diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84e25e2d5..e387d4a8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,64 @@
+## [Talos 1.12.1](https://github.com/siderolabs/talos/releases/tag/v1.12.1) (2026-01-05)
+
+Welcome to the v1.12.1 release of Talos!
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/talos/issues.
+
+### Component Updates
+
+Linux: 6.18.2
+
+Talos is built with Go 1.25.5.
+
+
+### Contributors
+
+* Andrey Smirnov
+* Mateusz Urbanek
+* Dmitrii Sharshakov
+
+### Changes
+6 commits
+
+
+* [`78a785604`](https://github.com/siderolabs/talos/commit/78a785604ad40eb9f1634c9db5477bd6ce99428c) chore: run rekres and update dependencies
+* [`c31067173`](https://github.com/siderolabs/talos/commit/c3106717392a34fcca959b414f5064d6c799eaa3) fix: disable swap for system services
+* [`a7e8426cf`](https://github.com/siderolabs/talos/commit/a7e8426cfb46f4c46476243032e2f4ade1fe9dfc) test: skip the source bundle on exact tag
+* [`943984167`](https://github.com/siderolabs/talos/commit/943984167c22af0853d2c956677a241acece807f) fix: probe small images correctly
+* [`42df71637`](https://github.com/siderolabs/talos/commit/42df71637763b1bf10bdf0fe89f650c367605b8c) fix: invalid versions check in talos-bundle
+* [`a3e90e445`](https://github.com/siderolabs/talos/commit/a3e90e445f0f99b050eb98fcd9565b2b5e3397bf) fix: make upgrade work with SELinux enforcing=1
+
+
+
+### Changes from siderolabs/pkgs
+2 commits
+
+
+* [`90ff196`](https://github.com/siderolabs/pkgs/commit/90ff1965cdb2ab54d8e826f3673324cd1b5c94da) chore: run rekres and update dependencies
+* [`2b30517`](https://github.com/siderolabs/pkgs/commit/2b3051775ca0d7531f65b81572e391a96b4a2c04) feat: update Linux to 6.18.2
+
+
+
+### Changes from siderolabs/tools
+1 commit
+
+
+* [`5df8bae`](https://github.com/siderolabs/tools/commit/5df8baedd100b6f117f664f383944daaf3371804) chore: run rekres and update dependencies
+
+
+
+### Dependency Changes
+
+* **github.com/klauspost/compress** v1.18.1 -> v1.18.2
+* **github.com/siderolabs/go-blockdevice/v2** v2.0.20 -> v2.0.22
+* **github.com/siderolabs/pkgs** v1.12.0-23-ge0b78b8 -> v1.12.0-25-g90ff196
+* **github.com/siderolabs/tools** v1.12.0-2-g7d57df0 -> v1.12.0-3-g5df8bae
+
+Previous release can be found at [v1.12.0](https://github.com/siderolabs/talos/releases/tag/v1.12.0)
+
## [Talos 1.12.0](https://github.com/siderolabs/talos/releases/tag/v1.12.0) (2025-12-22)
Welcome to the v1.12.0 release of Talos!
