diff --git a/fake-gcs-server.changes b/fake-gcs-server.changes
index a4ea3ed..8f31a34 100644
--- a/fake-gcs-server.changes
+++ b/fake-gcs-server.changes
@@ -5,8 +5,8 @@ Tue Mar 11 08:23:03 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
   - fix: typos
   - Use default temporary directory in tests
   - Go 1.24 is out, drop Go 1.22
-- bsc#1239200 (CVE-2025-22868): revendor
-  to use golang.org/x/oauth2 v0.28.0
+- bsc#1239200 (CVE-2025-22868): add update-golang-oauth2.patch to
+  revendor to use golang.org/x/oauth2 v0.28.0
   (https://pkg.go.dev/vuln/GO-2025-3488).
 
 -------------------------------------------------------------------