diff --git a/ChangeLog b/ChangeLog
index 458c82a50..a8f9a79b2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,11 +2,6 @@ mbed TLS ChangeLog (Sorted per branch, date)
 
 = mbed TLS 2.16.X branch released XXXX-XX-XX
 
-Bugfix
-   * Allow loading symlinked certificates. Fixes #3005. Reported and fixed
-     by Jonathan Bennett <JBennett@incomsystems.biz> via #3008.
-   * Fix an unchecked call to mbedtls_md() in the x509write module.
-
 Security
    * Fix potential memory overread when performing an ECDSA signature
      operation. The overread only happens with cryptographically low
@@ -21,6 +16,9 @@ Security
      ARMmbed/mbed-crypto#352
 
 Bugfix
+   * Allow loading symlinked certificates. Fixes #3005. Reported and fixed
+     by Jonathan Bennett <JBennett@incomsystems.biz> via #3008.
+   * Fix an unchecked call to mbedtls_md() in the x509write module.
 
 = mbed TLS 2.16.4 branch released 2020-01-15