diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..7dfb452
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,47 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). We do not use Semantic Versioning, because our images are tagged based on Rust releases. However, we try to maintain as much backwards compatibility as possible.
+
+For maximum stablity, use images with tags like `ekidd/rust-musl-builder:1.46.0` or `ekidd/rust-musl-builder:nightly-2020-08-26`. These may occasionally be rebuilt, but only while they're "current", or possibly if they're recent and serious security are discovered in a library.
+
+## 2020-09-04
+
+### Added
+
+- Added `examples/using-sqlx`.
+
+### Changed
+
+- Our OpenSSL configuration now uses environment variables prefixed with `X86_64_UNKNOWN_LINUX_MUSL_`. See [sfackler/rust-openssl#1337](https://github.com/sfackler/rust-openssl/issues/1337) and [launchbadge/sqlx#670](https://github.com/launchbadge/sqlx/issues/670) for background. This allows us to support static builds of `sqlx`, but it may break very old versions of `openssl-sys` (which were probably already broken when OpenSSL 1.0 reached its end-of-life).
+
+## 2020-08-27
+
+### Updated
+
+- Update to `cargo deny` 0.7.3.
+- Update to PostgreSQL 11.9.
+
+## 2020-07-16
+
+### Updated
+
+- Update to `mdbook` version 0.4.1.
+- Update to `cargo deny` 0.7.0.
+
+## 2020-06-05
+
+### Changed
+
+- Previously, `stable` included OpenSSL 1.0.2, and `stable-openssl11` included OpenSSL 1.1.1. However, OpenSSL 1.0.2 is **no longer receiving security fixes,** so the new tagging system will be:
+  - `stable`: OpenSSL 1.1.1 and the latest stable Rust.
+  - **DEPRECATED** `stable-openssl11`: OpenSSL 1.1 and Rust 1.42.0. This will no longer be updated. Use `stable` instead.
+  - **DEPRECATED** `1.42.0-openssl10` and `nightly-2020-03-12-openssl10`: OpenSSL 1.0.2. These will not be updated to newer Rust. You will still be able to build newer OpenSSL 1.0.2 images manually.
+
+  I hate to break compatibility with projects that require OpenSSL 1.0.2, but since it will receive no future security updates, I no longer feel comfortable supplying pre-built images.
+
+### Updated
+
+- Update to `cargo deny` 0.6.7.
+- Update to PostgreSQL 11.8.
diff --git a/README.md b/README.md
index 10a6605..0dd5f4b 100644
--- a/README.md
+++ b/README.md
@@ -2,11 +2,16 @@
 
 [![Docker Image](https://img.shields.io/docker/pulls/ekidd/rust-musl-builder.svg?maxAge=2592000)](https://hub.docker.com/r/ekidd/rust-musl-builder/)
 
-[Source on GitHub](https://github.com/emk/rust-musl-builder)
+- [Source on GitHub](https://github.com/emk/rust-musl-builder)
+- [Changelog](https://github.com/emk/rust-musl-builder/blob/master/CHANGELOG.md)
+
+**UPDATED:** The OpenSSL configuration has changed to support `sqlx`. This may break very old versions of the `openssl` crate. If this affects you, please file an issue. See the [Changelog](https://github.com/emk/rust-musl-builder/blob/master/CHANGELOG.md) for details.
 
 ## What is this?
 
-Do you want to compile a completely static Rust binary with no external dependencies?  If so, try:
+This image allows you to build static Rust binaries using `diesel`, `sqlx` or `openssl`. These images can be distributed as single executable files with no dependencies, and they should work on any modern Linux system.
+
+To try it, run:
 
 ```sh
 alias rust-musl-builder='docker run --rm -it -v "$(pwd)":/home/rust/src ekidd/rust-musl-builder'
@@ -15,7 +20,7 @@ rust-musl-builder cargo build --release
 
 This command assumes that `$(pwd)` is readable and writable by uid 1000, gid 1000. At the moment, it doesn't attempt to cache libraries between builds, so this is best reserved for making final release builds.
 
-For a more realistic example, see the `Dockerfile` for [examples/using-diesel](./examples/using-diesel) [examples/using-sqlx](./examples/using-sqlx).
+For a more realistic example, see the `Dockerfile`s for [examples/using-diesel](./examples/using-diesel) and [examples/using-sqlx](./examples/using-sqlx).
 
 ## Deploying your Rust application
 
@@ -42,16 +47,6 @@ compile [examples/using-diesel](./examples/using-diesel) and [examples/using-sql
 
 [comp]: https://rust-lang.github.io/rustup-components-history/index.html
 
-### OpenSSL security note
-
-Previously, `stable` included OpenSSL 1.0.2, and `stable-openssl11` included OpenSSL 1.1.1. However, OpenSSL 1.0.2 is **no longer receiving security fixes,** so the new tagging system will be:
-
-- `stable`: OpenSSL 1.1.1 and the latest stable Rust.
-- **DEPRECATED** `stable-openssl11`: OpenSSL 1.1 and Rust 1.42.0. This will no longer be updated. Use `stable` instead.
-- **DEPRECATED** `1.42.0-openssl10` and `nightly-2020-03-12-openssl10`: OpenSSL 1.0.2. These will not be updated to newer Rust. You will still be able to build newer OpenSSL 1.0.2 images manually.
-
-I hate to break compatibility with projects that require OpenSSL 1.0.2, but since it will receive no future security updates, I no longer feel comfortable supplying pre-built images.
-
 ## Caching builds
 
 You may be able to speed up build performance by adding the following `-v` commands to the `rust-musl-builder` alias:
@@ -205,7 +200,7 @@ This is missing many of the libraries used by the `x86_64` build, and it should
 
 ## Development notes
 
-After modifying the image, run `./test-image` to make sure that everything works.xs
+After modifying the image, run `./test-image` to make sure that everything works.
 
 ## Other ways to build portable Rust binaries