diff --git a/docs/modules/release-notes/pages/all-releases/4_28.adoc b/docs/modules/release-notes/pages/all-releases/4_28.adoc
index ff73e5344..5aced2cf0 100644
--- a/docs/modules/release-notes/pages/all-releases/4_28.adoc
+++ b/docs/modules/release-notes/pages/all-releases/4_28.adoc
@@ -139,6 +139,16 @@ Completed automation sessions can now be converted into Test Cases, matching the
 - Fixed an issue where Scriptless Test Runs could fail with "Device retry exceeded" errors on organizations with parallel testing enabled. Test Runs now wait until a parallel test slot becomes available instead of attempting a booking that would be rejected.
 - Fixed Scriptless Test Runs failing with "User not found" errors for users signed in via SSO, Google, or GitHub.
 
+// REVIEW (Robot Ranch draft, KOB-51470): confirm the target release before publishing.
+// The fix was still in open PRs and had not completed test validation when this entry was drafted.
+// Standalone-only change: confirm whether it belongs here or in a Standalone (S) release file.
+=== Security Banner
+
+- Fixed *Settings > Security Banner* being blocked on Standalone deployments. The page displayed _Security Banner setting page is available by upgrading your plan_ instead of the banner editor, which prevented admins from editing or publishing the login message and stopped published banners from appearing to users at sign-in.
++
+** Subscription expiry no longer gates the Security Banner on Standalone deployments, where plan upgrades do not apply. Cloud deployments are unaffected.
+** Permission requirements are unchanged. Only *Admins* or users with the `org_setting.modify_security_banner` permission can change the xref:organization:change-the-login-message.adoc[login message,window=read-later].
+
 === Session lifecycle
 
 - Improved handling of CLI sessions to prevent stale CLI sessions from persisting.