diff --git a/.releases/v0.11.1.yml b/.releases/v0.11.1.yml
new file mode 100644
index 00000000..b7f503ee
--- /dev/null
+++ b/.releases/v0.11.1.yml
@@ -0,0 +1,2 @@
+commit: "51cc63ae6367e2bd42c4955ab58f6afb2d30f66c"
+reason: "Patch release: distrust the compromised eMudhra intermediate CAs and clear rustls advisories"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 252ddec3..2aee805b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,3 +77,7 @@
 - New `proposer_deadline_buffer_ms` setting, default 20, for the time held back from the beacon node's deadline on ePBS requests (#505, #511)
 - Update `rustls` to 0.23.46 to clear RUSTSEC-2026-0346 to 0349 (#511)
 - Backwards compatiblebefore the fork, PBS and existing configs work as they did in v0.11.0
+
+### v0.11.1
+- Distrust the compromised eMudhra intermediate CAs. Relay connections and the header stream accepted a certificate issued with their keys, which anyone can now recompute. Updates `rustls-webpki` to 0.103.16 (RUSTSEC-2026-0382) and `webpki-roots` to 1.0.11, which also drops three eMudhra roots (RUSTSEC-2026-0381) (#516)
+- Update `rustls` to 0.23.46 to clear RUSTSEC-2026-0346 to 0349 (#516)
diff --git a/docs/docs/get_started/running/docker.md b/docs/docs/get_started/running/docker.md
index 164e08e1..62f64095 100644
--- a/docs/docs/get_started/running/docker.md
+++ b/docs/docs/get_started/running/docker.md
@@ -60,7 +60,7 @@ Below is a simple configuration for running only the PBS service on the Hoodi ne
 chain = "Hoodi"
 
 [pbs]
-docker_image = "ghcr.io/commit-boost/commit-boost:v0.11.0"
+docker_image = "ghcr.io/commit-boost/commit-boost:v0.11.1"
 relay_check = true
 wait_all_registrations = true
 
@@ -91,7 +91,7 @@ services:
       timeout: 5s
       retries: 3
       start_period: 5s
-    image: ghcr.io/commit-boost/commit-boost:v0.11.0
+    image: ghcr.io/commit-boost/commit-boost:v0.11.1
     container_name: cb_pbs
     ports:
     - 127.0.0.1:18550:18550
@@ -148,7 +148,7 @@ docker run -d --name cb_pbs \
   -v "$PWD/cb-config.toml:/cb-config.toml:ro" \
   -e CB_CONFIG=/cb-config.toml \
   -p 127.0.0.1:18550:18550 \
-  ghcr.io/commit-boost/commit-boost:v0.11.0 pbs
+  ghcr.io/commit-boost/commit-boost:v0.11.1 pbs
 ```
 
 `commit-boost init` sets the address PBS binds inside the container through `CB_PBS_ENDPOINT`. Without it, set `host = "0.0.0.0"` in `[pbs]`, since PBS otherwise binds `127.0.0.1` inside the container and nothing outside it can reach the port. To reach PBS from containers on another user-defined Docker network, such as your beacon node's, add `--network <that network>`; they reach it by its container name, here `http://cb_pbs:18550`. If `chain` uses a [spec file](../configuration.md#custom-chains), add `-v "$PWD/spec.json:/spec.json:ro"` and set `path` in `chain` to `"/spec.json"`. To serve metrics, also set [`CB_METRICS_PORT`](./binary.md#common) and publish that port with `-p`, both of which `init` does for you.
@@ -166,7 +166,7 @@ Below is a simple configuration for running only the three modules on the Hoodi
 chain = "Hoodi"
 
 [pbs]
-docker_image = "ghcr.io/commit-boost/commit-boost:v0.11.0"
+docker_image = "ghcr.io/commit-boost/commit-boost:v0.11.1"
 relay_check = true
 wait_all_registrations = true
 
@@ -179,7 +179,7 @@ id = "def"
 url = "https://0xa1cec75a3f0661e99299274182938151e8433c61a19222347ea1313d839229cb4ce4e3e5aa2bdeb71c8fcf1b084963c2@def.example.com"
 
 [signer]
-docker_image = "ghcr.io/commit-boost/commit-boost:v0.11.0"
+docker_image = "ghcr.io/commit-boost/commit-boost:v0.11.1"
 port = 20000
 
 [signer.local.loader]
@@ -233,7 +233,7 @@ services:
       timeout: 5s
       retries: 3
       start_period: 5s
-    image: ghcr.io/commit-boost/commit-boost:v0.11.0
+    image: ghcr.io/commit-boost/commit-boost:v0.11.1
     container_name: cb_pbs
     ports:
     - 127.0.0.1:18550:18550
@@ -251,7 +251,7 @@ services:
       timeout: 5s
       retries: 3
       start_period: 5s
-    image: ghcr.io/commit-boost/commit-boost:v0.11.0
+    image: ghcr.io/commit-boost/commit-boost:v0.11.1
     container_name: cb_signer
     ports:
     - 127.0.0.1:20000:20000
diff --git a/docs/docs/get_started/running/k8s.md b/docs/docs/get_started/running/k8s.md
index c71201d3..15450d60 100644
--- a/docs/docs/get_started/running/k8s.md
+++ b/docs/docs/get_started/running/k8s.md
@@ -59,7 +59,7 @@ The PBS service is configured through the `values.yaml` file. The chart exposes
 :::warning
 The chart's default `commitBoost.pbs.image.tag` is `v0.4.0`, which is far behind the current release
 and predates the unified `commit-boost pbs` CLI the chart invokes. Always set the tag explicitly to
-the release you want (e.g. `v0.11.0`) before installing.
+the release you want (e.g. `v0.11.1`) before installing.
 :::
 
 For the full list of available values and their descriptions, see the [README.md](https://github.com/Commit-Boost/commit-boost-client/blob/main/provisioning/k8s/commit-boost/README.md) in the chart directory.