diff --git a/.changelog-reader.yml b/.changelog-reader.yml
new file mode 100644
index 00000000..91f9f19e
--- /dev/null
+++ b/.changelog-reader.yml
@@ -0,0 +1,12 @@
+# Configuration for mindsers/changelog-reader-action (see .github/workflows
+# and the org's reusable powershell-ci.yml, which sets validation_level but
+# not validation_depth).
+#
+# Releases 0.65.1-0.66.2 predate this org's Keep a Changelog / SemVer
+# patch-section convention: those patch versions genuinely shipped
+# Added/Changed content alongside fixes (verified against their git tags),
+# so recategorizing them as Fixed-only would misrepresent what shipped.
+# Scoping validation to the most recent released entries keeps the linter
+# enforcing the convention on new work without rewriting that history.
+# See #499.
+validation_depth: 2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8940b4d2..8be63696 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+> Releases `0.65.1`-`0.66.2` predate this project's adoption of the
+> Keep a Changelog patch-release convention (only `Fixed`/`Security` entries)
+> and genuinely shipped `Added`/`Changed` content in what were nominally
+> patch versions; those historical entries are left as-is rather than
+> recategorized to avoid misrepresenting what actually shipped. CI changelog
+> validation is scoped to recent releases via `.changelog-reader.yml` (#499).
+
 ## [Unreleased]
 
 ### Changed