diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e683e94251..db11dcd1303 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Table of Contents
 
 * [Changelog for unreleased](#changelog-for-owncloud-core-unreleased-unreleased)
+* [Changelog for 10.16.4](#changelog-for-owncloud-core-10164-2026-07-29)
 * [Changelog for 10.16.3](#changelog-for-owncloud-core-10163-2026-05-22)
 * [Changelog for 10.16.2](#changelog-for-owncloud-core-10162-2026-04-02)
 * [Changelog for 10.16.1](#changelog-for-owncloud-core-10161-2026-02-18)
@@ -34,7 +35,7 @@
 The following sections list the changes in ownCloud core unreleased relevant to
 ownCloud admins and users.
 
-[unreleased]: https://github.com/owncloud/core/compare/v10.16.3...master
+[unreleased]: https://github.com/owncloud/core/compare/v10.16.4...master
 
 ## Summary
 
@@ -53,7 +54,6 @@ ownCloud admins and users.
 * Bugfix - Normalise trashbin original-location PROPFIND response: [#39337](https://github.com/owncloud/core/issues/39337)
 * Bugfix - Add missing space to mail footer signature delimiter: [#41364](https://github.com/owncloud/core/issues/41364)
 * Bugfix - Fix htaccess RewriteBase rules blocking API requests by file extension: [#41418](https://github.com/owncloud/core/issues/41418)
-* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
 * Bugfix - Adjust code to avoid PHP8 messages: [#41597](https://github.com/owncloud/core/pull/41597)
 * Bugfix - Support federation between systems in subdirectories: [#41599](https://github.com/owncloud/core/pull/41599)
 * Bugfix - Remove owncloud.com/federation link from federated cloud settings: [#41608](https://github.com/owncloud/core/pull/41608)
@@ -272,15 +272,6 @@ ownCloud admins and users.
 
    https://github.com/owncloud/core/issues/41418
 
-* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
-
-   The verification token and confirmation link in the subadmin path of
-   setMailAddress were associated with the caller's account instead of the target
-   user's account. Clicking the confirmation link changed the subadmin's email
-   rather than the intended target's email.
-
-   https://github.com/owncloud/core/pull/41574
-
 * Bugfix - Adjust code to avoid PHP8 messages: [#41597](https://github.com/owncloud/core/pull/41597)
 
    Avoid trying to access array offset on false in the encryption storage wrapper.
@@ -739,6 +730,38 @@ ownCloud admins and users.
 
    https://github.com/owncloud/core/pull/41762
 
+# Changelog for ownCloud Core [10.16.4] (2026-07-29)
+
+The following sections list the changes in ownCloud core 10.16.4 relevant to
+ownCloud admins and users.
+
+[10.16.4]: https://github.com/owncloud/core/compare/v10.16.3...v10.16.4
+
+## Summary
+
+* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
+* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763)
+
+## Details
+
+* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
+
+   The verification token and confirmation link in the subadmin path of
+   setMailAddress were associated with the caller's account instead of the target
+   user's account. Clicking the confirmation link changed the subadmin's email
+   rather than the intended target's email.
+
+   https://github.com/owncloud/core/pull/41574
+
+* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763)
+
+   The legacy WebDAV chunked upload path assembled the final file without
+   respecting the pre-write hook result, so the filename blacklist that applies to
+   ordinary uploads was not enforced for chunked uploads. The chunked assembly now
+   aborts when a write hook vetoes the file, matching the non-chunked upload path.
+
+   https://github.com/owncloud/core/pull/41763
+
 # Changelog for ownCloud Core [10.16.3] (2026-05-22)
 
 The following sections list the changes in ownCloud core 10.16.3 relevant to
diff --git a/changelog/unreleased/41574 b/changelog/10.16.4_2026-07-29/41574
similarity index 100%
rename from changelog/unreleased/41574
rename to changelog/10.16.4_2026-07-29/41574
diff --git a/changelog/10.16.4_2026-07-29/41763 b/changelog/10.16.4_2026-07-29/41763
new file mode 100644
index 00000000000..31a2a56fcad
--- /dev/null
+++ b/changelog/10.16.4_2026-07-29/41763
@@ -0,0 +1,9 @@
+Change: Honour the write hook veto on legacy chunked WebDAV uploads
+
+The legacy WebDAV chunked upload path assembled the final file without
+respecting the pre-write hook result, so the filename blacklist that applies
+to ordinary uploads was not enforced for chunked uploads. The chunked
+assembly now aborts when a write hook vetoes the file, matching the
+non-chunked upload path.
+
+https://github.com/owncloud/core/pull/41763