diff --git a/ChangeLog.md b/ChangeLog.md
index 6309b21956..32f0ed083a 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -34,6 +34,12 @@ Bug fixes:
   we were forgetting to record the result, which meant that all tests
   always ran even if they had already passed before. See
   [#3770](https://github.com/commercialhaskell/stack/pull/3770).
+* Includes a patched version of `hackage-security` which fixes both
+  some issues around asynchronous exception handling, and moves from
+  directory locking to file locking, making the update mechanism
+  resilient against SIGKILL and machine failure. See
+  [hackage-security #187](https://github.com/haskell/hackage-security/issues/187)
+  and [#3073](https://github.com/commercialhaskell/stack/issues/3073).
 
 ## v1.6.3
 
diff --git a/stack-nightly.yaml b/stack-nightly.yaml
index 6e7e2c5e6a..f0da109e2b 100644
--- a/stack-nightly.yaml
+++ b/stack-nightly.yaml
@@ -7,3 +7,6 @@ nix:
     - http-client-tls-0.3.4
 extra-deps:
 - hpack-0.26.0
+- archive: https://github.com/haskell/hackage-security/archive/3297b0f3f4285cb30321baaa7b54e3d22e1f6bd7.tar.gz
+  subdirs:
+  - hackage-security
diff --git a/stack.yaml b/stack.yaml
index 3371af5b98..0c1712865a 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -30,3 +30,6 @@ extra-deps:
 - ansi-terminal-0.7.1.1
 - ansi-wl-pprint-0.6.8.1
 - smallcheck-1.1.3
+- archive: https://github.com/haskell/hackage-security/archive/3297b0f3f4285cb30321baaa7b54e3d22e1f6bd7.tar.gz
+  subdirs:
+  - hackage-security