diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e98f690250a2..1fabdaeb3c527 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.3.9
+
+This release of Teleport contains a security fix.
+
+* Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): [#5122](https://github.com/gravitational/teleport/pull/5122). Users with SAML SSO providers should upgrade as soon as possible.
+
 ## 4.3.8
 
 This release of Teleport adds support for a new build architecture.
diff --git a/Makefile b/Makefile
index 59102bbf56e55..0503665005805 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@
 # Naming convention:
 #	for stable releases we use "1.0.0" format
 #   for pre-releases, we use   "1.0.0-beta.2" format
-VERSION=4.3.8
+VERSION=4.3.9
 
 DOCKER_IMAGE ?= quay.io/gravitational/teleport
 
diff --git a/version.go b/version.go
index e3240c6deb3a0..d9bc78eb10b9d 100644
--- a/version.go
+++ b/version.go
@@ -3,7 +3,7 @@
 package teleport
 
 const (
-	Version = "4.3.8"
+	Version = "4.3.9"
 )
 
 // Gitref variable is automatically set to the output of git-describe