diff --git a/ChangeLog b/ChangeLog
index b39b95391..924471a9a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,9 @@ Bugfix
      previously lead to a stack overflow on constrained targets.
    * Add `MBEDTLS_SELF_TEST` for the mbedtls_self_test functions
      in the header files, which missed the precompilation check. #971
+   * Fix private key DER output in the key_app_writer example. File contents
+     were shifted by one byte, creating an invalid ASN.1 tag. Fixed by
+     Christian Walther in #2239.
 
 = mbed TLS 2.16.0 branch released 2018-12-21