diff --git a/CHANGELOG.md b/CHANGELOG.md
index 901e6420..4591737d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +1,22 @@
 CHANGELOG
 =========
 
-DEVELOPMENT
------------
+IN DEVELOPMENT
+--------------
 
 Software updates:
 
 * Upgraded Nextcloud from 17.0.6 to 20.0.1 (with Contacts from 3.3.0 to 3.4.1 and Calendar from 2.0.3 to 2.1.2)
+* Upgraded Roundcube to version 1.4.9.
+
+Mail:
+
+* The MTA-STA max_age value was increased to the normal one week.
+
+Control Panel:
+
+* Two-factor authentication can now be enabled for logins to the control panel. However, keep in mind that many online services (including domain name registrars, cloud server providers, and TLS certificate providers) may allow an attacker to take over your account or issue a fraudulent TLS certificate with only access to your email address, and this new two-factor authentication does not protect access to your inbox. It therefore remains very important that user accounts with administrative email addresses have strong passwords.
+* TLS certificate expiry dates are now shown in ISO8601 format for clarity.
 
 v0.50 (September 25, 2020)
 --------------------------
diff --git a/api/mailinabox.yml b/api/mailinabox.yml
index 2c27b0b9..a9a2c124 100644
--- a/api/mailinabox.yml
+++ b/api/mailinabox.yml
@@ -1734,7 +1734,7 @@ paths:
       tags:
         - MFA
       summary: Disable multi-factor authentication for you or another user
-      description: Disables multi-factor authentication for the currently logged-in admin user or another user if a 'user' parameter is subimtted. Either disables all multi-factor authentication methods or the method corresponding to the optional property `mfa_id`.
+      description: Disables multi-factor authentication for the currently logged-in admin user or another user if a 'user' parameter is submitted. Either disables all multi-factor authentication methods or the method corresponding to the optional property `mfa_id`.
       operationId: mfaTotpDisable
       requestBody:
         required: false
diff --git a/setup/webmail.sh b/setup/webmail.sh
index dc645b96..61769eb6 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -28,8 +28,8 @@ apt_install \
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of plugins to track
 # whether we have the latest version of everything.
-VERSION=1.4.8
-HASH=3a6824fd68fef2e0d24f186cfbee5c6f9d6edbe9
+VERSION=1.4.9
+HASH=df650f4d3eae9eaae2d5a5f06d68665691daf57d
 PERSISTENT_LOGIN_VERSION=6b3fc450cae23ccb2f393d0ef67aa319e877e435
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
 CARDDAV_VERSION=3.0.3