diff --git a/changelog.d/2225.feature.md b/changelog.d/2225.feature.md
new file mode 100644
index 000000000..35630dc80
--- /dev/null
+++ b/changelog.d/2225.feature.md
@@ -0,0 +1 @@
+Disable legacy, unauthenticated media (`allow_legacy_media`) by default as the Matrix ecosystem has completely sunsetted this functionality. Legacy media allows anyone to access a file just by knowing its URL, thereby turning homeservers into unwitting CDNs. Homeserver admins are strongly encouraged to check and turn off this option.