diff --git a/changelog.d/973-tomtom-cross-site-gate.md b/changelog.d/973-tomtom-cross-site-gate.md
new file mode 100644
index 000000000..e4a029406
--- /dev/null
+++ b/changelog.d/973-tomtom-cross-site-gate.md
@@ -0,0 +1,4 @@
+- Cross-site browser requests can no longer spend the TomTom traffic-tile
+  budget through `/api/tomtom/*`. The shared same-site gate runs before status,
+  cache, and upstream work; same-origin app requests and non-browser local
+  callers remain supported (Sunil56224972, #973).