diff --git a/ChangeLog.d/fix_return_type_for_invalid_crypto_key.txt b/ChangeLog.d/fix_return_type_for_invalid_crypto_key.txt
new file mode 100644
index 0000000..dc6996e
--- /dev/null
+++ b/ChangeLog.d/fix_return_type_for_invalid_crypto_key.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * PSA functions other than psa_open_key now return PSA_ERROR_INVALID_HANDLE
+     rather than PSA_ERROR_DOES_NOT_EXIST for an invalid handle, bringing them
+     in line with version 1.0.0 of the specification. Fix #4162.