diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebd97e8ce..0d92ab989 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,16 @@
+### [2.8.4] 2024-12-11
+
+  * Fixed exit code of the `audit` command not being meaningful (now 1 for vulnerabilities and 2 for abandoned, 3 for both) (#12203)
+  * Fixed issue on plugin upgrade when it defines multiple classes (#12226)
+  * Fixed duplicate errors appearing in the output depending on php settings (#12214)
+  * Fixed InstalledVersions returning duplicate data in some instances (#12225)
+  * Fixed installed.php sorting to be deterministic (#12197)
+  * Fixed `bump-after-update` failing when using inline constraints (#12223)
+  * Fixed `create-project` command to now disable symlinking when used with a path repo as argument (#12222)
+  * Fixed `validate --no-check-publish` to hide publish errors entirely as they are irrelevant (#12196)
+  * Fixed `audit` command returning a failing code when composer audit fails as this should not trigger build failures, but running audit as standard part of your build is probably a terrible idea anyway (#12196)
+  * Fixed curl usage to disable multiplexing on broken versions when proxies are in use (#12207)
+
 ### [2.8.3] 2024-11-17
 
   * Fixed windows handling of process discovery (#12180)
@@ -1960,6 +1973,7 @@
 
   * Initial release
 
+[2.8.4]: https://github.com/composer/composer/compare/2.8.3...2.8.4
 [2.8.3]: https://github.com/composer/composer/compare/2.8.2...2.8.3
 [2.8.2]: https://github.com/composer/composer/compare/2.8.1...2.8.2
 [2.8.1]: https://github.com/composer/composer/compare/2.8.0...2.8.1