diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..b728640
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,18 @@
+# Changelog
+
+## [Unreleased]
+
+Changes yet to be released are documented here.
+
+## v0.1.0
+
+Initial release.
+
+- `login` — browser-based Authorization Code + PKCE flow
+- `refresh` — refresh access token using stored refresh token
+- `service-account` — headless client credentials flow for servers
+- `status` — decode JWT from netrc, show expiry info
+- `logout` — revoke tokens and clean up netrc
+- TOML config with environment variable expansion
+- netrc read/write preserving other entries
+- Nix flake with package, app, checks, and devShell