diff --git a/CHANGES b/CHANGES
index 604181d24a..a8eef143cc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5932.	[bug]		Fix rndc dumpdb -expired and always include expired
+			RRsets, not just for RBTDB_VIRTUAL time window.
+			[GL #3462]
+
 5931.	[bug]		Fix DiG query error handling robustness in NSSEARCH
 			mode by making sure that udp_ready(), tcp_connected(),
 			and send_done() callbacks start the next query in chain
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0bf1dcca11..2d89f1b1ad 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -57,3 +57,7 @@ Bug Fixes
   ``dnssec-policy``. In zones with both the old ``max-zone-ttl``
   option and ``dnssec-policy`` configured, the old option will be
   ignored, and a warning will be generated. :gl:`#2918`
+
+- Fix `rndc dumpdb -expired` to include expired RRsets, even if the cache
+  cleaning time window has passed. This will now show expired RRsets that are
+  stuck in the cache. :gl:`#3462`