diff --git a/CHANGELOG.md b/CHANGELOG.md
index 844190e8d..e9e35593e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -145,6 +145,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`,
 - `tls.acme.challenge_type` accepts `DNS-01`, using `dns.challenge.provider` [#3554](https://github.com/juanfont/headscale/pull/3554)
 - Fix the unix socket being created `0700` instead of the documented `0770` when `unix_socket_permission` is unset. The socket grants full admin access without authentication, so members of its group gain that access; check who is in it before upgrading [#3540](https://github.com/juanfont/headscale/pull/3540)
 - A policy write builds the peer map once instead of twice [#3557](https://github.com/juanfont/headscale/pull/3557)
+- Speed up the peer map build on large tailnets: each node's matchers are found once instead of checking every pair of nodes against every rule [#3556](https://github.com/juanfont/headscale/pull/3556)
 
 ## 0.29.5 (2026-10-13)