diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41e9f2b3d..a2fd39f25 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,12 @@
+## [v3.6.21](https://github.com/traefik/traefik/tree/v3.6.21) (2026-06-10)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.20...v3.6.21)
+
+**Bug fixes:**
+- **[k8s/gatewayapi]** Reject cross-provider references with backendRefs.namespace ([#13322](https://github.com/traefik/traefik/pull/13322) @youkoulayley)
+- **[server]** Bump to github.com/pires/go-proxyproto v0.12.0 ([#13313](https://github.com/traefik/traefik/pull/13313) @timschumi)
+- **[tls]** Fix routers with same host, different tlsoptions on different entryPoint ([#13329](https://github.com/traefik/traefik/pull/13329) @juliens)
+- **[tls]** Fix snicheck for routers with no hosts ([#13333](https://github.com/traefik/traefik/pull/13333) @rtribotte)
+
 ## [v2.11.50](https://github.com/traefik/traefik/tree/v2.11.50) (2026-06-10)
 [All Commits](https://github.com/traefik/traefik/compare/v2.11.49...v2.11.50)
 
diff --git a/script/gcg/traefik-bugfix.toml b/script/gcg/traefik-bugfix.toml
index c5bf100f8..d1ea03d13 100644
--- a/script/gcg/traefik-bugfix.toml
+++ b/script/gcg/traefik-bugfix.toml
@@ -4,11 +4,11 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example new bugfix v3.6.20
+# example new bugfix v3.6.21
 CurrentRef = "v3.6"
-PreviousRef = "v3.6.19"
+PreviousRef = "v3.6.20"
 BaseBranch = "v3.6"
-FutureCurrentRefName = "v3.6.20"
+FutureCurrentRefName = "v3.6.21"
 
 ThresholdPreviousRef = 10000
 ThresholdCurrentRef = 10000