diff --git a/docs/changelog.d/main.bugfix.md b/docs/changelog.d/main.bugfix.md
new file mode 100644
index 0000000..43b9286
--- /dev/null
+++ b/docs/changelog.d/main.bugfix.md
@@ -0,0 +1 @@
+Trust k3s CNI interfaces (cni0, flannel.1) in ringtail NixOS firewall, fixing pod-to-host networking that broke all ringtail Tailscale Ingress services (authentik, frigate, ntfy, ollama).