diff --git a/.gitignore b/.gitignore
index 610f9e0..3c10e50 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,4 +27,6 @@ htmlcov/
 
 # Subagent-driven-development scratch: per-plan ledgers, briefs, review packages.
 .superpowers/
-\n\n# Machine-specific project roots/names; the tracked projects.yaml stays generic.\nconfig/projects.local.yaml\n
\ No newline at end of file
+
+# Machine-specific project roots/names; the tracked projects.yaml stays generic.
+config/projects.local.yaml
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d1c474..2d0e7a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,17 +2,6 @@
 
 All notable changes to jobd. Format roughly follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [Unreleased]\n\n### Privacy — tracked config no longer carries real paths
-
-- `config/projects.local.yaml` (gitignored, beside `projects.yaml`) now holds
-  machine-specific `roots:` and private project names; each entry replaces the
-  same-named tracked entry wholesale. Operators must create it on deploy or lose
-  cwd-derived identity for those roots — see docs/projects-yaml.md.
-- The tracked `projects.yaml`, the replay corpus `tests/data/project_cwd_corpus.csv`,
-  tests, plans and docs are pseudonymised (`/home/user/...`, greek-letter project
-  names). `tests/test_no_private_paths.py` fails the suite if a private path, host,
-  address or session trailer is ever tracked again.
-
 ## [Unreleased]
 
 ## [0.5.42] — 2026-09-01
diff --git a/changelog.d/privacy-local-overlay.security.md b/changelog.d/privacy-local-overlay.security.md
new file mode 100644
index 0000000..050eabf
--- /dev/null
+++ b/changelog.d/privacy-local-overlay.security.md
@@ -0,0 +1 @@
+- **Tracked config no longer carries real paths or private names.** `config/projects.local.yaml` (gitignored, beside `projects.yaml`) now holds machine-specific `roots:` and private project names; each entry replaces the same-named tracked entry wholesale. Operators must create it on deploy or lose cwd-derived identity for those roots (docs/projects-yaml.md). The tracked `projects.yaml`, the replay corpus, tests, plans and docs are pseudonymised, and `tests/test_no_private_paths.py` fails the suite if a private path, host, address or session trailer is ever tracked again.