diff --git a/changelog.mdx b/changelog.mdx
index 93f021e..f7f8e8f 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -9,6 +9,24 @@ import { YouTubeVideo } from '/snippets/youtube-video.mdx';
 For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-node-sdk/blob/main/CHANGELOG.md), [Python SDK](https://github.com/onkernel/kernel-python-sdk/blob/next/CHANGELOG.md), and [Go SDK](https://github.com/onkernel/kernel-go-sdk/blob/main/CHANGELOG.md) changelogs.
 </Note>
 
+<Update label="July 10" tags={["Product", "Docs"]}>
+## Product updates
+
+- Consolidated on-demand and browser-pool concurrency into a single unified [concurrency limit](/info/projects) that counts `browsers.create()` sessions and pool reservations against one org cap. `max_pooled_sessions` is deprecated; `max_concurrent_sessions` now covers both. Rolling out gradually.
+- Shipped `kernel audit-logs search` in the [CLI](https://github.com/kernel/cli) for querying the org audit log by time window, HTTP method, service, auth strategy, and user, with table or JSON output. `GET` requests are excluded by default to keep the signal on mutations.
+- Added a `refresh_on_profile_update` flag to [browser pools](/browsers/pools) (SDK, [CLI](https://github.com/kernel/cli) `--refresh-on-profile-update`, and dashboard). Opted-in pools automatically flush their idle browsers when the pool's managed-auth profile re-authenticates, so pooled sessions stay logged in after a re-auth.
+- Extended [`@onkernel/cua-agent`](https://github.com/kernel/cua) with action-plane modes — `computer`, `browser`, and `hybrid` — plus `setMode()` and a `/mode` runtime switcher, and wired in support for Anthropic's shipped native `computer_20260701` and `browser_20260701` tools.
+- Exposed `profile_id` and `extension_ids` on browser pool reads, and returned an SHA-256 checksum for uploaded extensions.
+- Added the ability to inspect credential value keys and remove specific values on managed-auth credential updates.
+- `DELETE /org/api_keys/{id}` now returns `400 cannot_delete_current_key` when the target key is the one authenticating the request, so scripts and Terraform-style provisioners can't brick their own credentials mid-run.
+
+## Documentation updates
+
+- Documented the unified [concurrency limit](/info/projects) and marked `max_pooled_sessions` deprecated across pricing, projects, and the CLI reference.
+- Documented the new [`refresh_on_profile_update`](/browsers/pools) browser pool flag.
+- Added a proxy [health check](/proxies/overview) reference to the proxies overview.
+</Update>
+
 <Update label="July 3" tags={["Product", "Docs"]}>
 ## Product updates