diff --git a/CHANGELOG.md b/CHANGELOG.md
index 853cfbfd..f14be146 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ The **patch** part changes incrementally at each release.
 * Preliminary support for Debian 11 « Bullseye »
 * apache: new variable for mpm mode (+ updated default config accordingly)
 * certbot: add script for manual deploy hooks execution
+* evolinux-base: install molly-guard by default
 * listupgrade: crontab is configurable
 * mongodb: create munin plugins directory if missing
 * mysql: script "mysql_connections" to display a compact list of connections
diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml
index 8df64abd..9d9a6d6a 100644
--- a/evolinux-base/tasks/packages.yml
+++ b/evolinux-base/tasks/packages.yml
@@ -34,6 +34,7 @@
       - telnet
       - traceroute
       - man
+      - molly-guard
   when: evolinux_packages_diagnostic | bool
 
 - name: Install/Update hardware tools