diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e2c5c5..e72e216 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,3 +19,19 @@ would plausibly want. Newest first.
   **Re-vendor if:** your site uses the default built-in relay list (i.e. you
   don't pass your own `vault-relays`/`discovery-relays` attributes). If you
   already pass your own relay list, this doesn't affect you.
+
+- **Fix: widget completely unstyled (giant logo, unstyled buttons) under a
+  strict `style-src` CSP.** `element.ts` injected its CSS as an inline
+  `<style>` tag inside the shadow root on every render. A host with
+  `style-src 'self'` and no `'unsafe-inline'` silently drops an inline
+  `<style>`'s rules entirely — visible as the brand SVG rendering at its raw
+  ~590×119px intrinsic size instead of the intended 20px-tall lockup, with
+  every other shadow-DOM element similarly falling back to unstyled browser
+  defaults. Switched to building the stylesheet once as a `CSSStyleSheet` and
+  assigning it via `adoptedStyleSheets`, which isn't subject to `style-src`.
+  (`e8712f9`)
+  **Re-vendor if:** your site's CSP sets `style-src` without `'unsafe-inline'`
+  (check your CSP header/meta tag). If your `style-src` already includes
+  `'unsafe-inline'`, or you have no CSP, this was invisible to you either
+  way, but re-vendoring is still a good idea (this fix also drops needless
+  per-render CSS reparsing).