diff --git a/CHANGELOG.md b/CHANGELOG.md
index c84210743fe..81226a58321 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased 1.2.z]
 
+## [1.2.5] - 2025-02-13
+
+> Мороз и солнце; день чудесный!
+
+### Fixed
+* There was a regression in systemd v230 which made the way we define device
+  rule restrictions require a systemctl daemon-reload for our transient
+  units. This caused issues for workloads using NVIDIA GPUs. Workaround the
+  upstream regression by re-arranging how the unit properties are defined.
+  (#4568, #4612, #4615)
+ * Dependency github.com/cyphar/filepath-securejoin is updated to v0.4.1,
+   allowing projects that vendor runc to bump it as well. (#4608)
+ * CI: fixed criu-dev compilation. (#4611)
+
+### Changed
+ * Dependency golang.org/x/net is updated to 0.33.0. (#4632)
+
 ## [1.2.4] - 2025-01-07
 
 > Христос се роди!
@@ -972,7 +989,8 @@ implementation (libcontainer) is *not* covered by this policy.
 [1.1.0-rc.1]: https://github.com/opencontainers/runc/compare/v1.0.0...v1.1.0-rc.1
 
 <!-- 1.2.z patch releases -->
-[Unreleased 1.2.z]: https://github.com/opencontainers/runc/compare/v1.2.4...release-1.2
+[Unreleased 1.2.z]: https://github.com/opencontainers/runc/compare/v1.2.5...release-1.2
+[1.2.5]: https://github.com/opencontainers/runc/compare/v1.2.4...v1.2.5
 [1.2.4]: https://github.com/opencontainers/runc/compare/v1.2.3...v1.2.4
 [1.2.3]: https://github.com/opencontainers/runc/compare/v1.2.2...v1.2.3
 [1.2.2]: https://github.com/opencontainers/runc/compare/v1.2.1...v1.2.2
diff --git a/VERSION b/VERSION
index c9ce2ed870e..ba19f427b9e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.4+dev
+1.2.5+dev
diff --git a/script/release_sign.sh b/script/release_sign.sh
index 39f806fa642..883d0169a35 100755
--- a/script/release_sign.sh
+++ b/script/release_sign.sh
@@ -108,7 +108,7 @@ trap 'rm -r "$tmp_gpgdir"' EXIT
 tmp_runc_gpgflags=("--homedir=$tmp_gpgdir" "--no-default-keyring" "--keyring=$project.keyring")
 gpg "${tmp_runc_gpgflags[@]}" --import <"$root/$project.keyring"
 
-tmp_seccomp_gpgflags=("--homedir=$tmp_gpgdir" "--no-default-keyring" "--keyring=seccomp.keyring")
+tmp_seccomp_gpgflags=("--homedir=$tmp_gpgdir" "--no-default-keyring" "--keyring=seccomp.keyring" "--keyserver=keys.openpgp.org")
 gpg "${tmp_seccomp_gpgflags[@]}" --recv-keys 0x47A68FCE37C7D7024FD65E11356CE62C2B524099
 gpg "${tmp_seccomp_gpgflags[@]}" --recv-keys 0x7100AADFAE6E6E940D2E0AD655E45A5AE8CA7C8A