diff --git a/.cirrus.yml b/.cirrus.yml
index f11e114e24..1326a58dc6 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -307,25 +307,6 @@ ubuntu22_spicy_task:
   benchmark_script: ./ci/benchmark.sh
   << : *BENCHMARK_ONLY_IF_TEMPLATE
 
-ubuntu22_spicy_head_task:
-  container:
-    # Ubuntu 22.04 EOL: April 2027
-    dockerfile: ci/ubuntu-22.04/Dockerfile
-    << : *RESOURCES_TEMPLATE
-  << : *CI_TEMPLATE
-  env:
-    ZEEK_CI_CREATE_ARTIFACT: 1
-    # Pull auxil/spicy to the latest head version. May or may not build.
-    ZEEK_CI_PREBUILD_COMMAND: 'cd auxil/spicy && git fetch && git reset --hard origin/main && git submodule update --init --recursive'
-  spicy_install_analyzers_script: ./ci/spicy-install-analyzers.sh
-  upload_binary_artifacts:
-    path: build.tgz
-  benchmark_script: ./ci/benchmark.sh
-  # Don't run this job on release branches. It tests against spicy HEAD, which
-  # will frequently require other fixes that won't be in a release branch.
-  skip: $CIRRUS_BRANCH =~ 'release/.*'
-  << : *BENCHMARK_ONLY_IF_TEMPLATE
-
 ubuntu20_task:
   container:
     # Ubuntu 20.04 EOL: April 2025
diff --git a/CHANGES b/CHANGES
index 15f372e3ff..1b4d06f5e9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,18 @@
+7.0.8-9 | 2025-07-17 08:46:49 -0700
+
+  * CI: Remove spicy-head task (Tim Wojtulewicz, Corelight)
+
+  * [Spicy] Let `zeek::protocol_handle_close()` send a TCP EOF. (Benjamin Bannier, Corelight)
+
+    (cherry picked from commit ce6c7a6cd1b3eb7f7b3c12772763edd9881b430e)
+
+  * Remove libzmq5 from Docker images (Tim Wojtulewicz, Corelight)
+
+    This was accidentally added in 356685d82deea868f4340169b9a6c8d2e2109bed and
+    doesn't need to be in our official 7.0 images.
+
+  * CI: Force opensuse-tumbleweed image to rebuild (Tim Wojtulewicz, Corelight)
+
 7.0.8-5 | 2025-07-14 14:15:46 -0700
 
   * fix for error in ZAM's constant propagation logic (Vern Paxson, Corelight)
diff --git a/VERSION b/VERSION
index c7f44231d5..ce4dce2c30 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.0.8-5
+7.0.8-9