diff --git a/CHANGES b/CHANGES
index 341b35798d..5b3d9c9bd6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+7.2.0-rc1.18 | 2025-05-08 14:47:17 -0700
+
+  * Bump auxil/spicy to latest release (Benjamin Bannier, Corelight)
+
 7.2.0-rc1.16 | 2025-05-08 13:47:36 -0700
 
   * Downgrade broker clone FatalError to an Error (Tim Wojtulewicz, Corelight)
diff --git a/NEWS b/NEWS
index 4aa0840034..0a7456f847 100644
--- a/NEWS
+++ b/NEWS
@@ -36,6 +36,8 @@ New Functionality
 
   - The bundled version of ZeekJS has been updated to v0.17.0.
 
+  - The bundled version of Spicy has been updated to v1.13.0.
+
 - Some DNS events are not raised when ``dns_skip_all_addl`` is set to true.  Zeek now
   raises a warning when a script declares these events while this option is set to true.
 
diff --git a/VERSION b/VERSION
index e6d2ae3e32..f1c51ced11 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.2.0-rc1.16
+7.2.0-rc1.18
diff --git a/auxil/spicy b/auxil/spicy
index e15e0bd959..d594c99e7e 160000
--- a/auxil/spicy
+++ b/auxil/spicy
@@ -1 +1 @@
-Subproject commit e15e0bd959a03d06822ae76b53eef6181daf01a2
+Subproject commit d594c99e7efcf8d02d8f4f0336c3253585c9f609