diff --git a/changelog.mdx b/changelog.mdx
index 47c1347f0..c95527a8a 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,20 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
 
 To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
 
+<Update label="Sep 24, 2026" description="X API v2 and Livestream API">
+  ### New features
+
+  - **OAuth 2.0 webhook signatures.** Webhook deliveries now include an `X-Twitter-Webhooks-Signature-OAuth2` header signed with your app's OAuth 2.0 client secret. You can also generate CRC `response_token` values with the same secret. The legacy `X-Twitter-Webhooks-Signature` header still works for OAuth 1.0 integrations. See [Signature headers](/x-api/webhooks/introduction#signature-headers).
+  - **Expiring X Activity API subscriptions.** Pass an optional `expires_at` timestamp when you create a subscription, and X deletes it automatically at that time. To change the expiration, send the same subscription again with a new `expires_at`. See [Subscription expiration](/x-api/activity/introduction#subscription-expiration).
+  - **Livestream API access form.** You can now request Livestream API access through a dedicated form. Livestream API source and broadcast endpoints are available by approval only. See [Livestream API access form](/forms/livestream-api-access).
+
+  ### Updates
+
+  - **`is_moderator` on `broadcast.chat` events.** The [`broadcast.chat`](/x-api/activity/event-payloads#broadcast-chat) payload now shows whether the chat author is a moderator. The broadcast owner appears as `is_moderator: false` in their own broadcast.
+  - **Broadcast scopes in OAuth 1.0a token exchange.** Tokens you exchange from OAuth 1.0a now include `broadcast.read` for read access, and `broadcast.write` too for read and write access. See [Migrating OAuth 1.0a user tokens to OAuth 2.0](/fundamentals/authentication/oauth-2-0/oauth-1-0a-token-exchange).
+  - **`source` removed from `tweet.fields`.** X API v2 no longer supports the deprecated `source` field. Remove it from your `tweet.fields` requests. See [Post lookup fields](/x-api/posts/lookup/integrate).
+</Update>
+
 <Update label="Sep 21, 2026" description="X API v2">
   ### Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange