diff --git a/tools/_changelog_top.txt b/tools/_changelog_top.txt
new file mode 100644
index 000000000..6983b3a43
--- /dev/null
+++ b/tools/_changelog_top.txt
@@ -0,0 +1,21 @@
+## nextversion - master
+
+### Added
+
+*
+
+### Changed
+
+*
+
+### Fixed
+
+*
+
+Despite us having broken lockstep, we are continuing to release new versions of
+all Certbot components during releases for the time being, however, the only
+package with changes other than its version number was:
+
+*
+
+More details about these changes can be found on our GitHub repo.
diff --git a/tools/_release.sh b/tools/_release.sh
index dab4eec3a..97e6e9c63 100755
--- a/tools/_release.sh
+++ b/tools/_release.sh
@@ -65,12 +65,19 @@ if [ "$RELEASE_BRANCH" != "candidate-$version" ] ; then
 fi
 git checkout "$RELEASE_BRANCH"
 
+# Update changelog
+sed -i "s/master/$(date +'%Y-%m-%d')/" CHANGELOG.md
+git add CHANGELOG.md
+git diff --cached
+git commit -m "Update changelog for $version release"
+
 for pkg_dir in $SUBPKGS_NO_CERTBOT certbot-compatibility-test .
 do
   sed -i 's/\.dev0//' "$pkg_dir/setup.py"
   git add "$pkg_dir/setup.py"
 done
 
+
 SetVersion() {
     ver="$1"
     # bumping Certbot's version number is done differently
@@ -232,6 +239,19 @@ echo tar cJvf $name.$rev.tar.xz $name.$rev
 echo gpg2 -U $RELEASE_GPG_KEY --detach-sign --armor $name.$rev.tar.xz
 cd ~-
 
+# Add master section to CHANGELOG.md
+header=$(head -n 4 CHANGELOG.md)
+body=$(sed s/nextversion/$nextversion/ tools/_changelog_top.txt)
+footer=$(tail -n +5 CHANGELOG.md)
+echo "$header
+
+$body
+
+$footer" > CHANGELOG.md
+git add CHANGELOG.md
+git diff --cached
+git commit -m "Add contents to CHANGELOG.md for next version"
+
 echo "New root: $root"
 echo "Test commands (in the letstest repo):"
 echo 'python multitester.py targets.yaml $AWS_KEY $USERNAME scripts/test_leauto_upgrades.sh --alt_pip $YOUR_PIP_REPO --branch public-beta'