diff --git a/CHANGELOG.md b/CHANGELOG.md
index 38907235bb..97895c59d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+## [1.6.21] - 2020-03-30
+### Fixed
+- update Shell app to [v1.5.0](https://github.com/OSC/ood-shell/compare/v1.4.8...v1.5.0) which has
+  backported fix for adding CSRF protection via CSRF token and Origin checking when creating shell app
+  websocket connection [#444](https://github.com/OSC/ondemand/commit/1816de76fdf8bcec21d5f9619f5a3a09ff8db01d)
+
 ## [1.6.20] - 2019-10-14
 ### Fixed
 - fix bug to ensure `update_ood_portal` installs new config if existing
@@ -257,7 +263,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - From 1.3.7 - 1.4.2 updated app versions
 
 
-[Unreleased]: https://github.com/OSC/ondemand/compare/v1.6.20...HEAD
+[Unreleased]: https://github.com/OSC/ondemand/compare/v1.6.21...HEAD
+[1.6.21]: https://github.com/OSC/ondemand/compare/v1.6.20...v1.6.21
 [1.6.20]: https://github.com/OSC/ondemand/compare/v1.6.19...v1.6.20
 [1.6.19]: https://github.com/OSC/ondemand/compare/v1.6.18...v1.6.19
 [1.6.18]: https://github.com/OSC/ondemand/compare/v1.6.17...v1.6.18
diff --git a/config.json b/config.json
index 765b0cd72c..5a5082af3b 100644
--- a/config.json
+++ b/config.json
@@ -8,7 +8,7 @@
   {
     "name": "shell",
     "url": "https://github.com/OSC/ood-shell",
-    "tag": "v1.4.8",
+    "tag": "v1.5.0",
     "app": true
   },
   {