: on a GVC with more than one location, 1.0.0 would have run a second scheduler firing every scan twice and a second, independent database. Note the bundled Postgres still cannot be pinned to one location, so a multi-location GVC gives it one empty database per extra location — harmless today because the service DNS is location-local, but changing `location` later repoints the app at the empty one
+- **mongodb-cluster 2.0.0** — no longer creates a GVC, and **the shipped default could never fully work**. It defaulted to nine members, but MongoDB allows at most seven voters: the eighth and ninth joined nothing, ran a healthy-looking `mongod`, reported ready, and were never in the replica set. The default is now one location × three members and a roster above seven is refused. `backup.mode: physical` is **removed** — its restore could never run, because Percona Backup for MongoDB must execute `mongod` and the agent image does not contain it, so it wrote real-looking snapshots that could never be restored and failed silently doing it. The logical restore is verified end to end, and the documented steps used to point at an address that cannot resolve from your machine
+- **grafana-multi-location 2.0.0** — no longer creates a GVC, and picks up the converted `postgres-multi-location` and `redis-multi-location`. Losing the location named in `alerting.location` still stops alert evaluation while dashboards look perfectly healthy — set `alerting.highAvailability.enabled: true` if that matters, and note a fresh install now fails loudly rather than half-working
+- **airflow 2.0.0** — no longer creates a GVC. **KEDA autoscaling is now opt-in and off by default**, because it is a GVC-level setting a chart cannot turn on for you: enabling it against a GVC without KEDA is accepted silently and leaves the workers dead at zero replicas with no error anywhere. Turn KEDA on for your GVC first, then set `keda.enabled: true`. Also fixes a placement bug where a multi-location GVC would have run one scheduler and one broker **per location**
+- **redis-multi-location 3.0.0** — no longer creates a GVC. Also fixes two defects: scoping access with `internalAccess: workload-list` used to cut the cluster off from itself, and the safety check that refuses to bootstrap a misconfigured cluster **had never run at all** — it spoke an HTTP version the platform rejects, so every instance skipped it. Following the old README could leave you with no master and every write refused, while both workloads reported healthy
+- **nats 3.0.0** — no longer creates a GVC, and **is now closed to the internet by default**. It shipped open to `0.0.0.0/0` with no NATS authentication, which handed any anonymous client the cluster name, every server name and their private IPs. Reach a closed deployment with `cpln port-forward`, and open `allowCIDR` only alongside an `authorization` block. The default is now one location × three servers, and JetStream on exactly two servers is refused — two is genuinely worse than one, because losing either takes it down
+- **tidb 2.0.0** — no longer creates a GVC, which also removes a trap: 1.x adopted the GVC you pointed it at. Three fixes: `internalAccess: workload-list` never worked at all (a duplicate key silently discarded your list), the PD endpoint list was wrong whenever `pdReplicas` differed from the location count, and the backup cron was eligible to run five concurrent jobs. `exposeServer` is **removed** — it never published the MySQL port, only TiDB's unauthenticated status API. The default is now a single location, and `devMode` is gone
+- **postgres-multi-location 2.0.0** — no longer creates a GVC, and picks up the converted `etcd-multi-location`. Automatic failover is verified end to end: a hung primary was replaced in a surviving location in 43 seconds with no split brain. Note the documented WAL-G restore still cannot be followed as written — the volumeset it tells you to re-point has no values knob
+- **cockroach 2.0.0** — no longer creates a GVC. **The documented restore could never have worked**: the backup is a full-cluster backup and CockroachDB refuses to restore one onto a cluster that already has databases, which this template always creates. Both working paths are now documented and verified against real S3 and GCS. `SURVIVE REGION FAILURE` also used to fail silently, leaving the database at zone survival while the install reported success — it is now applied and verified across three regions. A one-node deployment is refused rather than crash-looping
+- **clickhouse 3.0.0** — no longer creates a GVC. `internalAccess: workload-list` never worked: the list was never applied, so it blocked everything. Also documented: a rolling upgrade of a three-shard cluster is about 83 seconds of unavailability, renaming `clusterName` orphans existing `Distributed` tables, and with one replica per shard losing a shard fails every distributed query
+- **etcd-multi-location 2.0.0** — no longer creates a GVC. Also fixes `internalAccess: workload-list`, which used to destroy the cluster: the list governs the members' own traffic to each other, so scoping access the way the README described cost quorum cluster-wide within two minutes while Helm reported success. Any `helm upgrade` restarts all three members roughly together and costs 20-30 seconds of lost quorum — that is unchanged, but now documented
+- **pgedge 2.0.1** — `internalAccess: workload-list` broke replication and backups. The list governs the nodes' own Spock traffic and the backup job's connection, so scoping access left nodes accepting writes that never replicated, and every scheduled backup uploading an empty file while reporting success
 - **New template: cpln-advisor 1.0.0** — watches the workloads in your own org and turns their metrics, logs and billed cost into LLM-generated tuning suggestions, with an optional Autopilot that applies the qualifying ones and keeps a one-click revert for each
 - **pgedge 2.0.0** — **replication never actually worked.** PostgreSQL 17.11 refuses to create a Spock replication slot unless the plugin is allow-listed, so every node accepted writes that never left it while reporting healthy — if you run 1.x, your cluster is almost certainly not replicating, and the README has a one-command fix you can apply without upgrading. Also fixed: restarting every node at once used to destroy the mesh permanently, a backup schedule starting with `*` broke the install, a single-node cluster could not serve reads, and `pgcat.maxClientConn` never did anything. **This release no longer creates a GVC** — it deploys into one you already have. **Do not `helm upgrade` a 1.x release onto it**: migrate to a new release instead, because a chart that stops declaring a GVC makes Helm delete it and everything inside it
 - **coraza 1.2.1** — the startup hook that configures the WAF's reverse proxy **never actually waited** for the proxy to be ready, so a configuration that failed to apply was reported as a healthy WAF that was not inspecting traffic. The hook now waits, verifies, and refuses to serve if it cannot configure itself, and failures say why in `cpln logs`. The bundled rule set moves from CRS 4.7.0 to 4.28.0, and request-body inspection is properly sized — the old defaults returned 504 for any body over 50 KB, against roughly 1.8 MB now. Pin a digest or a datecode, never a moving tag like `-lts`; only the Caddy image variants work