diff --git a/ChangeLog.d/fix-invalid-id-error-code.txt b/ChangeLog.d/fix-invalid-id-error-code.txt
new file mode 100644
index 000000000000..069a7678b7e3
--- /dev/null
+++ b/ChangeLog.d/fix-invalid-id-error-code.txt
@@ -0,0 +1,5 @@
+Bugfix
+   * PSA functions creating a key now return PSA_ERROR_INVALID_ARGUMENT rather
+     than PSA_ERROR_INVALID_HANDLE when the identifier specified for the key
+     to create is not valid, bringing them in line with version 1.0.0 of the
+     specification. Fix #4271.