diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68a35f932..06cc555f3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,15 +2,29 @@
 
 Canonical reference for changes, improvements, and bugfixes for Boundary.
 
-## 0.21.0 (2025/11/12)
+## 0.21.0 (2025/12/11)
 
 ### New and Improved
 
+* Vault LDAP has been added as a credential provider ([PR](https://github.com/hashicorp/boundary/pull/6222))
+* Added support for host key verification when connecting to an SSH target by
+  providing a `known_hosts` file. ([PR](https://github.com/hashicorp/boundary/pull/6263))
+* Added new credential type for password. ([PR](https://github.com/hashicorp/boundary/pull/6207))
 * ui: Optimized loading of table filters and improved table search support ([PR](https://github.com/hashicorp/boundary-ui/pull/3053))
+* cli: `boundary connect` will close unused sessions when there is no longer a
+  connection being actively proxied. This behavior can be modified via the
+  `-inactive-timeout=<duration>` command-line argument ([PR](https://github.com/hashicorp/boundary/pull/6232))
+* cli: `boundary connect redis` can now consume password credentials ([PR](https://github.com/hashicorp/boundary/pull/6213))
+* AWS KMS credential handling now allows the use of shared credential files.
+  Additionally, the `default` profile is now included in the credential chain
+  by default if it exists. ([PR](https://github.com/hashicorp/boundary/pull/6286))
 
 ### Bug fixes
 
 * ui: Show username for OIDC auth method in user menu ([PR](https://github.com/hashicorp/boundary-ui/pull/2930))
+* `boundary connect rdp` no longer opens a new window for each call on mac. ([PR](https://github.com/hashicorp/boundary/pull/6232))
+* Removed the error log during RDP basic settings exchange: When you connect to
+  an RDP target using the built-in Windows Remote Desktop Connection app. ([PR](https://github.com/hashicorp/boundary/pull/6136))
 
 ## 0.20.0 (2025/09/25)