diff --git a/CHANGELOG b/CHANGELOG
index ac7981c2a2..163cd06cc6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,36 @@
 v3.3.17 (XXXX-XX-XX)
 --------------------
 
+* added several advanced options for configuring and debugging LDAP connections.
+  Please note that some of the following options are platform-specific and may not 
+  work on all platforms or with all LDAP servers reliably:
+
+  - `--ldap.serialized`: whether or not calls into the underlying LDAP library 
+    should be serialized.
+    This option can be used to work around thread-unsafe LDAP library functionality.
+  - `--ldap.serialize-timeout`: sets the timeout value that is used when waiting to 
+    enter the LDAP library call serialization lock. This is only meaningful when 
+    `--ldap.serialized` has been set to `true`. 
+  - `--ldap.retries`: number of tries to attempt a connection. Setting this to values 
+    greater than one will make ArangoDB retry to contact the LDAP server in case no 
+    connection can be made initially.
+  - `--ldap.restart`: whether or not the LDAP library should implicitly restart 
+    connections
+  - `--ldap.referrals`: whether or not the LDAP library should implicitly chase 
+    referrals
+  - `--ldap.debug`: turn on internal OpenLDAP library output (warning: will print 
+    to stdout).
+  - `--ldap.timeout`: timeout value (in seconds) for synchronous LDAP API calls 
+    (a value of 0 means default timeout).
+  - `--ldap.network-timeout`: timeout value (in seconds) after which network operations 
+    following the initial connection return in case of no activity (a value of 0 means 
+    default timeout).
+  - `--ldap.async-connect`: whether or not the connection to the LDAP library will 
+    be done asynchronously.
+
+* fixed a shutdown race in ArangoDB's logger, which could have led to some buffered
+  log messages being discarded on shutdown
+
 * display shard synchronization progress for collections outside of the
   `_system` database