diff --git a/CHANGELOG.md b/CHANGELOG.md
index aea6622..fc7a0a6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Only manage security groups for ENIs tagged by CAPA.
+
 ## [2.27.0] - 2025-01-21
 
 ### Fixed
diff --git a/helm/cluster-api-provider-aws/values.yaml b/helm/cluster-api-provider-aws/values.yaml
index 2cf3f13..39ff896 100644
--- a/helm/cluster-api-provider-aws/values.yaml
+++ b/helm/cluster-api-provider-aws/values.yaml
@@ -10,7 +10,7 @@ name: cluster-api-provider-aws
 #   * Filter out AWS internal tags when reconciling (https://github.com/kubernetes-sigs/cluster-api-provider-aws/pull/5181/commits/4c61f2b5a01e0b67e647868a066dda1947b97d4c)
 #   * Support EC2 lifecycle hooks for machine pools (https://github.com/giantswarm/cluster-api-provider-aws/pull/613)
 #   * Tags defined in subnet spec should be applied (https://github.com/giantswarm/cluster-api-provider-aws/pull/615)
-tag: v2.7.1-gs-5ffc044f4
+tag: v2.7.1-gs-ef95bc532
 
 registry:
   domain: gsoci.azurecr.io