diff --git a/.changelog/19285.txt b/.changelog/19285.txt
new file mode 100644
index 0000000000..52320702ed
--- /dev/null
+++ b/.changelog/19285.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+ca: Fix bug with Vault CA provider where token renewal goroutines could leak if CA failed to initialize.
+```
+
+```release-note:bug
+ca: Fix bug with Vault CA provider where renewing a retracted token would cause retries in a tight loop, degrading performance.
+```