diff --git a/CHANGES b/CHANGES
index 92323f36b2..abedcfe7b3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5932.	[bug]		Fix rndc dumpdb -expired and always include expired
+			RRsets, not just for RBTDB_VIRTUAL time window.
+			[GL #3462]
+
 5931.	[bug]		Fix DiG query error handling robustness in NSSEARCH
 			mode by making sure that udp_ready(), tcp_connected(),
 			and send_done() callbacks start the next query in chain
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index acbec4e529..bbc6fc35bf 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -58,3 +58,7 @@ Bug Fixes
 - Non-dynamic zones that inherit dnssec-policy from the view or
   options level were not marked as inline-signed, and thus were never
   scheduled to be re-signed. This is now fixed. :gl:`#3438`
+
+- Fix `rndc dumpdb -expired` to include expired RRsets, even if the cache
+  cleaning time window has passed. This will now show expired RRsets that are
+  stuck in the cache. :gl:`#3462`