diff --git a/changelog.md b/changelog.md
index 7ab1517804..7879c8e7ab 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.1.0~rc2
+
+### Development
+
+* Added upgrade of all packages early in install, for newest ca-certificates (#6120)
+* Updated package build to use latest pip (21.3) rather than system pip for virtualenvs (#6141)
+* Removed version check for "verify" command for securedrop-admin (#6134)
+* Updated QA playbook for Focal apt sources (#6123)
+
 ## 2.1.0~rc1
 
 ### Web applications
@@ -20,7 +29,7 @@
 * Added script to repair Tails updater for Tails versions below 4.19 (#6110)
 * Silenced low-priority fwupd-related OSSEC alerts (#6107)
 * Removed superfluous Tails configuration chance to enforce preservation of filenames on decompression in Nautilus (#6079)
-* Removed expired signing key from Securedrop keyring (#5979)
+* Removed expired signing key from Securedrop keyring (#5979, #6138)
 * Added option to restore from backup file manually transferred to server (#5909)
 * Dependency updates: requests 2.22.0 to 2.26.0; urllib3 1.25.10 to 1.26.6; Ansible 2.9.21 to 2.9.26 (#6046, #6109)
 
diff --git a/install_files/ansible-base/group_vars/all/securedrop b/install_files/ansible-base/group_vars/all/securedrop
index 9c201d73dd..e854ca5e40 100644
--- a/install_files/ansible-base/group_vars/all/securedrop
+++ b/install_files/ansible-base/group_vars/all/securedrop
@@ -2,7 +2,7 @@
 # Variables that apply to both the app and monitor server go in this file
 # If the monitor or app server need different values define the variable in
 # hosts_vars/app.yml or host_vars/mon.yml
-securedrop_version: "2.1.0~rc1"
+securedrop_version: "2.1.0~rc2"
 securedrop_app_code_sdist_name: "securedrop-app-code-{{ securedrop_version | replace('~', '-') }}.tar.gz"
 
 grsecurity: true
diff --git a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/changelog-focal b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/changelog-focal
index 3b16ab5e32..06149a4373 100644
--- a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/changelog-focal
+++ b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/changelog-focal
@@ -1,3 +1,9 @@
+securedrop-app-code (2.1.0~rc2+focal) focal; urgency=medium
+
+  * see changelog.md
+
+ -- SecureDrop Team <securedrop@freedom.press>  Thu, 14 Oct 2021 08:43:18 -0700
+
 securedrop-app-code (2.1.0~rc1+focal) focal; urgency=medium
 
   * see changelog.md
diff --git a/molecule/builder-focal/tests/vars.yml b/molecule/builder-focal/tests/vars.yml
index ce778f97b2..401582fceb 100644
--- a/molecule/builder-focal/tests/vars.yml
+++ b/molecule/builder-focal/tests/vars.yml
@@ -1,5 +1,5 @@
 ---
-securedrop_version: "2.1.0~rc1"
+securedrop_version: "2.1.0~rc2"
 ossec_version: "3.6.0"
 keyring_version: "0.1.5"
 config_version: "0.1.4"
diff --git a/securedrop/version.py b/securedrop/version.py
index 7c1530a7ef..3d613f84a3 100644
--- a/securedrop/version.py
+++ b/securedrop/version.py
@@ -1 +1 @@
-__version__ = '2.1.0~rc1'
+__version__ = '2.1.0~rc2'
diff --git a/setup.py b/setup.py
index 228e63e5d7..8caaade5be 100644
--- a/setup.py
+++ b/setup.py
@@ -4,7 +4,7 @@
 
 setuptools.setup(
     name="securedrop-app-code",
-    version="2.1.0~rc1",
+    version="2.1.0~rc2",
     author="Freedom of the Press Foundation",
     author_email="securedrop@freedom.press",
     description="SecureDrop Server",