diff --git a/go.mod b/go.mod
index d28b8c91b..d5f169fee 100644
--- a/go.mod
+++ b/go.mod
@@ -160,7 +160,7 @@ require (
github.com/siderolabs/net v0.4.0
github.com/siderolabs/proto-codec v0.1.2
github.com/siderolabs/siderolink v0.3.15
- github.com/siderolabs/talos/pkg/machinery v1.12.0
+ github.com/siderolabs/talos/pkg/machinery v1.12.1
github.com/sirupsen/logrus v1.9.3
github.com/spf13/cobra v1.10.1
github.com/spf13/pflag v1.0.10
diff --git a/hack/release.toml b/hack/release.toml
index 40bbd0710..90dac348f 100644
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -7,7 +7,7 @@ match_deps = "^github.com/((talos-systems|siderolabs)/[a-zA-Z0-9-]+)$"
ignore_deps = ["github.com/coredns/coredns"]
# previous release
-previous = "v1.11.0"
+previous = "v1.12.0"
pre_release = false
diff --git a/pkg/machinery/gendata/data/tag b/pkg/machinery/gendata/data/tag
index 13a15bd96..ff55d5843 100644
--- a/pkg/machinery/gendata/data/tag
+++ b/pkg/machinery/gendata/data/tag
@@ -1 +1 @@
-v1.12.0
\ No newline at end of file
+v1.12.1
\ No newline at end of file
diff --git a/pkg/machinery/version/os-release b/pkg/machinery/version/os-release
index 00d468948..3732cc03c 100644
--- a/pkg/machinery/version/os-release
+++ b/pkg/machinery/version/os-release
@@ -1,7 +1,7 @@
NAME="Talos"
ID=talos
-VERSION_ID=v1.12.0
-PRETTY_NAME="Talos (v1.12.0)"
+VERSION_ID=v1.12.1
+PRETTY_NAME="Talos (v1.12.1)"
HOME_URL="https://www.talos.dev/"
BUG_REPORT_URL="https://github.com/siderolabs/talos/issues"
VENDOR_NAME="Sidero Labs"
diff --git a/website/content/v1.12/reference/cli.md b/website/content/v1.12/reference/cli.md
index fbd0140e5..7022b062f 100644
--- a/website/content/v1.12/reference/cli.md
+++ b/website/content/v1.12/reference/cli.md
@@ -134,7 +134,7 @@ talosctl cluster create dev [flags]
--bad-rtc launch VM with bad RTC state
--cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24")
--cni-bin-path strings search path for CNI binaries (default [/home/user/.talos/cni/bin])
- --cni-bundle-url string URL to download CNI bundle from (default "https://github.com/siderolabs/talos/releases/download/v1.12.0/talosctl-cni-bundle-${ARCH}.tar.gz")
+ --cni-bundle-url string URL to download CNI bundle from (default "https://github.com/siderolabs/talos/releases/download/v1.12.1/talosctl-cni-bundle-${ARCH}.tar.gz")
--cni-cache-dir string CNI cache directory path (default "/home/user/.talos/cni/cache")
--cni-conf-dir string CNI config directory path (default "/home/user/.talos/cni/conf.d")
--config-injection-method string a method to inject machine config: default is HTTP server, 'metal-iso' to mount an ISO
@@ -346,7 +346,7 @@ talosctl cluster create dev [flags]
--bad-rtc launch VM with bad RTC state
--cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24")
--cni-bin-path strings search path for CNI binaries (default [/home/user/.talos/cni/bin])
- --cni-bundle-url string URL to download CNI bundle from (default "https://github.com/siderolabs/talos/releases/download/v1.12.0/talosctl-cni-bundle-${ARCH}.tar.gz")
+ --cni-bundle-url string URL to download CNI bundle from (default "https://github.com/siderolabs/talos/releases/download/v1.12.1/talosctl-cni-bundle-${ARCH}.tar.gz")
--cni-cache-dir string CNI cache directory path (default "/home/user/.talos/cni/cache")
--cni-conf-dir string CNI config directory path (default "/home/user/.talos/cni/conf.d")
--config-injection-method string a method to inject machine config: default is HTTP server, 'metal-iso' to mount an ISO
@@ -3252,7 +3252,7 @@ talosctl upgrade [flags]
-e, --endpoints strings override default endpoints in Talos configuration
-f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss)
-h, --help help for upgrade
- -i, --image string the container image to use for performing the install (default "ghcr.io/siderolabs/installer:v1.12.0")
+ -i, --image string the container image to use for performing the install (default "ghcr.io/siderolabs/installer:v1.12.1")
--insecure upgrade using the insecure (encrypted with no auth) maintenance service
-n, --nodes strings target the specified nodes
-m, --reboot-mode string select the reboot mode during upgrade. Mode "powercycle" bypasses kexec. Valid values are: ["default" "powercycle"]. (default "default")