diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml
index bd5a803..0c08e61 100644
--- a/seb4itik/byow/roles/caddy/defaults/main.yml
+++ b/seb4itik/byow/roles/caddy/defaults/main.yml
@@ -7,9 +7,9 @@ caddy_https_port: 443
 caddy_default_bind: null
 
 # Sotware versions
-caddy_go_version: "1.26.1"
+caddy_go_version: "1.26.3"
 caddy_xcaddy_version: "0.4.5"
-caddy_version: "2.11.2"
+caddy_version: "2.11.3"
 
 # If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
@@ -21,8 +21,8 @@ caddy_config_only: false
 # - for each site, in: /var/log/<caddy_my_name>/site_<sit.id>.log
 # - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
 caddy_log_to_file: true
-caddy_log_format: "console"                # "console" or "json"
-caddy_log_debug: false                         # Debug will go to /var/log/<caddy_my_name>/debug.log
+caddy_log_format: "console"            # "console" or "json"
+caddy_log_debug: false                 # Debug will go to /var/log/<caddy_my_name>/debug.log
 
 # Paths
 caddy_binary: "/usr/local/sbin/caddy_{{ caddy_my_name }}"  # Should begin by "caddy" for CrowdSec
@@ -74,29 +74,40 @@ caddy_bot_barrier: false
 
 # Coraza
 caddy_coraza: true
-caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
+caddy_coraza_caddy_version: "v2@v2.5.0"  # Coraza v3.7.0
 # Different sites can use different versions of OWASP CRS
-caddy_coraza_crs_versions: ["4.24.1"]
+caddy_coraza_crs_versions: [
+  "4.25.0",  # LTS
+  "4.26.0"
+]
 # OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
+# FIXME: https://github.com/coreruleset/referer-hardening-plugin
 caddy_coraza_crs_plugins:
-  - name: "drupal-rule-exclusions"
+  - name: "cpanel-rule-exclusions"
     version: "1.0.0"
-  - name: "wordpress-rule-exclusions"
-    version: "1.2.0"
-  - name: "nextcloud-rule-exclusions"
-    version: "1.5.0"
   - name: "dokuwiki-rule-exclusions"
     version: "1.0.0"
-  - name: "phpmyadmin-rule-exclusions"
+  - name: "drupal-rule-exclusions"
+    version: "1.0.0"
+  - name: "google-oauth2"
+    version: "1.0.0"
+  - name: "nextcloud-rule-exclusions"
+    version: "1.6.0"
+  - name: "phpbb-rule-exclusions"
+    version: "1.1.0"
+  - name: "plausible-rule-exclusions"
     version: "1.0.0"
-    has_after_config: true
   - name: "roundcube-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"
   - name: "sogo-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"
+  - name: "wordpress-rule-exclusions"
+    version: "1.2.0"
+  - name: "xenforo-rule-exclusions"
+    version: "1.0.0"
 
 
 # Sites
diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml
index aaba1cc..23188d7 100644
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -280,7 +280,7 @@ caddy_global_sites_defaults:
 
   # corazawaf/coraza-caddy
   crs: true
-  crs_version: "4.24.1"
+  crs_version: "4.25.0"   # LTS
   crs_log_only: false
   crs_plugins: []
   crs_exceptions:
diff --git a/seb4itik/byow/roles/consul/defaults/main.yml b/seb4itik/byow/roles/consul/defaults/main.yml
index 8592958..a07ab7e 100644
--- a/seb4itik/byow/roles/consul/defaults/main.yml
+++ b/seb4itik/byow/roles/consul/defaults/main.yml
@@ -12,7 +12,7 @@ consul_ui_secret_id: null         # Generate with "uuidgen"
 
 # Defaults.
 consul_domain: "consul"
-consul_version: "1.22.3"
+consul_version: "1.22.7"
 consul_client_addr: "127.0.0.1"
 consul_bind_addr: "{{ ansible_default_ipv4.address }}"
 consul_default_check_interval: "15s"