diff --git a/changelog.mdx b/changelog.mdx
index 47c1347f0..b068fd7c3 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,19 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
 
 To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
 
+<Update label="Sep 26, 2026" description="X API v2">
+  ### New features
+
+  - **Subscription expiration in the X Activity API.** Pass an optional `expires_at` (RFC 3339) when creating a subscription, and XAA deletes it automatically at that time. To change the expiration, `POST` the same subscription again with a new `expires_at`. See [Subscription expiration](/x-api/activity/introduction#subscription-expiration).
+  - **OAuth 2.0 client secret for webhook signatures.** Webhook deliveries can include an `X-Twitter-Webhooks-Signature-OAuth2` header signed with your app's OAuth 2.0 client secret. We recommend verifying this header and using the same secret for CRC `response_token`s. The legacy `X-Twitter-Webhooks-Signature` header is still supported. See [Webhook security](/x-api/webhooks/introduction#security).
+  - **`is_moderator` on `broadcast.chat` events.** The `broadcast.chat` payload now includes an `is_moderator` boolean for the message author. The broadcast owner is reported as `is_moderator: false` in their own broadcast. See [Broadcast events](/x-api/activity/event-payloads#broadcast-chat).
+
+  ### Updates
+
+  - **Broadcast scopes in OAuth 1.0a token exchange.** Exchanged tokens now include `broadcast.read`, and `broadcast.write` for read-and-write apps. See the [permission-to-scope mapping](/fundamentals/authentication/oauth-2-0/oauth-1-0a-token-exchange#what-permissions-do-the-new-tokens-get).
+  - **`source` removed from `tweet.fields`.** The deprecated `source` field is no longer available in X API v2. Remove it from your `tweet.fields` requests. See [Post lookup fields](/x-api/posts/lookup/integrate).
+</Update>
+
 <Update label="Sep 21, 2026" description="X API v2">
   ### Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange