diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58426028..2251ea66 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * minifirewall: tail template follows symlinks
 * minifirewall: upstream release 22.03.5
 * openvpn: use a subnet topology instead of the net30 default topology
+* tomcat: Tomcat 9 by default with Debian 11
 
 ### Fixed
 
diff --git a/tomcat/tasks/packages.yml b/tomcat/tasks/packages.yml
index 9b7995cc..f1b968cc 100644
--- a/tomcat/tasks/packages.yml
+++ b/tomcat/tasks/packages.yml
@@ -21,9 +21,9 @@
     - ansible_distribution_release == "buster"
     - tomcat_version is not defined
 
-- name: Set Tomcat version to 10 on Debian 11 if missing
+- name: Set Tomcat version to 9 on Debian 11 if missing
   set_fact:
-    tomcat_version: 10
+    tomcat_version: 9
   when:
     - ansible_distribution_release == "bullseye"
     - tomcat_version is not defined