diff --git a/changelog.mdx b/changelog.mdx
index 4eb1749..9a111d5 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -9,6 +9,30 @@ import { YouTubeVideo } from '/snippets/youtube-video.mdx';
 For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-node-sdk/blob/main/CHANGELOG.md), [Python SDK](https://github.com/onkernel/kernel-python-sdk/blob/next/CHANGELOG.md), and [Go SDK](https://github.com/onkernel/kernel-go-sdk/blob/main/CHANGELOG.md) changelogs.
 </Note>
 
+<Update label="August 7" tags={["Product", "Docs"]}>
+## Product updates
+
+- Released the [Kernel Terraform provider](https://registry.terraform.io/providers/kernel/kernel/latest) on the Terraform Registry. Manage browser pools and projects as code, and reference existing profiles, proxies, and extensions as data sources. Install with `source = "kernel/kernel"`.
+- Released [Hypeman v0.3.0](https://github.com/kernel/hypeman/releases/tag/v0.3.0) with persistent Builder resources and build caches, safer auto-standby through `POST /instances/{id}/auto-standby/hold`, and a new default API port of `4973`. Existing explicit port settings are unchanged. [Hypeman CLI v0.17.0](https://github.com/kernel/hypeman-cli/releases/tag/v0.17.0) adds `builder create`, `list`, `get`, `delete`, and `prune` commands, plus `hypeman build --builder` for cache reuse.
+- Shipped CUA CLI 0.9.0 alongside [`@onkernel/cua-agent`](https://github.com/kernel/cua) and [`@onkernel/cua-ai`](https://github.com/kernel/cua) 0.10.0, adding an OpenRouter Kimi K3 computer-use provider, message queuing during active turns with cleaner interrupt handling, and Tzafon post-action screenshots. Also made cua-ai's catalog compilation declaration-only with a clearer execution boundary. Note for anyone embedding `cua-agent`: 0.10.0 upgrades the underlying `pi` stack to 0.83.0 and adopts its context-first harness API, which is a breaking change to `CuaAgentHarness`.
+- Added a secure managed auth login panel to the [MCP server](/reference/mcp-server), exposed as a new `open_auth_login` tool. Agents hand the user an interactive panel to complete login and re-auth, so credentials and MFA codes never enter the conversation. `manage_auth_connections` gained a read-only `wait` action to follow a flow through to completion.
+- Protected managed auth connections from losing their configured egress: `DELETE /proxies/{id}` now returns `400 resource_in_use` when a live connection still references the proxy. Remove or repoint those connections before deleting the proxy.
+- Improved [MCP server](/reference/mcp-server) error transparency: Kernel API, Playwright, `exec_command`, and `search_docs` failures now surface as tool errors instead of being masked as successes, so agents can retry or route around them. The server also advertises the Kernel server name on `initialize`.
+- MCP tool calls now require a short `context` field describing what the agent is trying to accomplish, with credential shapes and other request details excluded.
+- Added per-browser OTLP export destination selection to [browser telemetry](/browsers/telemetry/overview). Set `telemetry.export.otlp.destination` when creating a browser to route captured events to an org-scoped destination, and inspect the live export state in browser responses.
+- Allowed `CONNECT` tunnels to public destinations on non-standard ports while continuing to block SMTP port `25` and private or otherwise non-public addresses.
+- Improved browser egress reliability when an origin negotiates HTTP/2 during fallback by reusing the established connection instead of closing and redialing it.
+- Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project.
+- Added a search button beside the dashboard organization selector, making the existing Cmd+K or Ctrl+K command palette discoverable on desktop and mobile.
+
+## Documentation updates
+
+- Launched [Hypeman documentation](https://docs.hypeman.sh) with getting-started guides and generated API, TypeScript SDK, and Go SDK references.
+- Added a [Terraform integration guide](/integrations/terraform) covering provider setup, authentication, and where to find resources, examples, and releases.
+- Added a `URLAllowlist` navigation-restriction example to the [Chrome policies](/browsers/chrome-policies) guide.
+- Refreshed the [browser pools](/browsers/pools) guides and standardized on "browser pools" terminology across the docs.
+</Update>
+
 <Update label="July 31" tags={["Product", "Docs"]}>
 ## Product updates