diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3706b2fd..8e6149d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
 
 - More CRD documentation ([#749]).
 - Helm: support labels in values.yaml ([#763]).
+- Support for `3.9.1` ([#771]).
 
 ### Changed
 
@@ -21,11 +22,13 @@ All notable changes to this project will be documented in this file.
 ### Removed
 
 - [BREAKING] Removed legacy node selector on roleGroups ([#757]).
+- Support for `3.8.1` ([#771]).
 
 [#749]: https://github.com/stackabletech/zookeeper-operator/pull/749
 [#757]: https://github.com/stackabletech/zookeeper-operator/pull/757
 [#762]: https://github.com/stackabletech/zookeeper-operator/pull/762
 [#763]: https://github.com/stackabletech/zookeeper-operator/pull/763
+[#771]: https://github.com/stackabletech/zookeeper-operator/pull/771
 
 ## [23.11.0] - 2023-11-24
 
diff --git a/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh b/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh
index 74600dcc..35ec0d67 100755
--- a/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh
+++ b/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh
@@ -67,7 +67,7 @@ zkCli_ls() {
 # tag::zkcli-ls[]
 kubectl run my-pod \
   --stdin --tty --quiet --restart=Never \
-  --image docker.stackable.tech/stackable/zookeeper:3.8.3-stackable0.0.0-dev -- \
+  --image docker.stackable.tech/stackable/zookeeper:3.9.1-stackable0.0.0-dev -- \
   bin/zkCli.sh -server simple-zk-server-default:2282 ls / > /dev/null && \
   kubectl logs my-pod && \
   kubectl delete pods my-pod
diff --git a/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh.j2 b/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh.j2
index 0e6be48c..49ae5b6c 100755
--- a/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh.j2
+++ b/docs/modules/zookeeper/examples/getting_started/code/getting_started.sh.j2
@@ -67,7 +67,7 @@ zkCli_ls() {
 # tag::zkcli-ls[]
 kubectl run my-pod \
   --stdin --tty --quiet --restart=Never \
-  --image docker.stackable.tech/stackable/zookeeper:3.8.3-stackable{{ versions.zookeeper }} -- \
+  --image docker.stackable.tech/stackable/zookeeper:3.9.1-stackable{{ versions.zookeeper }} -- \
   bin/zkCli.sh -server simple-zk-server-default:2282 ls / > /dev/null && \
   kubectl logs my-pod && \
   kubectl delete pods my-pod
diff --git a/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml b/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml
index faa6ebd9..75428814 100644
--- a/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml
+++ b/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml
@@ -5,7 +5,7 @@ metadata:
   name: simple-zk
 spec:
   image:
-    productVersion: 3.8.3
+    productVersion: 3.9.1
   servers:
     roleGroups:
       default:
diff --git a/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml.j2 b/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml.j2
index e8fcb16e..7662cfbd 100644
--- a/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml.j2
+++ b/docs/modules/zookeeper/examples/getting_started/code/zookeeper.yaml.j2
@@ -7,7 +7,7 @@ spec:
   clusterConfig:
     listenerClass: external-unstable
   image:
-    productVersion: 3.8.3
+    productVersion: 3.9.1
   servers:
     roleGroups:
       default:
diff --git a/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-authentication.yaml b/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-authentication.yaml
index 02551ad8..41b6bb98 100644
--- a/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-authentication.yaml
+++ b/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-authentication.yaml
@@ -5,7 +5,7 @@ metadata:
   name: simple-zk
 spec:
   image:
-    productVersion: 3.8.3
+    productVersion: 3.9.1
   clusterConfig:
     authentication:
       - authenticationClass: zk-client-tls # <1>
diff --git a/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-encryption.yaml b/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-encryption.yaml
index 3ae97a50..004a06ae 100644
--- a/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-encryption.yaml
+++ b/docs/modules/zookeeper/examples/usage_guide/example-cluster-tls-encryption.yaml
@@ -5,7 +5,7 @@ metadata:
   name: simple-zk
 spec:
   image:
-    productVersion: 3.8.3
+    productVersion: 3.9.1
   clusterConfig:
     tls:
       serverSecretClass: tls # <1>
diff --git a/docs/modules/zookeeper/pages/index.adoc b/docs/modules/zookeeper/pages/index.adoc
index b73791a8..0294cf00 100644
--- a/docs/modules/zookeeper/pages/index.adoc
+++ b/docs/modules/zookeeper/pages/index.adoc
@@ -52,6 +52,4 @@ components will also deploy a ZooKeeper ensemble. Here is the list of the demos
 
