second release candidate for 25.12

diff --git a/.version b/.version
index 9f108a86..8a08be9e 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-v25.12rc1
+v25.12rc2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c7eeaed..ef4f5612 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## [25.12rc1] - 2025-11-25: "Boltz's Seamless Upgrade Experience"
+## [25.12rc2] - 2025-11-28: "Boltz's Seamless Upgrade Experience"
 
 Release Candidate for Core Lightning v25.12
 
@@ -16,6 +16,7 @@ This release named by @sangbida
  - JSON-RPC: `fundchannel_complete` new parameter `withhold` for zero-conf channels (default false). ([#8546])
  - Plugins: `xpay` will now wait if it suspects a payment failure is due to a height disagreement with the final node. ([#8645])
  - Tools: `lightning-hsmtool` now supports hsm_secret files using a 12-word mnemonic. ([#8400])
+ - Tools: `lightningd-downgrade` can downgrade your database from v25.12 to v25.09 if something goes wrong. ([#8702])
  - JSON-RPC: `askrene-bias-node`: an RPC command to set a bias on node's outgoing or incoming channels. ([#8608])
  - JSON-RPC: `listpeerchannels` `funding` object `withheld` flag, and `listclosedchannels` `funding_withheld` flags, indicating fundchannel_complete was called with the `withheld` parameter true. ([#8546])
  - JSON-RPC: `psbt` field in `funding` in listpeerchannels, and `funding_psbt` in listclosedchannels. ([#8546])
@@ -93,6 +94,7 @@ Note: You should always set `allow-deprecated-apis=false` to test for changes.
  - Splicing: Fixed crash when we splice a channel which hasn't been announced yet. ([#8555])
  - JSON-RPC: `cancelrecurringinvoice` command to send new "don't expect any more invoice requests" msg to recurring bolt12 invoices. ([#8398])
 
+[#8702]: https://github.com/ElementsProject/lightning/pull/8702
 [#8506]: https://github.com/ElementsProject/lightning/pull/8506
 [#8646]: https://github.com/ElementsProject/lightning/pull/8646
 [#8546]: https://github.com/ElementsProject/lightning/pull/8546
@@ -131,7 +133,7 @@ Note: You should always set `allow-deprecated-apis=false` to test for changes.
 [#8651]: https://github.com/ElementsProject/lightning/pull/8651
 [#8561]: https://github.com/ElementsProject/lightning/pull/8561
 [#8302]: https://github.com/ElementsProject/lightning/pull/8302
-[v25.12rc1]: https://github.com/ElementsProject/lightning/releases/tag/v25.12rc1
+[v25.12rc2]: https://github.com/ElementsProject/lightning/releases/tag/v25.12rc2
 
 
 ## [25.09.3] - 2025-11-06: "Hot Wallet Guardian IV"
diff --git a/contrib/pyln-client/pyln/client/__init__.py b/contrib/pyln-client/pyln/client/__init__.py
index 4594cf0c..10afa3b3 100644
--- a/contrib/pyln-client/pyln/client/__init__.py
+++ b/contrib/pyln-client/pyln/client/__init__.py
@@ -4,7 +4,7 @@ from .gossmap import Gossmap, GossmapNode, GossmapChannel, GossmapHalfchannel, G
 from .gossmapstats import GossmapStats
 from .version import NodeVersion
 
-__version__ = "v25.12rc1"
+__version__ = "v25.12rc2"
 
 __all__ = [
     "LightningRpc",
diff --git a/contrib/pyln-client/pyproject.toml b/contrib/pyln-client/pyproject.toml
index 82008102..17d2a616 100644
--- a/contrib/pyln-client/pyproject.toml
+++ b/contrib/pyln-client/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "pyln-client"
-version = "v25.12rc1"
+version = "v25.12rc2"
 description = "Client library and plugin library for Core Lightning"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }
diff --git a/contrib/pyln-proto/pyln/proto/__init__.py b/contrib/pyln-proto/pyln/proto/__init__.py
index da04ce5d..981b3b3c 100644
--- a/contrib/pyln-proto/pyln/proto/__init__.py
+++ b/contrib/pyln-proto/pyln/proto/__init__.py
@@ -4,7 +4,7 @@ from .invoice import Invoice
 from .onion import OnionPayload, TlvPayload, LegacyOnionPayload
 from .wire import LightningConnection, LightningServerSocket
 
-__version__ = "v25.12rc1"
+__version__ = "v25.12rc2"
 
 __all__ = [
     "Invoice",
diff --git a/contrib/pyln-proto/pyproject.toml b/contrib/pyln-proto/pyproject.toml
index 520ed51e..5c4eb392 100644
--- a/contrib/pyln-proto/pyproject.toml
+++ b/contrib/pyln-proto/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "pyln-proto"
-version = "v25.12rc1"
+version = "v25.12rc2"
 description = "This package implements some of the Lightning Network protocol in pure python. It is intended for protocol testing and some minor tooling only. It is not deemed secure enough to handle any amount of real funds (you have been warned!)."
 authors = [
     {name = "Christian Decker", email = "decker.christian@gmail.com"}
diff --git a/contrib/pyln-testing/pyln/testing/__init__.py b/contrib/pyln-testing/pyln/testing/__init__.py
index d8aa4665..687506b3 100644
--- a/contrib/pyln-testing/pyln/testing/__init__.py
+++ b/contrib/pyln-testing/pyln/testing/__init__.py
@@ -1,4 +1,4 @@
-__version__ = "v25.12rc1"
+__version__ = "v25.12rc2"
 
 __all__ = [
     "__version__",
diff --git a/contrib/pyln-testing/pyproject.toml b/contrib/pyln-testing/pyproject.toml
index 8410ceb9..278526bf 100644
--- a/contrib/pyln-testing/pyproject.toml
+++ b/contrib/pyln-testing/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "pyln-testing"
-version = "v25.12rc1"
+version = "v25.12rc2"
 description = "Test your Core Lightning integration, plugins or whatever you want"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }
diff --git a/tools/hsmtool b/tools/hsmtool
new file mode 100755
index 00000000..41762d60
Binary files /dev/null and b/tools/hsmtool differ
diff --git a/tools/reckless b/tools/reckless
index f3d96760..ce705f70 100755
--- a/tools/reckless
+++ b/tools/reckless
@@ -21,7 +21,7 @@ from urllib.error import HTTPError
 import venv
 
 
-__VERSION__ = 'v25.12rc1'
+__VERSION__ = 'v25.12rc2'
 
 logging.basicConfig(
     level=logging.INFO,
diff --git a/uv.lock b/uv.lock
index cb8758e6..2e3418c9 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1355,7 +1355,7 @@ dev = [{ name = "pyln-proto", editable = "contrib/pyln-proto" }]
 
 [[package]]
 name = "pyln-client"
-version = "25.12rc1"
+version = "25.12rc2"
 source = { editable = "contrib/pyln-client" }
 dependencies = [
     { name = "pyln-bolt7" },
@@ -1413,7 +1413,7 @@ dev = [
 
 [[package]]
 name = "pyln-proto"
-version = "25.12rc1"
+version = "25.12rc2"
 source = { editable = "contrib/pyln-proto" }
 dependencies = [
     { name = "base58" },
@@ -1442,7 +1442,7 @@ dev = [{ name = "pytest", specifier = ">=8.0.0" }]
 
 [[package]]
 name = "pyln-testing"
-version = "25.12rc1"
+version = "25.12rc2"
 source = { editable = "contrib/pyln-testing" }
 dependencies = [
     { name = "cheroot" },