diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5095e28b..eacb0a90 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,11 @@
+# Unreleased
+
+## Build Changes
+
+* Update Twoliter to `0.22.0` ([#511])
+
+[#511]: https://github.com/bottlerocket-os/bottlerocket-kernel-kit/pull/511
+
 # v7.2.1 (2026-07-27)
 
 ## OS Changes
diff --git a/Makefile b/Makefile
index d721c949..789ec532 100644
--- a/Makefile
+++ b/Makefile
@@ -4,9 +4,9 @@ TWOLITER_DIR := $(TOOLS_DIR)/twoliter
 TWOLITER := $(TWOLITER_DIR)/twoliter
 CARGO_HOME := $(TOP).cargo
 KERNEL_CONFIG_SCRIPT := $(TOOLS_DIR)/latest-kernel-full-config.sh
-TWOLITER_VERSION ?= "0.20.0"
-TWOLITER_SHA256_AARCH64 ?= "25e97fc63003e1c67b262d8ea3d7ca0ae934223805289edb130d80e1f0ef54a8"
-TWOLITER_SHA256_X86_64 ?= "6a102249ba567f681ce25ed02fb588a51397d66a27cde4dce2e56b92d45c2dff"
+TWOLITER_VERSION ?= "0.22.0"
+TWOLITER_SHA256_AARCH64 ?= "a3f8c06df586f176373f4bced90e6440e7a3cdbd3ef8154d2717209fe1236921"
+TWOLITER_SHA256_X86_64 ?= "0a65edff7337173d293fe930160784f3b8da6158a99d95da46a52401240ae3f5"
 KIT ?= bottlerocket-kernel-kit
 UNAME_ARCH = $(shell uname -m)
 ARCH ?= $(UNAME_ARCH)
diff --git a/tools/validate-changelog.sh b/tools/validate-changelog.sh
index a81a0f56..5f8a2b8c 100755
--- a/tools/validate-changelog.sh
+++ b/tools/validate-changelog.sh
@@ -1,11 +1,18 @@
 #!/usr/bin/env bash
 
-# check that all `# headers` are formatted as a version, e.g. v1.2.3
+# check that all `# headers` are formatted as a version, e.g. v1.2.3, with the
+# exception of a single leading `# Unreleased` header for changes that have
+# not yet been assigned a version.
 # this should be sufficient to validate the CHANGELOG for our CI, provided that
 # every new tag has a corresponding CHANGELOG update, as we always parse the
 # CHANGELOG between two headers with a tagged version.
-if ! diff <(grep -ne '^# ' CHANGELOG.md) <(grep -ne '^# v[0-9]\+\.[0-9]\+\.[0-9]\+' CHANGELOG.md); then
-  echo "CHANGELOG validation FAILED! Headers must match the regex '^# v[0-9]\+\.[0-9]\+\.[0-9]\+.'"
+headers=$(grep -ne '^# ' CHANGELOG.md)
+first_header=$(echo "${headers}" | head -n 1)
+if [[ "${first_header}" == *':# Unreleased' ]]; then
+  headers=$(echo "${headers}" | tail -n +2)
+fi
+if ! diff <(echo "${headers}") <(grep -ne '^# v[0-9]\+\.[0-9]\+\.[0-9]\+' CHANGELOG.md); then
+  echo "CHANGELOG validation FAILED! Headers must match the regex '^# v[0-9]\+\.[0-9]\+\.[0-9]\+.', except for a single leading '# Unreleased' header."
   exit 1
 fi