diff --git a/CHANGELOG.md b/CHANGELOG.md
index 60182a3ed..335030a39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,8 @@
-## [v2.11.47](https://github.com/traefik/traefik/tree/v2.11.47) (2026-06-03)
-[All Commits](https://github.com/traefik/traefik/compare/v2.11.46...v2.11.47)
+## [v2.11.48](https://github.com/traefik/traefik/tree/v2.11.48) (2026-06-04)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.46...v2.11.48)
 
 **Bug fixes:**
+- **[tls]** Compute resolved tlsOptions after applying models ([#13291](https://github.com/traefik/traefik/pull/13291) @rtribotte)
 - **[middleware, authentication]** Add error on basic auth build if users is empty ([#13195](https://github.com/traefik/traefik/pull/13195) @rtribotte)
 - **[k8s/ingress]** Avoid ingress path matcher injection and backport 11d251415 ([#13227](https://github.com/traefik/traefik/pull/13227) @rtribotte)
 - **[server]** Move snicheck to ctx instead of simulated routing ([#13214](https://github.com/traefik/traefik/pull/13214) @juliens)
@@ -9,6 +10,11 @@
 - **[server]** Bump golang.org/x/net to v0.55.0 ([#13251](https://github.com/traefik/traefik/pull/13251) @kevinpollet)
 - **[server]** Bump golang.org/x/crypto to v0.52.0 ([#13276](https://github.com/traefik/traefik/pull/13276) @rtribotte)
 
+## [v2.11.47](https://github.com/traefik/traefik/tree/v2.11.47) (2026-06-03)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.46...v2.11.47)
+
+Release canceled.
+
 ## [v2.11.46](https://github.com/traefik/traefik/tree/v2.11.46) (2026-05-11)
 [All Commits](https://github.com/traefik/traefik/compare/v2.11.45...v2.11.46)
 
diff --git a/docs/content/migration/v2.md b/docs/content/migration/v2.md
index 8c09fd7d5..3c74454bc 100644
--- a/docs/content/migration/v2.md
+++ b/docs/content/migration/v2.md
@@ -849,17 +849,17 @@ The behavior is as follows:
 Please check out the [Kubernetes CRD](../providers/kubernetes-crd.md#crossprovidernamespaces), [Kubernetes Ingress](../providers/kubernetes-ingress.md#crossprovidernamespaces),
 and [Kubernetes Gateway](../providers/kubernetes-gateway.md#crossprovidernamespaces) provider documentation for more details.
 
-## v2.11.47
+## v2.11.48
 
 ### BasicAuth Middleware
 
-From version `v2.11.47` onwards, the BasicAuth middleware requires a non-empty users configuration in order to be built successfully.
+From version `v2.11.48` onwards, the BasicAuth middleware requires a non-empty users configuration in order to be built successfully.
 Previously, the middleware would be built successfully but always return a 401 status code for any request.
 Now, an error occurs and any routers using it will be unmounted. For the same request, a 404 status code is served instead of a 401 status code.
 
 ### StripPrefix and StripPrefixRegex Middleware
 
-From version `v2.11.47` onwards, the StripPrefix middleware and the StripPrefixRegex middleware reject requests (`400 Bad Request`)
+From version `v2.11.48` onwards, the StripPrefix middleware and the StripPrefixRegex middleware reject requests (`400 Bad Request`)
 when stripping the configured prefix produces a path that differs from its normalised form
 (i.e. a path containing `.` or `..` segments that would be collapsed by normalisation).
 
diff --git a/script/gcg/traefik-bugfix.toml b/script/gcg/traefik-bugfix.toml
index 29e264568..6f161f155 100644
--- a/script/gcg/traefik-bugfix.toml
+++ b/script/gcg/traefik-bugfix.toml
@@ -4,11 +4,11 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example new bugfix v2.11.47
+# example new bugfix v2.11.48
 CurrentRef = "v2.11"
-PreviousRef = "v2.11.46"
+PreviousRef = "v2.11.47"
 BaseBranch = "v2.11"
-FutureCurrentRefName = "v2.11.47"
+FutureCurrentRefName = "v2.11.48"
 
 ThresholdPreviousRef = 10000
 ThresholdCurrentRef = 10000