diff --git a/src/keboola_agent_cli/changelog.py b/src/keboola_agent_cli/changelog.py
index 7c0da112..86390934 100644
--- a/src/keboola_agent_cli/changelog.py
+++ b/src/keboola_agent_cli/changelog.py
@@ -40,6 +40,53 @@
         "`auth login` instead. Stores the resulting session in `auth.json` exactly like "
         "`auth login` does -- same downstream command support, same "
         "`--register-projects` contract.",
+        "New: a `kbagent-promotion-pipeline` skill that generates a from-scratch GitHub "
+        "Actions setup promoting configurations from a SOURCE project (dev) to a "
+        "DESTINATION project (prod), with a human-reviewed PR gate in between. `sync` "
+        "targets one registered alias per invocation -- it has no 'this git branch is bound "
+        "to that project' magic -- so the skill builds the promotion loop out of that "
+        "primitive: a pull workflow syncs the source project into a scratch directory and "
+        "opens one PR against `main`, a validate workflow runs `sync push --dry-run` against "
+        "the DESTINATION token on that PR (the cross-project diff: if this merges, here is "
+        "exactly what changes in prod), and a push workflow applies it on merge -- one job "
+        "per pipeline, each gated by the `prod` GitHub Environment, so approving one "
+        "pipeline never approves another. Pull deliberately goes through a scratch "
+        "directory: the tracked directory's manifest is bound to the DESTINATION's config "
+        "ids, and overwriting it with the source's would make every push create duplicates "
+        "instead of matching the configs it already created. Handles multi-pipeline repos "
+        "and documents the GitHub secrets/environment setup. For porting an EXISTING `kbc` "
+        "repo, use `kbagent-cicd-migration` instead -- this one is for greenfield.",
+        "Fix (#568): `kbagent lineage show --upstream/--downstream <bucket>.<table>` warns "
+        "when an unqualified table id exists in more than one project. The help text has "
+        "promised 'auto-resolves, warns if ambiguous' since the command shipped, but no "
+        "warning was ever implemented -- the resolver returned the alphabetically first "
+        "project's copy and exited 0. With a bucket shared or linked across projects that "
+        "answered 'what depends on this table?' with one project's edges presented as the "
+        "whole picture, and the only clue was the fully-qualified `node` field in the "
+        "output. The first candidate is still what gets rendered, so nothing changes for "
+        "unambiguous ids, but the result now carries `ambiguous_matches` plus a `warnings` "
+        "entry naming every project that has the table and the `PROJECT:<bucket>.<table>` "
+        "form to query a specific one. In `--json` the warnings ride along in the payload, "
+        "`kbagent serve` returns them on `POST /lineage/show` and `GET /lineage/walk`, and "
+        "both diagram renderers carry the note as well (#584): the flowchart as a "
+        "standalone warning node, the ER view as a relationship-less `note` entity, so a "
+        "Web UI or `--format mermaid`/`er` reader is not left with one project's answer "
+        "looking like the whole picture. Note the remedy says `PROJECT:` rather than the "
+        "angle-bracket placeholder you might expect -- mermaid renders an escaped "
+        "`<project>` back to a literal tag that the browser then drops, quietly eating the "
+        "part that makes the advice usable.",
+        'Fix (#569): `kbagent search "<term>" --search-type config-based` matches '
+        "case-insensitively, the way the same command's textual mode always has. Keboola "
+        "configs routinely spell one logical table several ways -- a mixed-case row or "
+        "display name against the all-caps physical table id a DB-sourced extractor writes "
+        "into `storage.input.tables[].source` -- so a case-sensitive body scan answered 'is "
+        "this referenced anywhere?' with a false no, and the reporter's two queries differing "
+        "only in casing returned 5 vs 13 results org-wide, the shorter one missing an "
+        "actively-scheduled daily transformation. Nothing warned, and there was no "
+        "workaround: `--regex` is rejected in combination with `--search-type config-based`, "
+        "so not even a `(?i)` pattern was available on this surface. `kbagent config search` "
+        "is a different command and is unaffected -- it stays case-sensitive by default and "
+        "keeps its own `--ignore-case` for callers that need exact matching.",
     ],
     "0.83.0": [
         "Note (#390): there will be NO `kbagent agent migrate-mcp-tasks` command. Migrating "