diff --git a/cloudformation/README.md b/cloudformation/README.md
index bb19429..4672e17 100644
--- a/cloudformation/README.md
+++ b/cloudformation/README.md
@@ -14,7 +14,7 @@ On EKS the firewall is the **Helm chart** (`../helm`), which already supports DN
 |------|---------|
 | `eks-cluster.yaml` | **Greenfield wrapper** — VPC + EKS cluster + node group + OIDC provider. Skip if you already run a cluster. |
 | `firewall-eks.yaml` | **Shared base** — ElastiCache Redis + Socket token (Secrets Manager) + IRSA role; emits the `helm upgrade --install` command. |
-| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.0.14`. |
+| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.1.0`. |
 
 ## Cases
 
@@ -29,7 +29,7 @@ The base template currently takes the **handoff** approach: CloudFormation provi
 
 ## Config model
 
-On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.0.14`). Chart version defaults to `0.11.1`.
+On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.1.0`). Chart version defaults to `0.11.2`.
 
 ## Known DRAFT caveats
 
diff --git a/cloudformation/firewall-eks.yaml b/cloudformation/firewall-eks.yaml
index 76c63fd..a133a82 100644
--- a/cloudformation/firewall-eks.yaml
+++ b/cloudformation/firewall-eks.yaml
@@ -54,12 +54,12 @@ Parameters:
 
   ChartVersion:
     Type: String
-    Default: "0.11.1"
+    Default: "0.11.2"
     Description: Socket Firewall Helm chart version to install.
 
   FirewallImageTag:
     Type: String
-    Default: "2.0.14"
+    Default: "2.1.0"
     Description: socketdev/socket-registry-firewall image tag (must match chart appVersion).
 
 Resources:
diff --git a/cloudformation/values/dns-override.values.yaml b/cloudformation/values/dns-override.values.yaml
index fd16446..fa6dd98 100644
--- a/cloudformation/values/dns-override.values.yaml
+++ b/cloudformation/values/dns-override.values.yaml
@@ -17,7 +17,7 @@ image:
   repository: socketdev/socket-registry-firewall
   # Pin explicitly so CloudFormation installs don't drift if the chart
   # appVersion changes independently. Never use :latest for a security product.
-  tag: "2.0.14"
+  tag: "2.1.0"
   pullPolicy: Always
 
 socket:
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index 95c2fd3..baa805e 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -2,10 +2,10 @@ apiVersion: v2
 name: socket-firewall
 description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster
 type: application
-version: 0.11.1
+version: 0.11.2
 # appVersion is the single source of truth for the firewall image version.
 # image.tag in values.yaml defaults to this (see templates/_helpers.tpl).
-appVersion: "2.0.14"
+appVersion: "2.1.0"
 keywords:
   - security
   - supply-chain
diff --git a/helm/README.md b/helm/README.md
index 8da0c3e..1dbbc0e 100644
--- a/helm/README.md
+++ b/helm/README.md
@@ -90,7 +90,7 @@ registries:
 | Parameter | Description | Default |
 |-----------|-------------|---------|
 | `image.repository` | Docker image | `socketdev/socket-registry-firewall` |
-| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.0.14"` |
+| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.1.0"` |
 | `image.pullPolicy` | Image pull policy | `Always` |
 | `replicaCount` | Number of replicas (ignored if autoscaling enabled) | `1` |
 | `socket.apiToken` | Socket API token | `""` |
diff --git a/helm/values.yaml b/helm/values.yaml
index 099efba..8c93628 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -5,7 +5,7 @@ image:
   repository: socketdev/socket-registry-firewall
   # Keep in sync with Chart.yaml appVersion. Leave empty only if you intentionally
   # want to track whatever appVersion the installed chart carries.
-  tag: "2.0.14"
+  tag: "2.1.0"
   pullPolicy: Always
 
 # Image pull secrets for private registries