diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13f0ad5..2fbf4d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,7 +27,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **DC-103: One-click auto-route adoption.** `POST /api/v1/discover/adopt` creates service entry + Caddyfile reverse_proxy route + DNS record from a discovered container.
 - **DC-104: App catalog.** `GET /api/v1/catalog` browses 76 curated templates with category filtering, search, and popular badges. 7 auto-detected categories.
 - **DC-105: Smart defaults wizard.** "What do you want to self-host?" — 6 categories (media, files, network, smart home, development, monitoring), hardware profile limits, cross-category dedup with priority sorting.
-- **DC-106: Caddyfile-as-code.** Visual reverse proxy builder API — generate Caddyfile blocks from JSON config (TLS, auth, CORS, headers, WebSocket, compression, strip prefix). 5 preset templates.
+- **DC-106: Caddyfile-as-code.** Visual reverse proxy builder — form-driven UI in the Tools menu that consumes the `/api/v1/caddycode/{generate,validate,templates}` endpoints. Form fields (domain, upstream, TLS mode, behavior toggles, custom headers, DashCaddy SSO gate) → live Caddyfile preview with copy-to-clipboard. 5 preset templates. Frontend XSS protection + backend field sanitization (DC-070) for defense in depth. 19 unit tests.
 - **DC-107: Disaster recovery.** Full-system backup (services, config, credentials, Caddyfile, themes, assets) with SHA-256 checksum verification. One-click restore with partial-failure handling.
 - **DC-108: Multi-host fleet management.** Register/deregister remote DashCaddy instances, parallel health probes, multi-host deployment plan generation. API keys stored as SHA-256 hashes.