diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9017157..efaeaff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,23 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 ### Added
-- Added comprehensive upload/download tests for size boundaries (1B to 1GB)
-- Added concurrent upload/download tests (2, 5, 10 parallel operations)
-- Added data integrity tests (binary, text, unicode, compressed content)
-- Added chunk boundary tests for edge cases
-- Added `@pytest.mark.large` and `@pytest.mark.concurrent` test markers
-- Added `generate_content()` and `generate_content_with_hash()` test helpers
-- Added `sized_content` fixture for generating test content of specific sizes
-- Added upload API tests: upload without tag, artifact creation verification, S3 object creation
-- Added download API tests: tag: prefix resolution, 404 for nonexistent project/package/artifact
-- Added download header tests: Content-Type, Content-Length, Content-Disposition, ETag, X-Checksum-SHA256
-- Added error handling tests: timeout behavior, checksum validation, resource cleanup, graceful error responses
-- Added version API tests: version creation, auto-detection, listing, download by version prefix, deletion
-- Added integrity verification tests: round-trip hash verification, client-side verification workflow, size variants (1KB-10MB)
-- Added consistency check endpoint tests with response format validation
-- Added corruption detection tests: bit flip, truncation, appended content, size mismatch, missing S3 objects
-- Added Digest header tests (RFC 3230) and verification mode tests
-- Added integrity verification documentation (`docs/integrity-verification.md`)
+- Added comprehensive upload/download tests for size boundaries (1B to 1GB) (#38)
+- Added concurrent upload/download tests (2, 5, 10 parallel operations) (#38)
+- Added data integrity tests (binary, text, unicode, compressed content) (#38)
+- Added chunk boundary tests for edge cases (#38)
+- Added `@pytest.mark.large` and `@pytest.mark.concurrent` test markers (#38)
+- Added `generate_content()` and `generate_content_with_hash()` test helpers (#38)
+- Added `sized_content` fixture for generating test content of specific sizes (#38)
+- Added upload API tests: upload without tag, artifact creation verification, S3 object creation (#38)
+- Added download API tests: tag: prefix resolution, 404 for nonexistent project/package/artifact (#38)
+- Added download header tests: Content-Type, Content-Length, Content-Disposition, ETag, X-Checksum-SHA256 (#38)
+- Added error handling tests: timeout behavior, checksum validation, resource cleanup, graceful error responses (#38)
+- Added version API tests: version creation, auto-detection, listing, download by version prefix (#38)
+- Added integrity verification tests: round-trip hash verification, client-side verification workflow, size variants (1KB-10MB) (#40)
+- Added consistency check endpoint tests with response format validation (#40)
+- Added corruption detection tests: bit flip, truncation, appended content, size mismatch, missing S3 objects (#40)
+- Added Digest header tests (RFC 3230) and verification mode tests (#40)
+- Added integrity verification documentation (`docs/integrity-verification.md`) (#40)
 - Added `package_versions` table for immutable version tracking separate from mutable tags (#56)
   - Versions are set at upload time via explicit `version` parameter or auto-detected from filename/metadata
   - Version detection priority: explicit parameter > package metadata > filename pattern
@@ -61,7 +61,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Improved pod naming: Orchard pods now named `orchard-{env}-server-*` for clarity (#51)
 
 ### Fixed
-- Fixed Content-Disposition header encoding for non-ASCII filenames using RFC 5987
+- Fixed Content-Disposition header encoding for non-ASCII filenames using RFC 5987 (#38)
 - Fixed deploy jobs running even when tests or security scans fail (changed rules from `when: always` to `when: on_success`) (#63)
 - Fixed python_tests job not using internal PyPI proxy (#63)
 - Fixed `cleanup_feature` job failing when branch is deleted (`GIT_STRATEGY: none`) (#51)