diff --git a/CHANGELOG.md b/CHANGELOG.md
index b17ea3f..11f1de2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,16 @@
 # Changelog
 
+## 1.2.0
+
+Zero-parameter bootstrap and install directory hardening.
+
+- `bootstrap.ps1` reads `DnsServer` and `Domain` from `bootstrap.json` — no required parameters
+- Install directory (`C:\Program Files\Nebula`) locked down to SYSTEM and Administrators only — standard users cannot read `host.key`, certs, or config
+
 ## 1.1.0
 
 DNS persistence and domain authentication at the login screen.
 
-- `bootstrap.ps1` now reads `DnsServer` and `Domain` from `bootstrap.json` — no required parameters
 - `install-nebula.ps1` now requires `-DnsServer` and `-Domain` parameters (passed automatically by bootstrap)
 - Nebula service changed from `delayed-auto` to `auto` start — NlaSvc dependency already ensures the physical network is up
 - Creates a `NebulaDNS` scheduled task that runs at startup to re-apply DNS on the `nebula1` adapter after Nebula recreates it, wait for the DC to become reachable, and force Netlogon DC rediscovery via `nltest`