diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba87d6be1..1f024426d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,12 @@
-## 0.9.4 (Unreleased)
+## 0.9.4 (February 20th, 2018)
+
+SECURITY:
+
+ * Role Tags used with the EC2 style of AWS auth were being improperly parsed;
+   as a result they were not being used to properly restrict values.
+   Implementations following our suggestion of using these as defense-in-depth
+   rather than the only source of restriction should not have significant
+   impact.
 
 FEATURES:
 
diff --git a/scripts/cross/Dockerfile b/scripts/cross/Dockerfile
index 5f2d9794b..00c48adde 100644
--- a/scripts/cross/Dockerfile
+++ b/scripts/cross/Dockerfile
@@ -10,7 +10,7 @@ RUN apt-get update -y && apt-get install --no-install-recommends -y -q \
                          git mercurial bzr \
                && rm -rf /var/lib/apt/lists/*
 
-ENV GOVERSION 1.9.3
+ENV GOVERSION 1.10
 RUN mkdir /goroot && mkdir /gopath
 RUN curl https://storage.googleapis.com/golang/go${GOVERSION}.linux-amd64.tar.gz \
            | tar xvzf - -C /goroot --strip-components=1
diff --git a/terraform/aws/variables.tf b/terraform/aws/variables.tf
index f06ae18c1..5760dffbe 100644
--- a/terraform/aws/variables.tf
+++ b/terraform/aws/variables.tf
@@ -3,7 +3,7 @@
 //-------------------------------------------------------------------
 
 variable "download-url" {
-    default = "https://releases.hashicorp.com/vault/0.9.3/vault_0.9.3_linux_amd64.zip"
+    default = "https://releases.hashicorp.com/vault/0.9.4/vault_0.9.4_linux_amd64.zip"
     description = "URL to download Vault"
 }
 
diff --git a/version/version_base.go b/version/version_base.go
index 089a8cda1..72ba855a8 100644
--- a/version/version_base.go
+++ b/version/version_base.go
@@ -2,7 +2,7 @@ package version
 
 func init() {
 	// The main version number that is being run at the moment.
-	Version = "0.9.3"
+	Version = "0.9.4"
 
 	// A pre-release marker for the version. If this is "" (empty string)
 	// then it means that it is a final release. Otherwise, this is a pre-release
diff --git a/website/config.rb b/website/config.rb
index 8602bcacc..d561fadc9 100644
--- a/website/config.rb
+++ b/website/config.rb
@@ -2,7 +2,7 @@ set :base_url, "https://www.vaultproject.io/"
 
 activate :hashicorp do |h|
   h.name         = "vault"
-  h.version      = "0.9.3"
+  h.version      = "0.9.4"
   h.github_slug  = "hashicorp/vault"
   h.website_root = "website"
 end