diff --git a/src/content/changelog/logs/2026-06-30-account-level-firewall-events.mdx b/src/content/changelog/logs/2026-06-30-account-level-firewall-events.mdx
new file mode 100644
index 00000000000..4df88d3d872
--- /dev/null
+++ b/src/content/changelog/logs/2026-06-30-account-level-firewall-events.mdx
@@ -0,0 +1,17 @@
+---
+title: Account-scoped firewall events dataset in Logpush
+description: Stream firewall events for every zone in an account through a single Logpush job, with a new ZoneName field to identify the source zone.
+products:
+  - logs
+date: 2026-06-30
+---
+
+Cloudflare Logpush now supports [firewall events as an account-scoped dataset](/logs/logpush/logpush-job/datasets/account/firewall_events/). Configure a single Logpush job at the account level to receive firewall events for every zone in the account, instead of creating and maintaining a separate job per zone.
+
+The dataset includes a new [`ZoneName`](/logs/logpush/logpush-job/datasets/account/firewall_events/#zonename) field so you can identify which zone each event came from when consuming logs in your downstream pipeline.
+
+### What's available
+
+- A new account-scoped `firewall_events` dataset, configurable via the [Logpush API](/api/resources/logpush/subresources/jobs/) or the Cloudflare dashboard.
+- The same fields and filter expressions supported by the existing [zone-scoped firewall events dataset](/logs/logpush/logpush-job/datasets/zone/firewall_events/), plus the new `ZoneName` field.
+- Support for all existing Logpush destinations.