diff --git a/changelog.d/2444.bugfix.md b/changelog.d/2444.bugfix.md
new file mode 100644
index 000000000..27d87e4d0
--- /dev/null
+++ b/changelog.d/2444.bugfix.md
@@ -0,0 +1 @@
+Client-server API endpoints are now properly ratelimited for unauthenticated requests. Contributed by @ginger.