diff --git a/NEWS b/NEWS
index 1fd83c86..575df30d 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,9 @@
+Version 2.0.12 (2023-01-23)
+  o Filter: New 'onlink' route attribute
+  o Compile-time option to use 4-way tries instead of 16-way ones
+  o BSD: Support for kernel route metric and other improvements
+  o Important bugfixes
+
 Version 2.0.11 (2022-11-12)
   o BGP roles (RFC 9234)
   o BGP: Keepalive time scaling
diff --git a/misc/bird.spec b/misc/bird.spec
index 04b58bd9..2d05e0f6 100644
--- a/misc/bird.spec
+++ b/misc/bird.spec
@@ -1,6 +1,6 @@
 Summary: BIRD Internet Routing Daemon
 Name: bird
-Version: 2.0.11
+Version: 2.0.12
 Release: 1
 Copyright: GPL
 Group: Networking/Daemons
diff --git a/proto/babel/babel.c b/proto/babel/babel.c
index a00be9a5..a3a52f73 100644
--- a/proto/babel/babel.c
+++ b/proto/babel/babel.c
@@ -1945,6 +1945,9 @@ babel_reconfigure_ifaces(struct babel_proto *p, struct babel_config *cf)
 
   WALK_LIST(iface, iface_list)
   {
+    if (p->p.vrf && p->p.vrf != iface->master)
+      continue;
+
     if (!(iface->flags & IF_UP))
       continue;
 
diff --git a/proto/bfd/packets.c b/proto/bfd/packets.c
index 6f0b4eaf..2200ab09 100644
--- a/proto/bfd/packets.c
+++ b/proto/bfd/packets.c
@@ -374,6 +374,10 @@ bfd_rx_hook(sock *sk, uint len)
     /* FIXME: better session matching and message */
     if (!s)
       return 1;
+
+    /* For active sessions we require matching remote id */
+    if ((s->loc_state == BFD_STATE_UP) && (ntohl(pkt->snd_id) != s->rem_id))
+      DROP("mismatched remote id", ntohl(pkt->snd_id));
   }
 
   /* bfd_check_authentication() has its own error logging */
diff --git a/proto/ospf/iface.c b/proto/ospf/iface.c
index 4cd45033..84c53aa1 100644
--- a/proto/ospf/iface.c
+++ b/proto/ospf/iface.c
@@ -1227,6 +1227,9 @@ ospf_reconfigure_ifaces2(struct ospf_proto *p)
 
   WALK_LIST(iface, iface_list)
   {
+    if (p->p.vrf && p->p.vrf != iface->master)
+      continue;
+
     if (! (iface->flags & IF_UP))
       continue;
 
@@ -1273,6 +1276,9 @@ ospf_reconfigure_ifaces3(struct ospf_proto *p)
 
   WALK_LIST(iface, iface_list)
   {
+    if (p->p.vrf && p->p.vrf != iface->master)
+      continue;
+
     if (! (iface->flags & IF_UP))
       continue;
 
diff --git a/proto/radv/radv.c b/proto/radv/radv.c
index 10d5e3ed..8929e8ef 100644
--- a/proto/radv/radv.c
+++ b/proto/radv/radv.c
@@ -666,6 +666,9 @@ radv_reconfigure(struct proto *P, struct proto_config *CF)
   struct iface *iface;
   WALK_LIST(iface, iface_list)
   {
+    if (p->p.vrf && p->p.vrf != iface->master)
+      continue;
+
     if (!(iface->flags & IF_UP))
       continue;
 
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 5981ffa7..bd087246 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -808,6 +808,9 @@ rip_reconfigure_ifaces(struct rip_proto *p, struct rip_config *cf)
 
   WALK_LIST(iface, iface_list)
   {
+    if (p->p.vrf && p->p.vrf != iface->master)
+      continue;
+
     if (!(iface->flags & IF_UP))
       continue;
 
diff --git a/sysdep/config.h b/sysdep/config.h
index 9b0591a3..861e52bc 100644
--- a/sysdep/config.h
+++ b/sysdep/config.h
@@ -13,7 +13,7 @@
 #ifdef GIT_LABEL
 #define BIRD_VERSION XSTR1(GIT_LABEL)
 #else
-#define BIRD_VERSION "2.0.11"
+#define BIRD_VERSION "2.0.12"
 #endif
 
 /* Include parameters determined by configure script */