diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0422ea6..43988df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,6 +77,21 @@ Please see the [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest
 
 ## RELEASE NOTES
 
+## [2.2.1] 2022-02-22
+[2.2.1]: https://github.com/datawire/edge-stack/releases/v2.2.1
+
+## Ambassador Edge Stack
+
+- Change: Support for the Envoy V2 API is deprecated as of Ambassador Edge Stack v2.1, and will be removed
+  in Ambassador Edge Stack v3.0. The `AMBASSADOR_ENVOY_API_VERSION` environment variable will be
+  removed at the same time. Only the Envoy V3 API will be supported (this has been the default since
+  Ambassador Edge Stack v1.14.0).
+
+- Security: Upgraded Envoy to address security vulnerabilities CVE-2021-43824, CVE-2021-43825, CVE-2021-43826,
+  CVE-2022-21654, and CVE-2022-21655.
+
+- Bugfix: The Ambassador Agent now correctly supports requests to cancel a rollout.
+
 ## [2.2.0] 2022-02-10
 [2.2.0]: https://github.com/datawire/edge-stack/releases/v2.2.0
 
diff --git a/charts/edge-stack/Chart.lock b/charts/edge-stack/Chart.lock
index 791a186..990ec15 100644
--- a/charts/edge-stack/Chart.lock
+++ b/charts/edge-stack/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: emissary-ingress
-  repository: https://s3.amazonaws.com/datawire-static-files/charts-dev
-  version: 7.3.1-0.20220218203457-b727aaae1f2f
-digest: sha256:b7a7c9f227e128ef34a02666f30dc7514852d953ce5a2f911caf4b14ba77b358
-generated: "2022-02-18T14:33:50.762297228-07:00"
+  repository: https://s3.amazonaws.com/datawire-static-files/charts
+  version: 7.3.1
+digest: sha256:fbe74819194ad56fc13ed31c6f286e7533b7302030a7efb5bb764179f0f98e6a
+generated: "2022-02-22T14:31:12.48815216-07:00"
diff --git a/manifests/edge-stack/aes-ambassadorns-agent.yaml b/manifests/edge-stack/aes-ambassadorns-agent.yaml
index 3cd368f..b2d00b6 100644
--- a/manifests/edge-stack/aes-ambassadorns-agent.yaml
+++ b/manifests/edge-stack/aes-ambassadorns-agent.yaml
@@ -273,7 +273,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
diff --git a/manifests/edge-stack/aes-ambassadorns-migration.yaml b/manifests/edge-stack/aes-ambassadorns-migration.yaml
index eb36eb2..7b714a1 100644
--- a/manifests/edge-stack/aes-ambassadorns-migration.yaml
+++ b/manifests/edge-stack/aes-ambassadorns-migration.yaml
@@ -140,7 +140,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
diff --git a/manifests/edge-stack/aes-ambassadorns.yaml b/manifests/edge-stack/aes-ambassadorns.yaml
index daa01e8..830b96d 100644
--- a/manifests/edge-stack/aes-ambassadorns.yaml
+++ b/manifests/edge-stack/aes-ambassadorns.yaml
@@ -518,7 +518,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
@@ -593,7 +593,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
diff --git a/manifests/edge-stack/aes-crds.yaml b/manifests/edge-stack/aes-crds.yaml
index a3cac0e..d6d9b13 100644
--- a/manifests/edge-stack/aes-crds.yaml
+++ b/manifests/edge-stack/aes-crds.yaml
@@ -5553,7 +5553,7 @@ spec:
       serviceAccountName: emissary-apiext
       containers:
         - name: emissary-apiext
-          image: docker.io/datawire/aes:2.2.0
+          image: docker.io/datawire/aes:2.2.1
           imagePullPolicy: IfNotPresent
           command: [ "apiext", "emissary-apiext" ]
           ports:
diff --git a/manifests/edge-stack/aes-defaultns-agent.yaml b/manifests/edge-stack/aes-defaultns-agent.yaml
index 2185024..1fb5f55 100644
--- a/manifests/edge-stack/aes-defaultns-agent.yaml
+++ b/manifests/edge-stack/aes-defaultns-agent.yaml
@@ -273,7 +273,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
diff --git a/manifests/edge-stack/aes-defaultns-migration.yaml b/manifests/edge-stack/aes-defaultns-migration.yaml
index e6da644..d493e84 100644
--- a/manifests/edge-stack/aes-defaultns-migration.yaml
+++ b/manifests/edge-stack/aes-defaultns-migration.yaml
@@ -140,7 +140,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
diff --git a/manifests/edge-stack/aes-defaultns.yaml b/manifests/edge-stack/aes-defaultns.yaml
index ca49425..5055d14 100644
--- a/manifests/edge-stack/aes-defaultns.yaml
+++ b/manifests/edge-stack/aes-defaultns.yaml
@@ -510,7 +510,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
@@ -585,7 +585,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
diff --git a/manifests/edge-stack/aes-emissaryns-agent.yaml b/manifests/edge-stack/aes-emissaryns-agent.yaml
index 89f21ac..e3dc264 100644
--- a/manifests/edge-stack/aes-emissaryns-agent.yaml
+++ b/manifests/edge-stack/aes-emissaryns-agent.yaml
@@ -273,7 +273,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
diff --git a/manifests/edge-stack/aes-emissaryns-migration.yaml b/manifests/edge-stack/aes-emissaryns-migration.yaml
index 33b8b00..8bf8ff7 100644
--- a/manifests/edge-stack/aes-emissaryns-migration.yaml
+++ b/manifests/edge-stack/aes-emissaryns-migration.yaml
@@ -140,7 +140,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
diff --git a/manifests/edge-stack/aes-emissaryns.yaml b/manifests/edge-stack/aes-emissaryns.yaml
index 6eb4a21..b57db9c 100644
--- a/manifests/edge-stack/aes-emissaryns.yaml
+++ b/manifests/edge-stack/aes-emissaryns.yaml
@@ -518,7 +518,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
@@ -593,7 +593,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
diff --git a/manifests/edge-stack/aes.yaml b/manifests/edge-stack/aes.yaml
index daa01e8..830b96d 100644
--- a/manifests/edge-stack/aes.yaml
+++ b/manifests/edge-stack/aes.yaml
@@ -518,7 +518,7 @@ spec:
       serviceAccountName: edge-stack-agent
       containers:
       - name: agent
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         command: [agent]
         ports:
@@ -593,7 +593,7 @@ spec:
 
       containers:
       - name: aes
-        image: docker.io/datawire/aes:2.2.0
+        image: docker.io/datawire/aes:2.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - name: http