diff --git a/doc/Changelog b/doc/Changelog
index cd6848653..4c96c99b8 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+16 February 2026: Yorgos
+	- Fix #1404: Priming the root key fails after loading ipfire.org RPZ
+	  zones. Fixed by including the ZONEMD RRtype in the list of types to
+	  ignore for RPZ zones. Analysis and patch provided by ummeegge.
+
 11 February 2026: Wouter
 	- Fix #1403: Inconsistency between do-nat64 and do-not-query-address
 	  during retries.
diff --git a/services/rpz.c b/services/rpz.c
index f45cf6542..d83acbfb0 100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -153,6 +153,7 @@ rpz_type_ignored(uint16_t rr_type)
 		case LDNS_RR_TYPE_SOA:
 		case LDNS_RR_TYPE_NS:
 		case LDNS_RR_TYPE_DNAME:
+		case LDNS_RR_TYPE_ZONEMD:
 		/* all DNSSEC-related RRs must be ignored */
 		case LDNS_RR_TYPE_DNSKEY:
 		case LDNS_RR_TYPE_DS: