diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e63b911..dd07256b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,7 +47,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * **role:monitoring_plugins**: `install_method: 'source'` now reads the per-Python-LTS lockfile under `lockfiles/pyXX/requirements.txt` (`py39` ... `py314`) from both the `monitoring-plugins` and `lib` repos, picking the directory that matches the target host's Python. The previous root-level `requirements.txt` no longer exists upstream. No variable changes; rsync sources updated.
 * **CONTRIBUTING**: `meta/argument_specs.yml` must declare the `__dependent_var` slot for any variable that `setup_*` playbooks inject into the role via `vars:`. Dict variables fed by external lookups like `linuxfabrik.lfops.bitwarden_item` should use `type: 'dict'` without strict sub-options, since the lookup returns the full item with additional keys.
 * **role:example**: Demonstrate the `delegate_to: 'localhost'` + `become: false` pattern (download on the controller, copy to the target) so role authors can copy it consistently.
-* **role:apache_httpd**: bump Core Rule Set to 4.26.0
+* **role:apache_httpd**: bump Core Rule Set to 4.27.0
 * **role:apache_httpd**: Update the two reverse-proxy snippets in `EXAMPLES.md` to use `ProxyPass` instead of `RewriteRule ^/(.*) ... [proxy,last]`. The RewriteRule variant `%`-decodes the URI pattern and forwards characters such as `?` unencoded to the backend, which breaks WebDAV apps (file-not-found on rename in Nextcloud). The examples now also carry a comment explaining the choice and link to the corresponding [blog post](https://www.linuxfabrik.ch/blog/nextcloud-rewriterules-vs-proxypass).
 
 ### Fixed
diff --git a/roles/apache_httpd/README.md b/roles/apache_httpd/README.md
index 9ff21aeb..d82a110d 100644
--- a/roles/apache_httpd/README.md
+++ b/roles/apache_httpd/README.md
@@ -743,7 +743,7 @@ apache_httpd__mod_log_config_custom_log: 'logs/access.log combined'
 
 * The OWASP ModSecurity Core Rule Set (CRS) version number without "v".
 * Type: String.
-* Default: `'4.26.0'`
+* Default: `'4.27.0'`
 
 `apache_httpd__skip_mod_security_coreruleset`
 
@@ -755,7 +755,7 @@ Example:
 ```yaml
 # optional - mod_security
 apache_httpd__mod_security_coreruleset_url: 'https://github.com/coreruleset/coreruleset/archive'
-apache_httpd__mod_security_coreruleset_version: '4.24.1'
+apache_httpd__mod_security_coreruleset_version: '4.27.0'
 apache_httpd__skip_mod_security_coreruleset: true
 ```
 
diff --git a/roles/apache_httpd/defaults/main.yml b/roles/apache_httpd/defaults/main.yml
index d35a4656..dd965307 100644
--- a/roles/apache_httpd/defaults/main.yml
+++ b/roles/apache_httpd/defaults/main.yml
@@ -231,7 +231,7 @@ apache_httpd__mpm_worker_threads_per_child: 25
 # get details from https://coreruleset.org/installation/
 # origin: https://github.com/coreruleset/coreruleset/releases
 apache_httpd__mod_security_coreruleset_url: 'https://github.com/coreruleset/coreruleset/archive'
-apache_httpd__mod_security_coreruleset_version: '4.26.0'
+apache_httpd__mod_security_coreruleset_version: '4.27.0'
 
 # mod_ssl
 apache_httpd__mod_ssl_ssl_use_stapling: 'on'