diff --git a/content/releases/3.breaking-changes/3.version-12.md b/content/releases/3.breaking-changes/3.version-12.md
index 327f0d936..9670a67e0 100644
--- a/content/releases/3.breaking-changes/3.version-12.md
+++ b/content/releases/3.breaking-changes/3.version-12.md
@@ -10,6 +10,22 @@ description: Breaking changes may require action on your part before upgrading.
 
 The `/utils/hash/generate` and `/utils/hash/verify` endpoints have been removed. Equivalent behavior can be achieved by using extensions endpoints along with the `argon2` library.
 
+### Sensitive GraphQL system mutations are now limited to single use
+
+Sensitive GraphQL system mutations are now limited to one per request, set by the `GRAPHQL_SINGLE_USE_MUTATIONS` environment variable.
+
+### GraphQL WebSocket restrictions now match the HTTP endpoint
+
+GraphQL over WebSockets now applies the same restrictions as the HTTP endpoint. When introspection is disabled, validation hints are hidden.
+
+### `CORS_ORIGIN` is now enforced for WebSocket connections
+
+WebSocket connections are now validated against `CORS_ORIGIN`. If you use WebSockets, make sure `CORS_ORIGIN` includes your clients' origins, or those connections will now be rejected.
+
+### Hardened upload path validation
+
+Upload path validation has been hardened to prevent writes to extension and temporary storage directories. Uploads that previously targeted these protected directories will now be rejected.
+
 ## Version 12.0.0
 
 Jump to: