diff --git a/CHANGES.md b/CHANGES.md
index e49091205e..cf2c9b634f 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,3 +1,16 @@
+# Synapse 1.138.3 (2025-10-07)
+
+## Security Fixes
+
+- Fix [CVE-2025-61672](https://www.cve.org/CVERecord?id=CVE-2025-61672) / [GHSA-fh66-fcv5-jjfr](https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr). Lack of validation for device keys in Synapse before 1.139.1 allows an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. ([\#17097](https://github.com/element-hq/synapse/issues/17097))
+
+## Deprecations and Removals
+
+- Drop support for unstable field names from the long-accepted [MSC2732](https://github.com/matrix-org/matrix-spec-proposals/pull/2732) (Olm fallback keys) proposal. This change allows unit tests to pass following the security patch above. ([\#18996](https://github.com/element-hq/synapse/issues/18996))
+
+
+
+
 # Synapse 1.138.2 (2025-09-24)
 
 ## Internal Changes
diff --git a/changelog.d/17097.misc b/changelog.d/17097.misc
deleted file mode 100644
index 42792e5f38..0000000000
--- a/changelog.d/17097.misc
+++ /dev/null
@@ -1 +0,0 @@
-Extend validation of uploaded device keys.
\ No newline at end of file
diff --git a/changelog.d/18996.removal b/changelog.d/18996.removal
deleted file mode 100644
index fa06fcc929..0000000000
--- a/changelog.d/18996.removal
+++ /dev/null
@@ -1 +0,0 @@
-Drop support for unstable field names from the long-accepted [MSC2732](https://github.com/matrix-org/matrix-spec-proposals/pull/2732) (Olm fallback keys) proposal.
\ No newline at end of file
diff --git a/debian/changelog b/debian/changelog
index ea15974d63..f7ebd148a7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+matrix-synapse-py3 (1.138.3) stable; urgency=medium
+
+  * New Synapse release 1.138.3.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Oct 2025 12:54:18 +0100
+
 matrix-synapse-py3 (1.138.2) stable; urgency=medium
 
   * New Synapse release 1.138.2.
diff --git a/pyproject.toml b/pyproject.toml
index c548a652e9..50e8a7ed84 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -101,7 +101,7 @@ module-name = "synapse.synapse_rust"
 
 [tool.poetry]
 name = "matrix-synapse"
-version = "1.138.2"
+version = "1.138.3"
 description = "Homeserver for the Matrix decentralised comms protocol"
 authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
 license = "AGPL-3.0-or-later"