diff --git a/etc/kayobe/kolla-image-tags.yml b/etc/kayobe/kolla-image-tags.yml
index 9da400fa5..a812b33c1 100644
--- a/etc/kayobe/kolla-image-tags.yml
+++ b/etc/kayobe/kolla-image-tags.yml
@@ -27,6 +27,9 @@ kolla_image_tags:
   ironic_neutron_agent:
     rocky-9: 2023.1-rocky-9-20241022T090717
     ubuntu-jammy: 2023.1-ubuntu-jammy-20241022T090717
+  keystone:
+    rocky-9: 2023.1-rocky-9-20251031T100336
+    ubuntu-jammy: 2023.1-ubuntu-jammy-20251031T100336
   kolla_toolbox:
     rocky-9: 2023.1-rocky-9-20250321T110513
   letsencrypt:
diff --git a/releasenotes/notes/bump-keystone-image-ec2token-20462b47072214e6.yaml b/releasenotes/notes/bump-keystone-image-ec2token-20462b47072214e6.yaml
new file mode 100644
index 000000000..3576d6aaa
--- /dev/null
+++ b/releasenotes/notes/bump-keystone-image-ec2token-20462b47072214e6.yaml
@@ -0,0 +1,6 @@
+---
+security:
+  - |
+    Security fixes for `bug 2119646 <https://launchpad.net/bugs/2119646>`__:
+    Unauthenticated access to EC2/S3 token
+    endpoints can grant Keystone authorization.