diff --git a/changelog.d/1011.feature b/changelog.d/1011.feature
new file mode 100644
index 00000000..c9a043f4
--- /dev/null
+++ b/changelog.d/1011.feature
@@ -0,0 +1 @@
+Add `legacyPassKey` config option to specify a read-only key, allowing a gradual migration to a new key.