diff --git a/docs/changes/2.2.0/793.upgrade.md b/docs/changes/2.2.0/793.upgrade.md
new file mode 100644
index 00000000..69ad658d
--- /dev/null
+++ b/docs/changes/2.2.0/793.upgrade.md
@@ -0,0 +1,9 @@
+`yarn npm login` (Yarn 2+) and `npm login --auth-type=legacy` take a local
+account's password only while the local realm's **Accept passwords from
+clients (HTTP Basic)** is on, as the feeds do. In 2.1 these logins took it
+whatever `allow_password_basic` said. The upgrade sets the local realm's
+setting from `allow_password_basic`, which was off by default, so on such an
+install these logins answer 401 for every local account after the upgrade;
+accounts of a credential-forwarding realm sign in as before. Turn the
+setting on for the local realm under **Admin → Authentication**, or sign npm
+in with the browser (`npm login`) or a token from the web UI.