diff --git a/CHANGES b/CHANGES
index cbb67ac18d..f0536dacd0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+	--- 9.6-ESV-R7 released ---
+
 3314.	[bug]		The masters list could be updated while refesh_callback
 			and stub_callback were using it. [RT #26732]
 
diff --git a/EXCLUDED b/EXCLUDED
index 58d658ae2b..07ae697796 100644
--- a/EXCLUDED
+++ b/EXCLUDED
@@ -19,6 +19,9 @@
 3288.	[bug]		dlz_destroy() function wasn't correctly registered
 			by the DLZ dlopen driver. [RT #28056]
 
+3286.	[bug]		Managed key maintenance timer could fail to start
+			after 'rndc reconfig'. [RT #26786]
+
 3280.	[bug]		Potential double free of a rdataset on out of memory
 			with DNS64. [RT #27762]
 
@@ -26,12 +29,27 @@
 			a asynchronous load.  Address potential memory leak
 			if the asynchronous is cancelled. [RT #27750]
 
+3278.	[bug]		Make sure automatic key maintenance is started
+			when "auto-dnssec maintain" is turned on during
+			"rndc reconfig". [RT #26805]
+
 3277.	[bug]		win32: isc_socket_dup is not implemented. [RT #27696]
 
+3276.	[bug]		win32: ns_os_openfile failed to return NULL on
+			safe_open failure. [RT #27696]
+
 3275.	[bug]		Corrected rndc -h output; the 'rndc sync -clean'
 			option had been misspelled as '-clear'.  (To avoid
 			future confusion, both options now work.) [RT #27173]
 
+3273.	[bug]		AAAA responses could be returned in the additional
+			section even when filter-aaaa-on-v4 was in use.
+			[RT #27292]
+
+3271.	[port]		darwin: mksymtbl is not always stable, loop several
+			times before giving up.  mksymtbl was using non
+			portable perl to covert 64 bit hex strings. [RT #27653]
+
 3270.	[bug]		"rndc reload" didn't reuse existing zones correctly
 			when inline-signing was in use. [RT #27650]
 
@@ -50,6 +68,9 @@
 3262.	[bug]		Signed responses were handled incorrectly by RPZ.
 			[RT #27316]
 
+3258.	[test]		Add "forcing full sign with unreadable keys" test.
+			[RT #27153]
+
 3252.	[bug]		When master zones using inline-signing were
 			updated while the server was offline, the source
 			zone could fall out of sync with the signed
@@ -69,6 +90,8 @@
 3243.	[port]		freebsd,netbsd,bsdi: the thread defaults were not
 			being properly set.
 
+3240.	[bug]		DNSKEY state change events could be missed. [RT #26874]
+
 3239.	[bug]		dns_dnssec_findmatchingkeys needs to use a consistent
 			timestamp. [RT #26883]
 
@@ -168,6 +191,9 @@
 3155.	[bug]		Fixed a build failure when using contrib DLZ
 			drivers (e.g., mysql, postgresql, etc). [RT #25710]
 
+3152.	[cleanup]	Some versions of gcc and clang failed due to
+			incorrect use of __builtin_expect. [RT #25183]
+
 3142.	[bug]		NAPTR is class agnostic. [RT #25429]
 
 3141.	[bug]		Silence spurious "zone serial (0) unchanged" messages
@@ -192,6 +218,12 @@
 			RPZ caused named to exit with a assertion failure.
 			[RT #24715]
 
+3122.	[cleanup]	dnssec-settime: corrected usage message. [RT #24664]
+
+3117.	[cleanup]	Remove doc and parser references to the
+			never-implemented 'auto-dnssec create' option.
+			[RT #24533]
+
 3115.	[bug]		Named could fail to return requested data when
 			following a CNAME that points into the same zone.
 			[RT #24455]
@@ -467,12 +499,18 @@
 2824.	[bug]		"rndc sign" was not being run by the correct task.
 			[RT #20759]
 
+2822.	[bug]		rbtdb.c:loadnode() could return the wrong result.
+			[RT #20802]
+
 2821.	[doc]		Add note that named-checkconf doesn't automatically
 			read rndc.key and bind.keys [RT #20758]
 
 2816.	[bug]		previous_closest_nsec() could fail to return
 			data for NSEC3 nodes [RT #29730]
 
+2812.	[bug]		Make sure updates can't result in a zone with
+			NSEC-only keys and NSEC3 records. [RT #20748]
+
 2811.	[cleanup]	Add "rndc sign" to list of commands in rndc usage
 			output. [RT #20733]
 
diff --git a/README b/README
index 191125b546..28750be5d8 100644
--- a/README
+++ b/README
@@ -48,6 +48,11 @@ BIND 9
         For up-to-date release notes and errata, see
         http://www.isc.org/software/bind9/releasenotes
 
+BIND 9.6-ESV-R7 (Extended Support Version)
+
+	BIND 9.4-ESV-R7 is a maintenance release, fixing bugs in BIND
+	9.6-ESV-R6.
+
 BIND 9.6-ESV-R6 (Extended Support Version)
 
 	BIND 9.6-ESV-R6 includes a number of bug fixes and prevents a
diff --git a/lib/dns/api b/lib/dns/api
index 5a5cbc7fd1..974ae84d53 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -4,5 +4,5 @@
 # 9.8: 80-89
 # 9.9: 90-109
 LIBINTERFACE = 110
-LIBREVISION = 1
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/lib/isccfg/api b/lib/isccfg/api
index ae9fbaedc5..d15c78ebe6 100644
--- a/lib/isccfg/api
+++ b/lib/isccfg/api
@@ -4,5 +4,5 @@
 # 9.8: 80-89
 # 9.9: 90-109
 LIBINTERFACE = 50
-LIBREVISION = 4
+LIBREVISION = 6
 LIBAGE = 0
diff --git a/util/copyrights b/util/copyrights
index 0215a71c17..4cfa7eb3ce 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -2486,7 +2486,6 @@
 ./make/mkdep.in					X	1999,2000,2001,2006,2011
 ./make/rules.in					MAKE	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012
 ./mkinstalldirs					X	1996,2012
-./release-notes.css				X	2011
 ./unit/.gitignore				X	2012
 ./unit/Makefile.in				MAKE	2011,2012
 ./unit/README					X	2011
diff --git a/version b/version
index fc25d26d82..103d10e60f 100644
--- a/version
+++ b/version
@@ -7,4 +7,4 @@ MAJORVER=9
 MINORVER=6
 PATCHVER=
 RELEASETYPE=-ESV
-RELEASEVER=-R6
+RELEASEVER=-R7