diff --git a/CHANGELOG.md b/CHANGELOG.md
index a023bbe0..bc9ea7e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ The **patch** part changes incrementally at each release.
 ### Added
 * apache: add server status suffix in VHost (and default site) if missing
 * apt: add a script to manage packages with "hold" mark
+* evolinux-base: install "spectre-meltdown-checker" (Debian 9 and later)
 * evomaintenance: make hooks configurable
 * nginx: add server status suffix in VHost (and default site) if missing
 * redmine: enable gzip compression in nginx vhost
diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml
index c510bab5..aab2f6da 100644
--- a/evolinux-base/tasks/packages.yml
+++ b/evolinux-base/tasks/packages.yml
@@ -91,6 +91,7 @@
     name: "{{ item }}"
   with_items:
   - net-tools
+  - spectre-meltdown-checker
   when:
   - evolinux_packages_stretch
   - ansible_distribution_major_version | version_compare('9', '>=')