diff --git a/changelog/69402.fixed.md b/changelog/69402.fixed.md
new file mode 100644
index 000000000000..c703f49ee586
--- /dev/null
+++ b/changelog/69402.fixed.md
@@ -0,0 +1,4 @@
+Prefix ``file.managed`` error comments with ``Unable to manage file:`` and
+redact HTTP basic-auth credentials from ``Source hash`` error messages in
+``salt.modules.file.get_source_sum`` so they are not leaked in state output
+or logs.
diff --git a/changelog/69461.fixed.md b/changelog/69461.fixed.md
new file mode 100644
index 000000000000..c9bc78327b64
--- /dev/null
+++ b/changelog/69461.fixed.md
@@ -0,0 +1,4 @@
+Fix ``NotADirectoryError`` in ``tools/pkg/build.py`` ``salt_onedir`` by no
+longer passing the source tarball path as the ``cwd=`` of the
+``git add -f salt/_version.txt`` subprocess; the command now runs in the
+salt source checkout (a real git working tree) as intended.