diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45943e95..5a77964e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,17 @@
 CHANGELOG
 =========
 
+Version 72 (June 3, 2025)
+-------------------------
+
+Upgrades
+
+* Roundcube upgraded to version 1.6.11, fixing a security vulnerability.
+
+Control Panel
+
+* A warning during daily tasks related to no TLS certificates being expired is fixed.
+
 Version 71 (January 4, 2025)
 ----------------------------
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 46995595..0a20fa71 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -51,7 +51,7 @@ if [ -z "$TAG" ]; then
 	if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then
 		# This machine is running Ubuntu 22.04, which is supported by
 		# Mail-in-a-Box versions 60 and later.
-		TAG=v71a
+		TAG=v72
 	elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then
 		# This machine is running Ubuntu 18.04, which is supported by
 		# Mail-in-a-Box versions 0.40 through 5x.
diff --git a/setup/webmail.sh b/setup/webmail.sh
index bbcef7a1..b9435ff9 100644
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -49,8 +49,8 @@ apt_install php"${PHP_VER}"-ldap
 #   https://github.com/mstilkerich/rcmcarddav/releases
 # The easiest way to get the package hashes is to run this script and get the hash from
 # the error message.
-VERSION=1.6.10
-HASH=0cfbb457e230793df8c56c2e6d3655cf3818f168
+VERSION=1.6.11
+HASH=d72da06b5f65142dab8b574f7676e0220541a3d4
 PERSISTENT_LOGIN_VERSION=version-5.3.0
 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+
 CARDDAV_VERSION=4.4.3