diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c9dcd6..085c16a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# 9.12.0
+
+* Add new `NonGovukDomains` module with `EXTERNAL_HOST_REDIRECT_ALLOW_LIST` constant, so that we can avoid duplicating allowlists across publishing apps. ([#367](https://github.com/alphagov/govuk_app_config/pull/367))
+
 # 9.11.0
 
 * Add GDS::SSO::PermissionDeniedError to excluded exceptions list ([#366](https://github.com/alphagov/govuk_app_config/pull/366))
diff --git a/lib/govuk_app_config/non_govuk_domains.rb b/lib/govuk_app_config/non_govuk_domains.rb
new file mode 100644
index 0000000..effb9e1
--- /dev/null
+++ b/lib/govuk_app_config/non_govuk_domains.rb
@@ -0,0 +1,12 @@
+module NonGovukDomains
+  EXTERNAL_HOST_REDIRECT_ALLOW_LIST = %w[
+    .caa.co.uk
+    .gov.uk
+    .judiciary.uk
+    .moneyhelper.org.uk
+    .nationalhighways.co.uk
+    .nhs.uk
+    .police.uk
+    .ukri.org
+  ].freeze
+end
diff --git a/lib/govuk_app_config/version.rb b/lib/govuk_app_config/version.rb
index 51211b1..f2d8063 100644
--- a/lib/govuk_app_config/version.rb
+++ b/lib/govuk_app_config/version.rb
@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "9.11.0".freeze
+  VERSION = "9.12.0".freeze
 end