diff --git a/CHANGELOG.md b/CHANGELOG.md
index d324c3c99..6fbbc4a94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - [Issue #3275161: Allow IMG tags in default text format](https://www.drupal.org/project/farm/issues/3275161)
 
+### Security
+
+- Update Drupal core to 9.3.12 for [SA-CORE-2022-008](https://www.drupal.org/sa-core-2022-008) and
+  [SA-CORE-2022-009](https://www.drupal.org/sa-core-2022-009).
+
 ## [2.0.0-beta4] 2022-04-13
 
 ### Added
diff --git a/composer.json b/composer.json
index 68bb49a08..27efef2a0 100644
--- a/composer.json
+++ b/composer.json
@@ -18,7 +18,7 @@
     "require": {
         "cweagans/composer-patches": "^1.6",
         "drupal/admin_toolbar": "^2.4",
-        "drupal/core": "9.3.9",
+        "drupal/core": "9.3.12",
         "drupal/config_update": "^1.7",
         "drupal/csv_serialization": "^2.0",
         "drupal/date_popup": "^1.1",
diff --git a/composer.project.json b/composer.project.json
index 2723ee089..ab427c46d 100644
--- a/composer.project.json
+++ b/composer.project.json
@@ -1,11 +1,11 @@
 {
     "require": {
         "cweagans/composer-patches": "^1.7",
-        "drupal/core-composer-scaffold": "9.3.9"
+        "drupal/core-composer-scaffold": "9.3.12"
     },
     "require-dev": {
         "brianium/paratest": "^4",
-        "drupal/core-dev": "9.3.9",
+        "drupal/core-dev": "9.3.12",
         "phpspec/prophecy-phpunit": "^2",
         "symfony/finder": "^4.0"
     },