diff --git a/changelogs/CHANGELOG-v2.21.rst b/changelogs/CHANGELOG-v2.21.rst
index 82452b5fea5..0460544a546 100644
--- a/changelogs/CHANGELOG-v2.21.rst
+++ b/changelogs/CHANGELOG-v2.21.rst
@@ -4,6 +4,33 @@ ansible-core 2.21 "The Rain Song" Release Notes
 
 .. contents:: Topics
 
+v2.21.1rc1
+==========
+
+Release Summary
+---------------
+
+| Release Date: 2026-06-11
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.21/porting_guides/porting_guide_core_2.21.html>`__
+
+Security Fixes
+--------------
+
+- ansible-galaxy install - Ensure role requirements are passed as positional arguments to :command:`git clone`. Previously, a malicious role author could inject arbitrary git configuration in role dependencies. (CVE-2026-11332)
+- psrp - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: true`` set
+- winrm - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: true`` set
+
+Bugfixes
+--------
+
+- cli - handle empty value for PAGER (https://github.com/ansible/ansible/issues/86898).
+- config - use correct key value for inject_invocation setting (https://github.com/ansible/ansible/issues/86999).
+- free strategy - Fix ``IndexError`` when hosts become unreachable during playbook execution (https://github.com/ansible/ansible/issues/87027).
+- meta pseudo-action - Fixed callback args passed to ``v2_runner_on_skipped`` when any ``meta`` action was skipped by a ``when`` condition; added test coverage. A previous regression caused the callback dispatch to be omitted and a warning issued.
+- module_utils sanitize_keys and remove_value functions now sort their input to ensure matching subsets are always obscured.
+- module_utils/basic.py - Fix ``AnsibleModule.run_command()`` to handle ``None`` return from non-blocking pipe reads (https://github.com/ansible/ansible/issues/86920).
+- wait_for - use ``errno.ENOENT`` symbolic constant instead of hardcoded value for improved code portability.
+
 v2.21.0
 =======
 
diff --git a/changelogs/changelog.yaml b/changelogs/changelog.yaml
index 4155cc2b81b..08a97ed58ff 100644
--- a/changelogs/changelog.yaml
+++ b/changelogs/changelog.yaml
@@ -638,3 +638,46 @@ releases:
     - 2.21.0rc1_summary.yaml
     - 77691-git-track-submodules-branch.yml
     release_date: '2026-04-28'
+  2.21.1rc1:
+    changes:
+      bugfixes:
+      - cli - handle empty value for PAGER (https://github.com/ansible/ansible/issues/86898).
+      - config - use correct key value for inject_invocation setting (https://github.com/ansible/ansible/issues/86999).
+      - free strategy - Fix ``IndexError`` when hosts become unreachable during playbook
+        execution (https://github.com/ansible/ansible/issues/87027).
+      - meta pseudo-action - Fixed callback args passed to ``v2_runner_on_skipped``
+        when any ``meta`` action was skipped by a ``when`` condition; added test coverage.
+        A previous regression caused the callback dispatch to be omitted and a warning
+        issued.
+      - module_utils sanitize_keys and remove_value functions now sort their input
+        to ensure matching subsets are always obscured.
+      - module_utils/basic.py - Fix ``AnsibleModule.run_command()`` to handle ``None``
+        return from non-blocking pipe reads (https://github.com/ansible/ansible/issues/86920).
+      - wait_for - use ``errno.ENOENT`` symbolic constant instead of hardcoded value
+        for improved code portability.
+      release_summary: '| Release Date: 2026-06-11
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.21/porting_guides/porting_guide_core_2.21.html>`__
+
+        '
+      security_fixes:
+      - ansible-galaxy install - Ensure role requirements are passed as positional
+        arguments to :command:`git clone`. Previously, a malicious role author could
+        inject arbitrary git configuration in role dependencies. (CVE-2026-11332)
+      - 'psrp - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log:
+        true`` set'
+      - 'winrm - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log:
+        true`` set'
+    codename: The Rain Song
+    fragments:
+    - 2.21.1rc1_summary.yaml
+    - 86920-fix-run-command-none-read.yml
+    - 87027-free-strategy-indexerror.yml
+    - 87087-wait_for-errno-constant.yml
+    - fix-cloning-malformed-role-requirements.yml
+    - inject_invocation.yml
+    - meta_skipped_callback_args.yml
+    - pager.yml
+    - sort_obfuscation.yml
+    - winrm-psrp-nolog.yml
+    release_date: '2026-06-11'
diff --git a/changelogs/fragments/2.21.1rc1_summary.yaml b/changelogs/fragments/2.21.1rc1_summary.yaml
new file mode 100644
index 00000000000..979e335636f
--- /dev/null
+++ b/changelogs/fragments/2.21.1rc1_summary.yaml
@@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2026-06-11
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.21/porting_guides/porting_guide_core_2.21.html>`__
diff --git a/lib/ansible/release.py b/lib/ansible/release.py
index 1c129d8dc71..a4950b73536 100644
--- a/lib/ansible/release.py
+++ b/lib/ansible/release.py
@@ -17,6 +17,6 @@
 
 from __future__ import annotations
 
-__version__ = '2.21.0.post0'
+__version__ = '2.21.1rc1'
 __author__ = 'Ansible, Inc.'
 __codename__ = "The Rain Song"