diff --git a/NEWS b/NEWS
index a56183cb1..c7002ec08 100644
--- a/NEWS
+++ b/NEWS
@@ -65,6 +65,9 @@ Bug fixes:
   - bubblewrap 0.12.0 (CVE-2026-87766)
   - xdg-dbus-proxy 0.1.9 (CVE-2026-93676, CVE-2026-94422)
 
+* Improve hardening against symlink traversal, related to
+  CVE-2026-97023 and CVE-2026-97024
+
 * Validate GVariant structure of summaries before using generated variant
   readers (#6779)