diff --git a/CHANGELOG.md b/CHANGELOG.md
index ea360bc56..18316a526 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Update Drupal core to 9.3.16 for [SA-CORE-2022-011](https://www.drupal.org/sa-core-2022-011).
+
 ## [2.0.0-beta5]
 
 ### Changed
diff --git a/composer.json b/composer.json
index 0631dcb15..daf8d5dfb 100644
--- a/composer.json
+++ b/composer.json
@@ -18,7 +18,7 @@
     "require": {
         "cweagans/composer-patches": "^1.6",
         "drupal/admin_toolbar": "^2.4",
-        "drupal/core": "9.3.15",
+        "drupal/core": "9.3.16",
         "drupal/config_update": "^1.7",
         "drupal/csv_serialization": "^2.0",
         "drupal/date_popup": "^1.1",
diff --git a/composer.project.json b/composer.project.json
index e7c6c7057..1e4e9e6c8 100644
--- a/composer.project.json
+++ b/composer.project.json
@@ -1,11 +1,11 @@
 {
     "require": {
         "cweagans/composer-patches": "^1.7",
-        "drupal/core-composer-scaffold": "9.3.15"
+        "drupal/core-composer-scaffold": "9.3.16"
     },
     "require-dev": {
         "brianium/paratest": "^4",
-        "drupal/core-dev": "9.3.15",
+        "drupal/core-dev": "9.3.16",
         "phpspec/prophecy-phpunit": "^2",
         "symfony/finder": "^4.0"
     },