diff --git a/src/content/docs/docs/contributing/index.md b/src/content/docs/docs/contributing/index.md
index 26d728b..9298bc8 100644
--- a/src/content/docs/docs/contributing/index.md
+++ b/src/content/docs/docs/contributing/index.md
@@ -38,7 +38,6 @@ CI runs `.github/actions/checks/action.yml`:
 ```sh
 npm ci
 node scripts/changelog-check.js
-node scripts/changelog-fragments.js --check
 node scripts/bump-cache-busting.js --check
 npm run paths:check
 cd api && npm test
@@ -53,7 +52,7 @@ docker build -t stackyard:ci .
 
 CodeQL and Trivy also run. Both block on a finding.
 
-- Do not edit `CHANGELOG.md`. Add a fragment in `changelog.d/` named `<section>-<slug>.md`.
+- Do not edit `CHANGELOG.md`. List user-visible changes in the pull request description under **Changelog**, as `- ` lines below a Keep a Changelog heading such as `### Fixed`. Merging adds them to `[Unreleased]`.
 - Write `?v=1` on new `/css/` and `/js/` imports. The release sets the real hash.
 - A new `ui/js` module needs two entries in `tsconfig.frontend.json`: the path and its `?v=*` form.
 - Run Biome through `npm run lint`. A bare `npx biome` runs an unrelated package.
diff --git a/src/content/docs/docs/contributing/releasing.md b/src/content/docs/docs/contributing/releasing.md
index 33affb2..2e00ea3 100644
--- a/src/content/docs/docs/contributing/releasing.md
+++ b/src/content/docs/docs/contributing/releasing.md
@@ -6,7 +6,7 @@ description: How a Stackyard version is cut, signed and published, and how the p
 ## Cut a release
 
 1. Run **Release prep** in Actions with the version, such as `1.8.0`.
-2. It folds `changelog.d/` into the changelog, bumps the version, pins the demo image, and opens a pull request.
+2. It dates the `[Unreleased]` section, bumps the version, pins the demo image, and opens a pull request.
 3. Merge it. The tag builds, scans, signs and publishes the image and the release page.
 4. Merge the Community Applications pull request that follows.
 
@@ -16,7 +16,7 @@ If a release build fails, fix `main`, delete the tag, and push it again.
 
 ## Secrets
 
-- `RELEASE_APP_CLIENT_ID` and `RELEASE_APP_PRIVATE_KEY`: a GitHub App with read and write on Contents and Pull requests, installed on this repository only. The built-in token cannot trigger the release workflows.
+- `RELEASE_APP_CLIENT_ID` and `RELEASE_APP_PRIVATE_KEY`: a GitHub App with read and write on Contents and Pull requests, installed on this repository only. The built-in token cannot trigger the release workflows. The app is also a bypass actor on the `main` ruleset, so it can push changelog entries after each merge.
 - `DOCS_DEPLOY_HOOK_URL`: a Cloudflare Pages deploy hook. It rebuilds this site after a stable release. The release still succeeds without it.
 
 ## Demo