diff --git a/CHANGES.rst b/CHANGES.rst
index c5b38b5ca4..1f97680f41 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,17 +7,20 @@ Changes:
 * Reduce DB hits for replication (PR #1141)
 * Implement pluggable password auth (PR #1155)
 * Remove rate limiting from app service senders and fix get_or_create_user
-  requester (PR #1157)
+  requester, thanks to Patrik Oldsberg (PR #1157)
 * window.postmessage for Interactive Auth fallback (PR #1159)
-* Use sys.executable instead of hardcoded python. fixes #1161 (PR #1162)
+* Use sys.executable instead of hardcoded python, thanks to Pedro Larroy
+  (PR #1162)
 * Add config option for adding additional TLS fingerprints (PR #1167)
 * User-interactive auth on delete device (PR #1168)
 
 
 Bug fixes:
 
-* Fix not being allowed to set your own state_key (PR #1150)
-* Fix interactive auth to return 401 from for incorrect password (PR #1160)
+* Fix not being allowed to set your own state_key, thanks to Patrik Oldsberg
+  (PR #1150)
+* Fix interactive auth to return 401 from for incorrect password (PR #1160,
+  #1166)
 * Fix email push notifs being dropped (PR #1169)