diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64d70370f..6b8b6af0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,8 +2,19 @@
 
 ## Unreleased: mitmproxy next
 
-* Hard exit when mitmproxy cannot write logs, fixes endless loop when parent process exits
-  ([#4669](https://github.com/mitmproxy/mitmproxy/issues/4669), @Prinzhorn))
+
+
+## 02 November 2022: mitmproxy 9.0.1
+
+* The precompiled binaries now ship with OpenSSL 3.0.7, which resolves CVE-2022-3602 and CVE-2022-3786.
+* Performance and stability improvements for WireGuard mode.
+  ([#5694](https://github.com/mitmproxy/mitmproxy/issues/5694), @mhils, @decathorpe)
+* Fix a bug where the standalone Linux binaries would require libffi to be installed.
+  ([#5699](https://github.com/mitmproxy/mitmproxy/issues/5699), @mhils)
+* Hard exit when mitmproxy cannot write logs, fixes endless loop when parent process exits.
+  ([#4669](https://github.com/mitmproxy/mitmproxy/issues/4669), @Prinzhorn)
+* Fix a permission error affecting the Docker images.
+  ([#5700](https://github.com/mitmproxy/mitmproxy/issues/5700), @mhils)
 
 
 ## 28 October 2022: mitmproxy 9.0.0
@@ -27,6 +38,12 @@
 * Deprecate `mitmproxy.ctx.log` in favor of Python's builtin `logging` module.
   See [the docs](https://docs.mitmproxy.org/dev/addons-api-changelog/) for details and upgrade instructions.
   ([#5590](https://github.com/mitmproxy/mitmproxy/pull/5590), @mhils)
+  
+### Breaking Changes
+
+ * The `mode` option is now a list of server specs instead of a single spec.
+   The CLI interface is unaffected, but users may need to update their `config.yaml`.
+   ([#5393](https://github.com/mitmproxy/mitmproxy/pull/5393), @mhils)
 
 ### Full Changelog
 
diff --git a/mitmproxy/options.py b/mitmproxy/options.py
index 22dc1fcc2..2ca6ccb58 100644
--- a/mitmproxy/options.py
+++ b/mitmproxy/options.py
@@ -103,8 +103,9 @@ class Options(optmanager.OptManager):
             The proxy server type(s) to spawn. Can be passed multiple times.
 
             Mitmproxy supports "regular" (HTTP), "transparent", "socks5", "reverse:SPEC",
-            and "upstream:SPEC" proxy servers. For reverse and upstream proxy modes, SPEC
-            is host specification in the form of "http[s]://host[:port]".
+            "upstream:SPEC", and "wireguard[:PATH]" proxy servers. For reverse and upstream proxy modes, SPEC
+            is host specification in the form of "http[s]://host[:port]". For WireGuard mode, PATH may point to
+            a file containing key material. If no such file exists, it will be created on startup.
 
             You may append `@listen_port` or `@listen_host:listen_port` to override `listen_host` or `listen_port` for
             a specific proxy mode. Features such as client playback will use the first mode to determine
diff --git a/mitmproxy/proxy/mode_servers.py b/mitmproxy/proxy/mode_servers.py
index be7f9a9d6..5090f0597 100644
--- a/mitmproxy/proxy/mode_servers.py
+++ b/mitmproxy/proxy/mode_servers.py
@@ -308,6 +308,7 @@ class WireGuardServerInstance(ServerInstance[mode_specs.WireGuardMode]):
 
         try:
             if not conf_path.exists():
+                conf_path.parent.mkdir(parents=True, exist_ok=True)
                 conf_path.write_text(json.dumps({
                     "server_key": wg.genkey(),
                     "client_key": wg.genkey(),
diff --git a/release/docker/docker-entrypoint.sh b/release/docker/docker-entrypoint.sh
index 93449c066..0cf853da6 100755
--- a/release/docker/docker-entrypoint.sh
+++ b/release/docker/docker-entrypoint.sh
@@ -7,14 +7,17 @@ set -o nounset
 
 MITMPROXY_PATH="/home/mitmproxy/.mitmproxy"
 
+if [ -f "$MITMPROXY_PATH/mitmproxy-ca.pem" ]; then
+  f="$MITMPROXY_PATH/mitmproxy-ca.pem"
+else
+  f="$MITMPROXY_PATH"
+fi
+usermod -o \
+    -u $(stat -c "%u" "$f") \
+    -g $(stat -c "%g" "$f") \
+    mitmproxy
+
 if [[ "$1" = "mitmdump" || "$1" = "mitmproxy" || "$1" = "mitmweb" ]]; then
-  mkdir -p "$MITMPROXY_PATH"
-  if [ -f "$MITMPROXY_PATH/mitmproxy-ca.pem" ]; then
-    usermod -o \
-        -u $(stat -c "%u" "$MITMPROXY_PATH/mitmproxy-ca.pem") \
-        -g $(stat -c "%g" "$MITMPROXY_PATH/mitmproxy-ca.pem") \
-        mitmproxy
-  fi
   gosu mitmproxy "$@"
 else
   exec "$@"
diff --git a/setup.py b/setup.py
index 14cfc7881..f1a3c203d 100644
--- a/setup.py
+++ b/setup.py
@@ -109,7 +109,7 @@ setup(
             "hypothesis>=5.8,<7",
             "parver>=0.1,<2.0",
             "pdoc>=4.0.0",
-            "pyinstaller==5.6.1",
+            "pyinstaller==5.6.2",
             "pytest-asyncio>=0.17,<0.21",
             "pytest-cov>=2.7.1,<4.1",
             "pytest-timeout>=1.3.3,<2.2",