diff --git a/CHANGELOG.md b/CHANGELOG.md
index e099d83fb..98d32365f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,15 +1,5 @@
 # Changelog
 
-- Bound what a caller can grow through `/api/terrain/heights`. Every distinct
-  5-decimal point was a permanent in-memory entry, a permanent line in an
-  uncapped `.gev-cache/terrain-heights.json`, and a live upstream call, with
-  nothing limiting the rate. The point cache now holds at most 50,000 entries
-  and evicts oldest-first, a cache file above
-  24 MB is not read back, and the route is limited to 90 requests/minute per
-  client (270 global). Evicting a point costs one refetch, never a wrong
-  answer, since terrain does not move. Ordinary use is unaffected: a full
-  `test:track` run drives 10 requests, peaking at 8/min.
-
 - The tracked-aircraft descriptor now publishes `verticalRateMps`, on both the
   civil and military layers, so a consumer reading `getTrackedInfo()` no longer
   has to reach past it into the raw poll record for climb/descent. Reported,
diff --git a/changelog.d/686-terrain-heights-bounds.md b/changelog.d/686-terrain-heights-bounds.md
new file mode 100644
index 000000000..7e0004069
--- /dev/null
+++ b/changelog.d/686-terrain-heights-bounds.md
@@ -0,0 +1,9 @@
+- Bound what a caller can grow through `/api/terrain/heights`. Every distinct
+  5-decimal point was a permanent in-memory entry, a permanent line in an
+  uncapped `.gev-cache/terrain-heights.json`, and a live upstream call, with
+  nothing limiting the rate. The point cache now holds at most 50,000 entries
+  and evicts oldest-first, a cache file above
+  24 MB is not read back, and the route is limited to 90 requests/minute per
+  client (270 global). Evicting a point costs one refetch, never a wrong
+  answer, since terrain does not move. Ordinary use is unaffected: a full
+  `test:track` run drives 10 requests, peaking at 8/min (daikaginza, #686).