diff --git a/ChangeLog b/ChangeLog
index 497d7195254c..4df6a665346b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,11 @@
 Mbed TLS ChangeLog (Sorted per branch, date)
 
-= Mbed TLS x.x.x branch released xxxx-xx-xx
+= Mbed TLS 2.28.8 branch released 2024-03-28
 
 Features
-   *  AES-NI is now supported in Windows builds with clang and clang-cl.
-      Resolves #8372.
-   * Add pc files for pkg-config. eg.:
+   * AES-NI is now supported in Windows builds with clang and clang-cl.
+     Resolves #8372.
+   * Add pc files for pkg-config, e.g.:
      pkg-config --cflags --libs (mbedtls|mbedcrypto|mbedx509)
 
 Security
@@ -20,16 +20,16 @@ Security
      copying may be disabled by setting MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS.
      Note that setting this option will cause input-output buffer overlap to
      be only partially supported (#3266).
-     Fixes CVE-2024-28960
+     Fixes CVE-2024-28960.
 
 Bugfix
    * Fix the build with CMake when Everest is enabled through
      a user configuration file or the compiler command line. Fixes #8165.
-  * Fix an inconsistency between implementations and usages of `__cpuid`,
-    which mainly causes failures when building Windows target using
-    mingw or clang. Fixes #8334 & #8332.
-   * Correct initial capacities for key derivation algorithms:TLS12_PRF,
-     TLS12_PSK_TO_MS
+   * Fix an inconsistency between implementations and usages of `__cpuid`,
+     which mainly causes failures when building Windows target using
+     mingw or clang. Fixes #8334 & #8332.
+   * Correct initial capacities for key derivation algorithms: TLS12_PRF,
+     TLS12_PSK_TO_MS.
    * Fix mbedtls_pk_get_bitlen() for RSA keys whose size is not a
      multiple of 8. Fixes #868.
    * Avoid segmentation fault caused by releasing not initialized
@@ -38,7 +38,7 @@ Bugfix
      allowed SSL sessions saved in one configuration to be loaded in a
      different, incompatible configuration.
    * Fix the restoration of the ALPN when loading serialized connection with
-   * the mbedtls_ssl_context_load() API.
+     the mbedtls_ssl_context_load() API.
    * Fully support arbitrary overlap between inputs and outputs of PSA
      functions. Note that overlap is still only partially supported when
      MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS is set (#3266).