diff --git a/actions/ql/src/change-notes/2026-05-12-sha256-pinned-actions.md b/actions/ql/src/change-notes/2026-05-12-sha256-pinned-actions.md
new file mode 100644
index 00000000000..521a5878c37
--- /dev/null
+++ b/actions/ql/src/change-notes/2026-05-12-sha256-pinned-actions.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/unpinned-tag` query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.