diff --git a/CHANGELOG-6.4.md b/CHANGELOG-6.4.md
index d90aa4d68616c..55b4c7823acec 100644
--- a/CHANGELOG-6.4.md
+++ b/CHANGELOG-6.4.md
@@ -7,6 +7,44 @@ in 6.4 minor versions.
 To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
 To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v6.4.0...v6.4.1
 
+* 6.4.13 (2024-10-27)
+
+ * bug #58669 [Cache] Revert "Initialize RedisAdapter cursor to 0" (nicolas-grekas)
+ * bug #58649 [TwigBridge] ensure compatibility with Twig 3.15 (xabbuh)
+ * bug #58661 [Cache] Initialize RedisAdapter cursor to 0 (thomas-hiron)
+ * bug #58593 [Mime] fix encoding issue with UTF-8 addresses containing doubles spaces (0xb4lint)
+ * bug #58636 [Notifier] Improve Telegrams markdown escaping (codedge)
+ * bug #58615 [Validator] [Choice] Fix callback option if not array returned (symfonyaml)
+ * bug #58618 [DependencyInjection] Fix linting factories implemented via __callStatic (KevinVanSonsbeek)
+ * bug #58619 [HttpFoundation][Lock] Ensure compatibility with ext-mongodb v2 (GromNaN)
+ * bug #58627 Minor fixes around `parse_url()` checks (nicolas-grekas)
+ * bug #58617 [DependencyInjection] Fix replacing abstract arguments with bindings (nicolas-grekas)
+ * bug #58623 [Intl] do not access typed property before initialization (xabbuh)
+ * bug #58613 Symfony 5.4 LTS will get security fixes until Feb 2029 thanks to Ibexa' sponsoring (nicolas-grekas)
+ * bug #58523 [DoctrineBridge] fix: DoctrineTokenProvider not oracle compatible (jjjb03)
+ * bug #58569 [Mailer][MailJet] Fix parameters for TrackClicks and TrackOpens (torohill)
+ * bug #58557 [Doctrine][Messenger] Oracle sequences are suffixed with `_seq` (clem-rwan)
+ * bug #58525 [Notifier] silence warnings triggered when malformed XML is parsed (xabbuh)
+ * bug #58550 [Scheduler] silence PHP warning when an invalid date interval format string is used (xabbuh)
+ * bug #58492 [MonologBridge] Fix PHP deprecation with `preg_match()` (simoheinonen)
+ * bug #58449 [Form] Support intl.use_exceptions/error_level in NumberToLocalizedStringTransformer (bram123)
+ * bug #54566 [Doctrine][Messenger] Use common sequence name to get id from Oracle (rjd22)
+ * bug #58459 [FrameworkBundle] Fix displayed stack trace when session is used on stateless routes (nicolas-grekas)
+ * bug #58255 [Serializer] Fix `ObjectNormalizer` gives warnings on normalizing with public static property (André Laugks)
+ * bug #58306 [Serializer] Collect denormalization errors for variadic params (mtarld)
+ * bug #58376 [HttpKernel] Correctly merge `max-age`/`s-maxage` and `Expires` headers (aschempp)
+ * bug #58299 [DependencyInjection] Fix `XmlFileLoader` not respecting when env for services (Bradley Zeggelaar)
+ * bug #58332 [Console] Suppress `proc_open` errors within `Terminal::readFromProcess` (fritzmg)
+ * bug #58343 [HttpClient] Add `crypto_method` to scoped client options (HypeMC)
+ * bug #58395 [TwigBridge] Fixed a parameterized choice label translation (7-zete-7)
+ * bug #58409 [Translation] Fix extracting of message from ->trans() method with named params (tugmaks)
+ * bug #58404 [TwigBridge] Remove usage of `Node()` instantiations (fabpot)
+ * bug #58377 [Emoji] Update data to support emoji 16 (lyrixx)
+ * bug #58393 [Dotenv] Default value can be empty (HypeMC)
+ * bug #58400 [Mailer] Fix exception message on invalid event in `SendgridPayloadConverter` (alexandre-daubois)
+ * bug #58372 Tweak error/exception handler registration (nicolas-grekas)
+ * bug #58365 [Cache] silence warnings issued by Redis Sentinel on connection issues (xabbuh)
+
 * 6.4.12 (2024-09-21)
 
  * bug #58339 [Notifier] allow the Novu bridge to be used with symfony/notifier 7.x (xabbuh)