diff --git a/package.json b/package.json
index 6dafa77b4..d986ae2bc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@databricks/databricks-vscode",
-    "version": "2.23.0",
+    "version": "2.23.1",
     "private": true,
     "workspaces": [
         "packages/*"
diff --git a/packages/databricks-vscode-types/CHANGELOG.md b/packages/databricks-vscode-types/CHANGELOG.md
index 5f9ace1d8..02514f6f3 100644
--- a/packages/databricks-vscode-types/CHANGELOG.md
+++ b/packages/databricks-vscode-types/CHANGELOG.md
@@ -1,3 +1,9 @@
+# Release: v2.23.1
+
+## packages/databricks-vscode-types
+
+## (2026-11-05)
+
 # Release: v2.23.0
 
 ## packages/databricks-vscode-types
diff --git a/packages/databricks-vscode-types/package.json b/packages/databricks-vscode-types/package.json
index 7a9b69da7..841cde0c1 100644
--- a/packages/databricks-vscode-types/package.json
+++ b/packages/databricks-vscode-types/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@databricks/databricks-vscode-types",
-    "version": "2.23.0",
+    "version": "2.23.1",
     "description": "Package with types and interfaces to develop extensions to the Databricks VSCode plugin",
     "main": "index.js",
     "types": "index.d.ts",
diff --git a/packages/databricks-vscode/CHANGELOG.md b/packages/databricks-vscode/CHANGELOG.md
index 56b3b9c17..2ceac37a0 100644
--- a/packages/databricks-vscode/CHANGELOG.md
+++ b/packages/databricks-vscode/CHANGELOG.md
@@ -1,3 +1,12 @@
+# Release: v2.23.1
+
+## packages/databricks-vscode
+
+## (2026-11-05)
+
+-   Treat a bundle variable used as the value of a secret as sensitive, as part of the update to Databricks CLI v1.24.0 (#2286) ([40eb86e](https://github.com/databricks/databricks-vscode/commit/40eb86e)). If another field, such as a job parameter or the secret's `comment`, references that variable, `bundle validate` and `bundle deploy` fail, because the value would be used in plain text. Mark other variables that hold secrets with `sensitive: true` to get the same protection. If you can't change the bundle yet, stay on extension v2.23.0. Serverless SSH connections get a new default connection name, so the first connection after the update is set up again; the old connection's SSH keys and known hosts in your local `.databricks` folder are no longer used and can be removed. Signing in with a profile name that contains a dot, such as `team.prod`, no longer overwrites the host and token of the `[team]` profile. `bundle deploy` no longer redeploys an app on every run because of its `config.env` values. See the [CLI release notes](https://github.com/databricks/cli/releases/tag/v1.24.0) for details
+-   Open the remote window for a Databricks SSH tunnel when the `code` or `cursor` command is not on your PATH: the extension now finds the editor executable in its install folder (#2285) ([004553b](https://github.com/databricks/databricks-vscode/commit/004553b))
+
 # Release: v2.23.0
 
 ## packages/databricks-vscode
diff --git a/packages/databricks-vscode/package.json b/packages/databricks-vscode/package.json
index e603353a7..12dd5f3fe 100644
--- a/packages/databricks-vscode/package.json
+++ b/packages/databricks-vscode/package.json
@@ -4,7 +4,7 @@
     "description": "IDE support for Databricks",
     "publisher": "databricks",
     "license": "LicenseRef-LICENSE",
-    "version": "2.23.0",
+    "version": "2.23.1",
     "engines": {
         "vscode": "^1.104.0",
         "node": ">=22.0"