diff --git a/.changes/bump-flutter-webrtc-1.6.3 b/.changes/bump-flutter-webrtc-1.6.3
deleted file mode 100644
index fa6bc5503..000000000
--- a/.changes/bump-flutter-webrtc-1.6.3
+++ /dev/null
@@ -1 +0,0 @@
-patch type="changed" "Bump flutter_webrtc to 1.6.3 and WebRTC-SDK to 150.7871.04. Windows and Linux can attach native video processors to local tracks, Linux screen share no longer hangs in getSources(), and the bundled TURN/TLS roots no longer include the compromised eMudhra cross-signed AAA Certificate Services root"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bef5038c..ebe6141f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 2.13.2
+
+* Security: Bump flutter_webrtc to 1.6.3 and WebRTC-SDK to 150.7871.04. The bundled TURN/TLS roots no longer include AAA Certificate Services, which cross-signs the compromised eMudhra intermediate CAs (CVE-2026-111943)
+
 ## 2.13.1
 
 * Changed: Bump flutter_webrtc to 1.6.2+hotfix.4, which fixes a crash on iOS and macOS when a video renderer is disposed while frames are still arriving