 The Stackable Operator for Apache ZooKeeper currently supports the following versions of ZooKeeper:
 
-WARNING: The use of 3.8.1 is strongly discouraged due to https://zookeeper.apache.org/security.html#CVE-2023-44981[Authorization bypass in SASL Quorum Peer Authentication]. Several other versions are affected but not offered by Stackable. Please take this into account when using custom images.
-
 include::partial$supported-versions.adoc[]
diff --git a/docs/modules/zookeeper/pages/reference/discovery.adoc b/docs/modules/zookeeper/pages/reference/discovery.adoc
index 4f014be2..fbddfb63 100644
--- a/docs/modules/zookeeper/pages/reference/discovery.adoc
+++ b/docs/modules/zookeeper/pages/reference/discovery.adoc
@@ -26,7 +26,7 @@ The name of the ConfigMap created for this discovery profile is `$BASENAME-nodep
 
 Each discovery profile contains the following fields:
 
-`ZOOKEEPER`:: A connection string, as accepted by https://zookeeper.apache.org/doc/r3.8.3/apidocs/zookeeper-server/org/apache/zookeeper/ZooKeeper.html#ZooKeeper-java.lang.String-int-org.apache.zookeeper.Watcher-[the official Java client], e.g. `test-zk-server-default-0.test-zk-server-default.kuttl-test-proper-spaniel.svc.cluster.local:2282,test-zk-server-default-1.test-zk-server-default.kuttl-test-proper-spaniel.svc.cluster.local:2282/znode-4e169890-d2eb-4d62-9515-e4786f0ac58e`
+`ZOOKEEPER`:: A connection string, as accepted by https://zookeeper.apache.org/doc/r3.9.1/apidocs/zookeeper-server/org/apache/zookeeper/ZooKeeper.html#ZooKeeper-java.lang.String-int-org.apache.zookeeper.Watcher-[the official Java client], e.g. `test-zk-server-default-0.test-zk-server-default.kuttl-test-proper-spaniel.svc.cluster.local:2282,test-zk-server-default-1.test-zk-server-default.kuttl-test-proper-spaniel.svc.cluster.local:2282/znode-4e169890-d2eb-4d62-9515-e4786f0ac58e`
 `ZOOKEEPER_HOSTS`:: A comma-separated list of `node1:port1,node2:port2,...`, e.g. `test-zk-server-default-0.test-zk-server-default.kuttl-test-proper-spaniel.svc.cluster.local:2282,test-zk-server-default-1.test-zk-server-default.kuttl-test-proper-spaniel.svc.cluster.local:2282`
 `ZOOKEEPER_CHROOT`:: The name of the root ZNode associated with the discovery profile, should be used if (and only if) connecting using `ZOOKEEPER_HOSTS` (rather than `ZOOKEEPER`), e.g. `/znode-4e169890-d2eb-4d62-9515-e4786f0ac58e` in case of a ZNode discovery or `/` in case of a ZookeeperServer discovery
 `ZOOKEEPER_CLIENT_PORT`:: The port clients should use when connecting, e.g. `2282`
diff --git a/docs/modules/zookeeper/pages/usage_guide/configuration_environment_overrides.adoc b/docs/modules/zookeeper/pages/usage_guide/configuration_environment_overrides.adoc
index 3ea8f51f..3e8fa722 100644
--- a/docs/modules/zookeeper/pages/usage_guide/configuration_environment_overrides.adoc
+++ b/docs/modules/zookeeper/pages/usage_guide/configuration_environment_overrides.adoc
@@ -39,7 +39,7 @@ servers:
 
 All property values must be strings.
 
-For a full list of configuration options we refer to the Apache ZooKeeper https://zookeeper.apache.org/doc/r3.8.3/zookeeperAdmin.html#sc_configuration[Configuration Reference].
+For a full list of configuration options we refer to the Apache ZooKeeper https://zookeeper.apache.org/doc/r3.9.1/zookeeperAdmin.html#sc_configuration[Configuration Reference].
 
