diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf6e527e..8a8bcbfc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,27 +4,29 @@ CHANGELOG
 In Development
 --------------
 
+This version updates ownCloud, which may include security fixes, and makes some other smaller improvements.
+
+Mail:
+
+* Header privacy filters were improperly running on the contents of forwarded email --- that's fixed.
+* We have another go at fixing a long-standing issue with training the spam filter (because of a file permissions issue).
+* Exchange/ActiveSync will now use your display name set in Roundcube in the From: line of outgoing email.
+
 ownCloud:
 
-* Update ownCloud to version 9.1.1
+* Updated ownCloud to version 9.1.1.
 
 Control panel:
 
 * Backups can now be made using rsync-over-ssh!
-* Remove recommendations for Certificate Providers
 * Status checks failed if the system doesn't support iptables or doesn't have ufw installed.
-* Add support for SSHFP records when sshd listens on non-standard ports
+* Added support for SSHFP records when sshd listens on non-standard ports.
+* Recommendations for TLS certificate providers were removed now that everyone mostly uses Let's Encrypt.
 
 System:
 
 * Ubuntu's "Upgrade to 16.04" notice is suppressed since you should not do that.
-* Lower memory requirements to 512MB, display a warning if system memory is below 768MB.
-
-Mail:
-
-* Turn off header filters for forwarded email.
-* Another go at fixing a long-standing issue with training the spam filter not working (because of a file permissions issue).
-* Exchange/ActiveSync will now use your display name set in Roundcube in the From: line of outgoing email.
+* Lowered memory requirements to 512MB, display a warning if system memory is below 768MB.
 
 v0.20 (September 23, 2016)
 --------------------------
diff --git a/README.md b/README.md
index 89f0cdb1..225be813 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.20
+	$ git verify-tag v0.21
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.20
+	$ git checkout v0.21
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index d3e7712a..bcd87b86 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.20
+	TAG=v0.21
 fi
 
 # Are we running as root?