diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc68941f8..4a296e375 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,16 @@
 ### Changed
 
 ### Fixed
+- Fixes VIT0089540 ([#1395](https://github.com/opendevstack/ods-core/pull/1395))
+- Fixed VIT0089535 ([#1394](https://github.com/opendevstack/ods-core/pull/1394))
+- Fixed VIT0089533 ([#1397](https://github.com/opendevstack/ods-core/pull/1397))
+- Fixed VIT0089531 ([#1393](https://github.com/opendevstack/ods-core/pull/1393))
+- Fixed VIT0089530 ([#1392](https://github.com/opendevstack/ods-core/pull/1392))
+- Harden post-creation scripts against RCE and credential exfiltration: remove `CD_PASSWORD` from the scripts environment and restrict the scripts/config repositories to an explicit `POST_CREATION_SCRIPTS_REPO_ALLOWLIST` (finding F-05) ([#1396] https://github.com/opendevstack/ods-core/pull/1396)
+
+## [4.13.1] - 2026-07-30
+### Fixed
+- Fix jenkins plugins ([#1399](https://github.com/opendevstack/ods-core/pull/1399))
 
 ## [4.13.0] - 2026-07-01
 ### Changed
diff --git a/jenkins/master/plugins.ubi9.txt b/jenkins/master/plugins.ubi9.txt
index ffebb900a..96b30a65e 100644
--- a/jenkins/master/plugins.ubi9.txt
+++ b/jenkins/master/plugins.ubi9.txt
@@ -5,4 +5,8 @@ audit-trail:395.vce180b_359a_b_5
 Office-365-Connector:5.1.0
 mask-passwords:196.v7d505d39886e
 allure-jenkins-plugin:2.34.0
-idc-provider:89.v3dfb_6d89b_618
+oidc-provider:89.v3dfb_6d89b_618
+
+# plugins modified to fix incompatibilities
+git-client:6.6.1
+git:5.10.1