 === Overriding entries in security.properties
 
diff --git a/docs/modules/zookeeper/pages/znodes.adoc b/docs/modules/zookeeper/pages/znodes.adoc
index 1d1b1f6a..d93bd5c0 100644
--- a/docs/modules/zookeeper/pages/znodes.adoc
+++ b/docs/modules/zookeeper/pages/znodes.adoc
@@ -1,6 +1,6 @@
 = ZNodes
 
-Apache ZooKeeper organizes all data into a hierarchical system of https://zookeeper.apache.org/doc/r3.8.3/zookeeperProgrammers.html#ch_zkDataModel[ZNodes],
+Apache ZooKeeper organizes all data into a hierarchical system of https://zookeeper.apache.org/doc/r3.9.1/zookeeperProgrammers.html#ch_zkDataModel[ZNodes],
 which act as both files (they can have data associated with them) and folders (they can contain other ZNodes) when compared to a traditional (POSIX-like) file system.
 
 In order to isolate different clients using the same ZooKeeper cluster, each client application should be assigned a unique root ZNode, which it can then organize
diff --git a/docs/modules/zookeeper/partials/supported-versions.adoc b/docs/modules/zookeeper/partials/supported-versions.adoc
index 9bfd1a82..75b8d06d 100644
--- a/docs/modules/zookeeper/partials/supported-versions.adoc
+++ b/docs/modules/zookeeper/partials/supported-versions.adoc
@@ -2,5 +2,5 @@
 // This is a separate file, since it is used by both the direct ZooKeeper documentation, and the overarching
 // Stackable Platform documentation.
 
-- 3.8.3
-- 3.8.1 (deprecated)
+- 3.9.1
+- 3.8.3 (LTS)
diff --git a/examples/simple-zookeeper-tls-cluster.yaml b/examples/simple-zookeeper-tls-cluster.yaml
index 06556498..a470f099 100644
--- a/examples/simple-zookeeper-tls-cluster.yaml
+++ b/examples/simple-zookeeper-tls-cluster.yaml
@@ -5,7 +5,7 @@ metadata:
   name: simple-zk
 spec:
   image:
-    productVersion: 3.8.3
+    productVersion: 3.9.1
   clusterConfig:
     authentication:
       - authenticationClass: zk-client-tls
diff --git a/rust/crd/src/affinity.rs b/rust/crd/src/affinity.rs
index dd4f5910..c45051c9 100644
--- a/rust/crd/src/affinity.rs
+++ b/rust/crd/src/affinity.rs
@@ -48,7 +48,7 @@ mod tests {
           name: simple-zk
         spec:
           image:
-            productVersion: 3.8.3
+            productVersion: 3.9.1
           clusterConfig:
             authentication:
               - authenticationClass: zk-client-tls
diff --git a/rust/crd/src/lib.rs b/rust/crd/src/lib.rs
index 9b58e610..8720240f 100644
--- a/rust/crd/src/lib.rs
+++ b/rust/crd/src/lib.rs
@@ -740,7 +740,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
         "#;
         let zookeeper: ZookeeperCluster = serde_yaml::from_str(input).expect("illegal test input");
         assert_eq!(
@@ -759,7 +759,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           clusterConfig:
             tls:
               serverSecretClass: simple-zookeeper-client-tls
@@ -782,7 +782,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           clusterConfig:
             tls:
               serverSecretClass: null
@@ -801,7 +801,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           clusterConfig:
             tls:
               quorumSecretClass: simple-zookeeper-quorum-tls
@@ -826,7 +826,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
         "#;
         let zookeeper: ZookeeperCluster = serde_yaml::from_str(input).expect("illegal test input");
 
@@ -846,7 +846,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           clusterConfig:
             tls:
               quorumSecretClass: simple-zookeeper-quorum-tls
@@ -868,7 +868,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           clusterConfig:
             tls:
               serverSecretClass: simple-zookeeper-server-tls
diff --git a/rust/operator-binary/src/zk_controller.rs b/rust/operator-binary/src/zk_controller.rs
index df1d6421..bbd3f5b6 100644
--- a/rust/operator-binary/src/zk_controller.rs
+++ b/rust/operator-binary/src/zk_controller.rs
@@ -1021,7 +1021,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           servers:
             roleGroups:
               default:
@@ -1048,7 +1048,7 @@ mod tests {
           name: simple-zookeeper
         spec:
           image:
-            productVersion: "3.8.3"
+            productVersion: "3.9.1"
           servers:
             configOverrides:
               zoo.cfg:
diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml
index 37ab2773..b203801d 100644
--- a/tests/test-definition.yaml
+++ b/tests/test-definition.yaml
@@ -2,11 +2,11 @@
 dimensions:
   - name: zookeeper
     values:
-      - 3.8.1
       - 3.8.3
+      - 3.9.1
   - name: zookeeper-latest
     values:
-      - 3.8.3
+      - 3.9.1
   - name: use-server-tls
     values:
       - "true"