diff --git a/CHANGELOG.md b/CHANGELOG.md
index 30820d45e4..70d51caed0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@
 ## 3.12.0-rc.0 / 2026-05-15
 
 - [SECURITY] Remote-write: Reject snappy-compressed requests whose declared decoded length exceeds the 32MB. #18642
-- [SECURITY] STACKIT SD: Fix secrets being exposed in plaintext via `/-/config` endpoint. Kudos to GHSA-39j6-789q-qxvh #18649
+- [SECURITY] STACKIT SD: Fix secrets being exposed in plaintext via `/-/config` endpoint. Thanks to @August829 and @Phaxma for reporting. GHSA-39j6-789q-qxvh #18649
 - [CHANGE] TSDB/Agent: Adds Start Timestamp field to all WAL Histogram samples in memory; used `st-storage` flag is enabled. #18221
 - [FEATURE] API: Add `/api/v1/status/self_metrics` endpoint returning the current state of the Prometheus server's own metrics about itself as JSON. #18411
 - [FEATURE] Discovery: Add DigitalOcean Managed Databases service discovery #18287
diff --git a/scripts/generate_release_notes.sh b/scripts/generate_release_notes.sh
index 2ded5e8a52..cf42717427 100755
--- a/scripts/generate_release_notes.sh
+++ b/scripts/generate_release_notes.sh
@@ -51,6 +51,9 @@ TMPL='{{- $version := .CurrentRevision -}}
 
 release_branch="release-${major}.${minor}"
 
+tmp_file=$(mktemp)
+trap 'rm -f "${tmp_file}"' EXIT
+
 if [[ "${patch}" == "0" ]]; then
 	# Minor release (any RC or final): cover the full cycle from the previous minor's branch-cut point.
 	prev_minor=$(( minor - 1 ))
@@ -64,7 +67,7 @@ if [[ "${patch}" == "0" ]]; then
 		--org prometheus --repo prometheus \
 		--required-author="" --dependencies=false \
 		--go-template="go-template:inline:${TMPL}" \
-		--output=/dev/stdout
+		--output="${tmp_file}" || exit 1
 else
 	# Patch release: cover commits since the previous patch tag.
 	prev_patch=$(( patch - 1 ))
@@ -79,5 +82,12 @@ else
 		--required-author="" --dependencies=false \
 		--go-template="go-template:inline:${TMPL}" \
 		--skip-first-commit \
-		--output=/dev/stdout
+		--output="${tmp_file}" || exit 1
 fi
+
+# sed is used to remove the @user references from the release notes.
+# Prometheus CHANGELOG used to not do this.
+sed -E 's/\((#[0-9]+), @[^)]+\)/\1/g' "${tmp_file}"
+
+echo "Done; Removing "${tmp_file}" temporary file."
+echo "Maintainers, please copy the output to CHANGELOG.md and adjust if needed."