diff --git a/CHANGELOG.md b/CHANGELOG.md
index 383f3138..e2f6d2e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,14 +4,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 This project does not follow semantic versioning.
-The **major** part of the version is aligned with the stable version of Debian.
-The **minor** part changes with big changes (probably incompatible).
-The **patch** part changes incrementally at each release.
+The **major** part of the version is the year
+The **minor** part changes is the month
+The **patch** part changes is incremented if multiple releases happen the same month
 
 ## [Unreleased]
 
 ### Added
 
+### Changed
+
+### Fixed
+
+### Removed
+
+### Security
+
+## [21.09] 2021-09-29
+
+### Added
+
 * Preliminary support for Debian 11 « Bullseye »
 * apache: new variable for mpm mode (+ updated default config accordingly)
 * certbot: add script for manual deploy hooks execution
@@ -32,6 +44,7 @@ The **patch** part changes incrementally at each release.
 
 ### Changed
 
+* Change version pattern
 * Use python3 modules for Debian 11 and later
 * Remove embedded GPG keys only if legacy keyring is present
 * apt: remove workaround for Evolix public repositories with Debian 11
@@ -50,6 +63,7 @@ The **patch** part changes incrementally at each release.
 * logstash: elastic_stack_version = 7.x
 * mysql: mariadb-client-10.5 on Debian 11
 * mysql: use python3 with Debian 11 and later
+* php: enforce Debian version with assert instead of fail
 * squid: improve default whitelist (more specific patterns)
 * squid: must be started in foreground mode for systemd
 * squid: remove obsolete variable on Squid 4
@@ -63,8 +77,6 @@ The **patch** part changes incrementally at each release.
 * php: remove php-gettext for 7.4
 * logstash: no more dependency on Java
 
-### Security
-
 ## [10.6.0] 2021-06-28
 
 ### Added
diff --git a/php/tasks/main.yml b/php/tasks/main.yml
index 5cf46bec..c0f736c4 100644
--- a/php/tasks/main.yml
+++ b/php/tasks/main.yml
@@ -1,8 +1,11 @@
 ---
 
-- fail:
-    msg: only compatible with Debian >= 8
-  when: ansible_distribution != "Debian" or ansible_distribution_major_version is version('8', '<')
+- assert:
+    that:
+      - ansible_distribution != "Debian"
+      - ansible_distribution_major_version is version('8', '>=')
+      - ansible_distribution_major_version is version('11', '<=')
+    msg: This is only compatible with Debian 8 → 11
 
 - include: main_jessie.yml
   when: ansible_distribution_release == "jessie"