diff --git a/NEWS b/NEWS
index 54b590d5913b746b5220d0738398ec243e4b9c49..43e523d25d9426a40a032b74f191642b42663122 100644
--- a/NEWS
+++ b/NEWS
@@ -6,13 +6,18 @@ unreleased (207x-xx-xx)
     parameter does. Also, fix some whitespace messiness in
     /etc/pam.d/sshd [adamhl]
 
-release/005.010 (2017-10-02)
-
     [syslog] Add use_logsink_server parameter that allows servers to not
     send logs to the logsink server. Once everyone is using Splunk, ELK,
     etc., we will set this default to false. In the meantime, the default
     is true. [adamhl]
 
+    [pam] Add "ensure" parameter to base::pam::debian to allow the
+    non-installation of some Kerberos-related PAM packages in the special
+    case of non-production Kerberos servers not synced with production
+    Kerberos environment. [adamhl]
+
+release/005.010 (2017-10-02)
+
     [kerberos] Use three rather than four "kdc" lines in
     /etc/krb5.conf. [adamhl]
 
@@ -26,11 +31,6 @@ release/005.010 (2017-10-02)
     off-campus Instead, just have everything go through smtp.stanford.edu
     (which still has an on-campus presence). [akkornel]
 
-    [pam] Add "ensure" parameter to base::pam::debian to allow the
-    non-installation of some Kerberos-related PAM packages in the special
-    case of non-production Kerberos servers not synced with production
-    Kerberos environment. [adamhl]
-
 release/005.009 (2017-07-07)
 
     [ntp] Push "tinker-panic 0" to the top of the ntp.conf file to help