diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6bbebb5..4e9bf2ed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,18 @@ All notable changes to `rh-model-signing` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.6] - 2026-11-05
+
+### Fixed
+- Added `pyOpenSSL` as a direct dependency. `model_signing` imports `OpenSSL` for certificate chain verification but relied on `sigstore` to install it, and `sigstore` 4.5.1 no longer does, so a fresh install failed with `ModuleNotFoundError: No module named 'OpenSSL'`. ([#685](https://github.com/sigstore/model-transparency/issues/685))
+- Security fixes.
+
+## [1.0.5] - 2026-10-19
+
+### Fixed
+- Added `pyOpenSSL` as a direct dependency. `model_signing` imports `OpenSSL` for certificate chain verification but relied on `sigstore` to install it, and `sigstore` 4.5.1 no longer does, so a fresh install failed with `ModuleNotFoundError: No module named 'OpenSSL'`. ([#685](https://github.com/sigstore/model-transparency/issues/685))
+- Security fixes.
+
 ## [1.0.4] - 2026-10-07
 
 ### Added
diff --git a/pyproject.toml b/pyproject.toml
index d0917b86..5a9c5c45 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,6 +41,7 @@ dependencies = [
   "in-toto-attestation",
   "oras>=0.2.30",
   "pyasn1>=0.6.4",
+  "pyOpenSSL",
   "sigstore>=4.2",
   "sigstore-models>=0.0.5",
   "typing_extensions",