diff --git a/.versionbot/CHANGELOG.yml b/.versionbot/CHANGELOG.yml
index 955e15a1..96ad7027 100644
--- a/.versionbot/CHANGELOG.yml
+++ b/.versionbot/CHANGELOG.yml
@@ -1,3 +1,18 @@
+- commits:
+    - subject: 'tls: Use TLS for tunnel connection'
+      hash: 7ae83d9ce578dc82d8324fa78f3b59c4bc965e4f
+      body: |
+        Switch to using the exposed tunnelUrl and TLS for making
+        tunnels to the device, to improve security.
+      footer:
+        Change-type: patch
+        change-type: patch
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Balena CI
+      nested: []
+  version: 12.38.5
+  date: 2021-01-21T23:26:41.306Z
 - commits:
     - subject: Update supported Node.js version range in package.json (<13.0.0)
       hash: b363d28664a78f9f3c40ac6bfccb1eea544879c3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b4f063d..dd9a9191 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 12.38.5 - 2021-01-21
+
+* tls: Use TLS for tunnel connection [Balena CI]
+
 ## 12.38.4 - 2021-01-21
 
 * Update supported Node.js version range in package.json (<13.0.0) [Paulo Castro]
diff --git a/npm-shrinkwrap.json b/npm-shrinkwrap.json
index d4675dfb..d6614216 100644
--- a/npm-shrinkwrap.json
+++ b/npm-shrinkwrap.json
@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "12.38.4",
+  "version": "12.38.5",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index ef731857..15c84639 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "12.38.4",
+  "version": "12.38.5",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",