diff --git a/changelog.d/1580 b/changelog.d/1580
new file mode 100644
index 00000000..a1adea64
--- /dev/null
+++ b/changelog.d/1580
@@ -0,0 +1,10 @@
+synopsis: Allow IO in validationKeys
+prs: #1580
+issues: #1579
+
+description: {
+
+Currently validationKeys are a fixed JWKSet. This does not work for setups such
+as AWS Cognito or Okta, where there is a regular key rotation. This change
+alters the type of validationKeys from JWKSet to IO JWKSet.
+}