diff --git a/doc/Changelog b/doc/Changelog
index 3006d53fb..d85f13142 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+27 July 2018: Wouter
+	- Fix man page, say that chroot is enabled by default.
+
 26 July 2018: Wouter
 	- Fix #4135: 64-bit Windows Installer Creates Entries Under The
 	  Wrong Registry Key, reported by Brian White.
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 4698c38e9..e5c76b5f9 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -557,8 +557,9 @@ to chroot and dropping permissions. This allows the pidfile to be
 Additionally, unbound may need to access /dev/random (for entropy)
 from inside the chroot.
 .IP
-If given a chroot is done to the given directory. The default is
-"@UNBOUND_CHROOT_DIR@". If you give "" no chroot is performed.
+If given a chroot is done to the given directory. By default chroot is
+enabled and the default is "@UNBOUND_CHROOT_DIR@". If you give "" no
+chroot is performed.
 .TP
 .B username: \fI<name>
 If given, after binding the port the user privileges are dropped. Default is