diff --git a/CHANGES.md b/CHANGES.md
index 90df4d8c6..c7a93ed97 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,29 @@
 # Changes
 
+## edge-20.9.2
+
+This edge release continues the work of adding support for mTLS for all TCP
+traffic and changes the default container registry to `ghcr.io` from `gcr.io`.
+
+If you are upgrading from `stable-2.8.x` with the Linkerd CLI using the
+`linkerd upgrade` command, you must add the `--addon-overwrite` flag to ensure
+that the grafana image is properly set.
+
+* Removed the default timeout for ServiceProfiles so that ServiceProfile routes
+  behave the same as when there is no ServiceProfile definition
+* Changed default docker image repository to ghcr.io from gcr.io. **Users who
+  pull the images into private repositories should take note of this change**
+* Added endpoint labels to outbound TCP metrics to provide more context and
+  detail for the metrics, add load balancing to TCP connections
+  (bypassing kube-proxy), and secure the connection with mTLS when both
+  endpoints are meshed
+* Made unnamed ServiceProfile discovery configurable using the
+  `proxy.destinationGetNetworks` variable to set the
+  `LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS` variable in the proxy chart
+  template
+* Added TLS certificate validation for the Injector, SP Validator, and Tap
+  webhooks to the `linkerd check` command
+
 ## edge-20.9.1
 
 This edge release contains an important proxy update that allows linkerd to