diff --git a/CHANGELOG.md b/CHANGELOG.md
index d81608af4d..ffbf71fcb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,13 +8,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 ## [4.15.0 UNRELEASED](https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.15.0) - TBD
 
-## Added / support upgraded
+### Added / support upgraded
  - ARM IOREQ servers (device emulation etc.) (Tech Preview)
  - Renesas IPMMU-VMSA (Supported, not security supported; was Tech Preview)
  - ARM SMMUv3 (Tech Preview)
  - Switched MSR accesses to deny by default policy.
 
-## Removed / support downgraded
+### Removed / support downgraded
 
  - qemu-xen-traditional as host process device model, now "No security
    support, not recommended".  (Use as stub domain device model is still