diff --git a/README.md b/README.md
index d42445a..2881398 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@ id: my_integration            # required, unique, slug
 name: My Integration          # required, human name
 version: 1.0.0                # semver
 description: What it does.
+changelog: "1.1.0 — notes"   # optional: shown on update so operators can assess risk
 category: enrichment          # free text (enrichment, containment, ticketing…)
 
 # Per-instance configuration the operator fills when creating an instance.
diff --git a/integrations/virustotal/manifest.yaml b/integrations/virustotal/manifest.yaml
index 9ae6b7d..2481f5a 100644
--- a/integrations/virustotal/manifest.yaml
+++ b/integrations/virustotal/manifest.yaml
@@ -2,6 +2,7 @@ id: virustotal
 name: VirusTotal
 version: 1.0.0
 description: VirusTotal API v3 — reputation lookups for IPs and domains.
+changelog: "1.0.0 — Initial release: IP and domain reputation lookups."
 category: enrichment
 
 config_schema:
diff --git a/templates/manifest.example.yaml b/templates/manifest.example.yaml
index 0b752f9..b62eae0 100644
--- a/templates/manifest.example.yaml
+++ b/templates/manifest.example.yaml
@@ -8,6 +8,9 @@ id: example_integration          # required · unique slug · [a-z0-9_]
 name: Example Integration        # required · shown in the UI
 version: 1.0.0                   # semver · bump on every change
 description: One-line description of what this integration does.
+# changelog: shown to operators when an update is available, so they can assess
+# risk before updating. Describe notable/breaking changes for THIS version.
+changelog: "1.0.0 — Initial release."
 category: enrichment             # free text: enrichment | containment | ticketing | ...
 
 # ---------------------------------------------------------------------------