diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28fc00904e..d10c9b7f56 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,16 +3,16 @@
 FEATURES:
 
 * agent: Added `encrypt_verify_incoming` and `encrypt_verify_outgoing` options to use for upshifting to encrypted gossip on an existing cluster.
+* agent: Added a method for gracefully transitioning to TLS on an existing cluster. [GH-1705]
+* agent: Added support for RetryJoin on Azure [GH-2978]
 
 IMPROVEMENTS:
 
 * agent: Added a check which prevents advertising or setting a service to a zero address (`0.0.0.0`, `[::]`, `::`). [GH-2961]
 * agent: Allow binding to any public IPv6 address with `::` [GH-2285]
-* agent: Added a method for gracefully transitioning to TLS on an existing cluster. [GH-1705]
 * agent: Removed SCADA-related code for Atlas and deprecated all Atlas-related configuration options. [GH-3032]
 * agent: Added support for custom check id and name when registering checks along with a service. [GH-3047]
 * agent: Updated [go-sockaddr](https://github.com/hashicorp/go-sockaddr) library to add support for new helper functions in bind address templates (`GetPrivateIPs`, `GetPublicIPs`), new math functions, and to pick up fixes for issues with detecting addresses on multi-homed hosts. [GH-3068]
-* agent: Added support for RetryJoin on Azure [GH-2978]
 * agent: Watches now reset their index back to zero after an error, or if the index goes backwards, which allows watches to recover after a server restart with fresh state. [GH-2621]
 * build: Added support for linux/arm64 binaries. [GH-3042]
 * build: Consul now builds with Go 1.8.3. [GH-3074]