diff --git a/.github/release.yaml b/.github/release.yaml
index d299d225..df0008ef 100644
--- a/.github/release.yaml
+++ b/.github/release.yaml
@@ -8,6 +8,11 @@ changelog:
     - title: Breaking changes
       labels:
         - breaking-change
+    # must come before Bugfixes/New Features: PRs land in the first matching
+    # category, and security-relevant PRs usually also carry "bug" or "enhancement"
+    - title: Security
+      labels:
+        - security
     - title: Bugfixes
       labels:
         - bug