diff --git a/CHANGES-202605.md b/CHANGES-202605.md
index 5291ba69..d6f075e2 100644
--- a/CHANGES-202605.md
+++ b/CHANGES-202605.md
@@ -187,6 +187,7 @@ CREATE TABLE IF NOT EXISTS suppressions (
 - **libspf2 include/library paths not propagated to Makefiles**: `configure.ac` modified `CFLAGS` to pass the SPF2 include path to `AC_SEARCH_LIBS`, but autoconf does not propagate `CFLAGS` changes into generated Makefiles. This caused build failures in rpmbuild environments (Fedora/EPEL) where `CFLAGS` is pre-set by distribution policy. Paths are now appended to `CPPFLAGS` and `LDFLAGS` instead, making `--with-spf2-include` and `--with-spf2-lib` work correctly. (#287, issue #146)
 - **`@sysconfdir@`/`@sbindir@`/`@localstatedir@` never expanded in generated scripts**: These standard autoconf directory variables only self-expand inside Makefiles, where Make resolves the nested `${prefix}` reference at build time. For non-Makefile `AC_CONFIG_FILES` outputs, `config.status` substitutes them with their literal unexpanded form (e.g. `${prefix}/etc`), which is meaningless once dropped into a Perl string or a systemd unit file. This broke the default config-file lookup in `opendmarc-reports` and `opendmarc-importstats`, the `$import` command `opendmarc-importstats` shells out to, and `ExecStart`/`EnvironmentFile`/`ReadWritePaths` in the generated `opendmarc.service` -- on every platform, not just non-`/etc` ones like FreeBSD. `configure.ac` now also resolves `SBINDIR` and `LOCALSTATEDIR` the same way it already resolved `SYSCONFDIR`, and all affected templates use the resolved uppercase forms. `opendmarc-run` is also now a proper `.in` template installed via `make install` (to `$(libexecdir)`) instead of a static, hardcoded-path script that was never wired into the build. (issue #420)
 - **`opendmarc-run` moved from `contrib/` to `reports/`**: `contrib/README` describes that directory as community-contributed and "not directly supported by the project team," which stopped being true once `opendmarc-run` became a real `.in` template wired into the build and actually installed by `make install`. It now lives alongside the tools it wraps (`opendmarc-import`, `opendmarc-expire`, `opendmarc-reports`), still installed to `$(libexecdir)` rather than `$(sbindir)` since it's a cron wrapper, not an interactively-run admin tool.
+- **`char`/`u_char` pointer-sign warnings resolved throughout libopendmarc and the milter**: CI builds with `-Wno-pointer-sign` to suppress roughly 240 warnings caused by the long-standing mixing of `char *` and `u_char *` across function signatures. A non-CI build (Clang on FreeBSD, without that flag) surfaced all of them, plus a stray nested `/*` inside an already-open block comment. Resolved with explicit casts at each char/u_char boundary, matching the casting style already used elsewhere in these files. Two existing casts on `dfc->mctx_jobid` (actually declared `char *`, not `u_char *`) were backwards and have been removed rather than compounded. `make check` surfaced the same warning class in `libopendmarc/tests/*.c`, plus a real bug: `test_dmarc_fetch.c` declared the return of `opendmarc_policy_fetch_ruf()`/`opendmarc_policy_fetch_rua()` as `u_char *` when both functions actually return `u_char **`, caught by `-Wincompatible-pointer-types`. (#426, #427)
 
 ---