diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9395c35..5cde955 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1475,3 +1475,6 @@
 * Fix [CVE-2025-61672](https://www.cve.org/CVERecord?id=CVE-2025-61672) / [GHSA-fh66-fcv5-jjfr](https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr). Lack of validation for device keys in Synapse before 1.139.1 allows an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. ([#17097](https://github.com/element-hq/synapse/issues/17097))
 * Drop support for unstable field names from the long-accepted [MSC2732](https://github.com/matrix-org/matrix-spec-proposals/pull/2732) (Olm fallback keys) proposal. This change allows unit tests to pass following the security patch above. ([#18996](https://github.com/element-hq/synapse/issues/18996))
 
+[1.120.2]
+* Update synapse to 1.139.2
+
diff --git a/CloudronManifest.json b/CloudronManifest.json
index 05b7c76..2ec711f 100644
--- a/CloudronManifest.json
+++ b/CloudronManifest.json
@@ -5,7 +5,7 @@
   "description": "file://DESCRIPTION.md",
   "changelog": "file://CHANGELOG.md",
   "tagline": "Secure & decentralized communication",
-  "version": "1.120.1",
+  "version": "1.120.2",
   "upstreamVersion": "1.139.2",
   "healthCheckPath": "/",
   "httpPort": 8008,