diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml
index 1fe1fba..5082f5c 100644
--- a/seb4itik/byow/roles/caddy/defaults/main.yml
+++ b/seb4itik/byow/roles/caddy/defaults/main.yml
@@ -6,7 +6,7 @@ caddy_http_port: 80
 caddy_https_port: 443
 caddy_default_bind: null
 
-# If true, will not install software, just deploy Caddy and OWASP CRS
+# If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
 caddy_config_only: false
 
@@ -25,7 +25,10 @@ caddy_consul_server: "{{ ansible_fqdn }}:8501"
 caddy_consul_delegate_to: null         # Required, Consul host for running Consul commands
 caddy_consul_admin_token: null         # Required
 caddy_consul_aes_key: null             # Required, 32 characters
-caddy_consul_client_cert: null         # Required
+caddy_consul_client_cert: null         # Required, CN must be "server.<consul datacenter>.<consul domain>"
+                                       # At least, SANs must include:
+                                       #   - "DNS:server.<consul datacenter>.<consul domain>"
+                                       #   - "DNS:<host FQDN>" 
 caddy_consul_client_key: null          # Required
 
 # Accound id and license key are required if a site use Geoip filtering.
@@ -36,12 +39,12 @@ caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
 caddy_geoip_update_frequency: 86400   # In seconds
 
 # Sotware versions
-caddy_version: "2.10.2"
-caddy_go_version: "1.25.6"
+caddy_version: "2.11.2"
+caddy_go_version: "1.26.1"
 caddy_xcaddy_version: "0.4.5"
-caddy_coraza_caddy_version: "v2@v2.1.0"  # Coraza v3.3.3
+caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
 # Different sites can use different versions of OWASP CRS
-caddy_owasp_crs_versions: ["4.23.0"]
+caddy_owasp_crs_versions: ["4.24.1"]
 
 # Paths
 caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
@@ -53,7 +56,7 @@ caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
 caddy_sites_dir: "{{ caddy_config_dir }}/sites"
 caddy_log_dir: "/var/log/{{ caddy_my_name }}"
 
-# OWASP CRS plugins that will can be actived per site.
+# OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
 caddy_crs_plugins:
   - name: "drupal-rule-exclusions"
diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml
index 6c6e86c..416b849 100644
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -286,7 +286,7 @@ caddy_global_sites_defaults:
 
   # corazawaf/coraza-caddy
   crs: true
-  crs_version: "4.22.0"
+  crs_version: "4.24.1"
   crs_log_only: false
   crs_plugins: []
   crs_exceptions: