diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd0e42e..bec8b07 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,8 +46,8 @@ All notable changes to this project will be documented in this file.
 
 - `grant update` now verifies the downloaded archive's SHA-256 against the release's `checksums.txt` before replacing the binary. Previously no validation was performed at all (`selfupdate.DefaultUpdater()` ships a nil `Validator`). Note the trust model: `checksums.txt` is fetched from the same origin as the archive, so this protects against corrupted or tampered downloads in transit, not against a compromised GitHub account or release pipeline
 - Archive extraction now rejects oversized entries instead of silently truncating them at the 128 MiB cap, rejects drive-absolute (`C:\...`) and UNC archive paths alongside `..` traversal, and only accepts the binary at the archive root (never a nested entry, never two candidates)
-- Removes `golang.org/x/crypto/openpgp` from the build graph, clearing advisory GO-2026-5932 (unmaintained package, no fix available). Dropping `ulikunitz/xz` also clears GO-2025-3922
-- `govulncheck` findings drop from 34 vulnerabilities across 4 modules to 25, all of which are Go standard library issues fixed in go1.25.x patch releases. No third-party module in the build graph has a called vulnerability
+- Clears two dependency advisories. Replacing `rhysd/go-github-selfupdate` with `minio/selfupdate` removes `golang.org/x/crypto/openpgp` from the build graph, clearing GO-2026-5932 (unmaintained package, no fix available); dropping `ulikunitz/xz` with the same dependency tail clears GO-2025-3922. No third-party module in the build graph has a called vulnerability
+- The `govulncheck` findings that remained at release time were Go standard library issues, not dependency issues, and the count is a property of the scanning toolchain rather than of this tree. Scanned with go1.25.0 the release tree reports called stdlib vulnerabilities (34 at the time this section was first written, 29 on a re-scan on 2026-08-14 as the advisory database grew); scanned with go1.25.13 it reports **0 called vulnerabilities**. CI and the release pipeline pin a floating `go-version: "1.25"`, so published binaries are built against the current patched standard library. The only residuals under go1.25.13 are not called: GO-2026-5942 (`net` SVCB/HTTPS RR parsing panic, fixed in `net@go1.26.6`, with no Go 1.25 patch available) and GO-2026-5932, which lingers as a module-graph entry outside the build graph
 
 ## [0.7.0] - 2026-04-21