diff --git a/CHANGELOG.md b/CHANGELOG.md
index e28d5a2f94..487ea482a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org).
 
+## [v10.6.0](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v10.6.0) - 2025-10-13
+
+[Full Changelog](https://github.com/puppetlabs/puppetlabs-postgresql/compare/v10.5.0...v10.6.0)
+
+### Added
+
+- Allow puppetlabs/apt 11.x & puppet/systemd 9.x [#1645](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1645) ([kenyon](https://github.com/kenyon))
+- Add support for Debian 13 (trixie) [#1638](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1638) ([trefzer](https://github.com/trefzer))
+- Role: Add support for valid_until [#1624](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1624) ([mooreandrew](https://github.com/mooreandrew))
+
+### Fixed
+
+- Debian 11: Use correct package name for python bindings  [#1647](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1647) ([bastelfreak](https://github.com/bastelfreak))
+- Unbreak Debian support with custom encoding [#1564](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1564) ([smortex](https://github.com/smortex))
+
+### Other
+
+- (CAT-2296) Update github runner image to ubuntu-24.04 [#1636](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1636) ([shubhamshinde360](https://github.com/shubhamshinde360))
+
 ## [v10.5.0](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v10.5.0) - 2025-01-07
 
 [Full Changelog](https://github.com/puppetlabs/puppetlabs-postgresql/compare/v10.4.0...v10.5.0)
@@ -352,7 +371,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 
 ### Fixed
 
-- Do not add version component to repo definition [#1282](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1282) ([weastur](https://github.com/weastur))
+- Do not add version component to repo definition [#1282](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1282) ([psapezhka](https://github.com/psapezhka))
 - (MODULES-8700) Autorequire the service in postgresql_psql [#1276](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1276) ([ekohl](https://github.com/ekohl))
 
 ## [v7.2.0](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v7.2.0) - 2021-05-24
diff --git a/REFERENCE.md b/REFERENCE.md
index 247b58c952..bf3ffc306f 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -3677,6 +3677,7 @@ The following parameters are available in the `postgresql::server::role` defined
 * [`inherit`](#-postgresql--server--role--inherit)
 * [`superuser`](#-postgresql--server--role--superuser)
 * [`replication`](#-postgresql--server--role--replication)
+* [`valid_until`](#-postgresql--server--role--valid_until)
 * [`connection_limit`](#-postgresql--server--role--connection_limit)
 * [`username`](#-postgresql--server--role--username)
 * [`connect_settings`](#-postgresql--server--role--connect_settings)
@@ -3769,6 +3770,14 @@ Provides provides replication capabilities for this role if set to true.
 
 Default value: `false`
 
+##### <a name="-postgresql--server--role--valid_until"></a>`valid_until`
+
+Data type: `Optional[String[1]]`
+
+Specifies whether to set a valid until date for the role.
+
+Default value: `undef`
+
 ##### <a name="-postgresql--server--role--connection_limit"></a>`connection_limit`
 
 Data type: `String[1]`
diff --git a/lib/puppet/functions/postgresql/postgresql_password.rb b/lib/puppet/functions/postgresql/postgresql_password.rb
index a444d5cd01..9ca4d81dbb 100644
--- a/lib/puppet/functions/postgresql/postgresql_password.rb
+++ b/lib/puppet/functions/postgresql/postgresql_password.rb
@@ -24,7 +24,8 @@
     required_param 'Variant[String[1], Integer]', :username
     required_param 'Variant[String[1], Sensitive[String[1]], Integer]', :password
     optional_param 'Boolean', :sensitive
-    optional_param 'Optional[Postgresql::Pg_password_encryption]', :hash
+    # The following Enum is also defined in `types/pg_password_encryption.pp` but type alias can't be used in Deferred functions.
+    optional_param 'Optional[Enum["md5", "scram-sha-256"]]', :hash
     optional_param 'Optional[Variant[String[1], Integer]]', :salt
     return_type 'Variant[String, Sensitive[String]]'
   end
diff --git a/manifests/globals.pp b/manifests/globals.pp
index 64a4815fcc..f0eb07a9e8 100644
--- a/manifests/globals.pp
+++ b/manifests/globals.pp
@@ -210,6 +210,7 @@
         '10'    => '11',
         '11'    => '13',
         '12'    => '15',
+        '13'    => '17',
         default => undef,
       },
       'Ubuntu' => $facts['os']['release']['major'] ? {
diff --git a/manifests/params.pp b/manifests/params.pp
index 8441aa829c..55dcd24c0f 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -161,9 +161,9 @@
       $plpython_package_name  = pick($plpython_package_name, "postgresql-plpython-${version}")
 
       $_ubuntu_2204 = ($facts['os']['name'] == 'Ubuntu' and versioncmp($facts['os']['release']['full'], '22.04') >= 0)
-      $_debian_12 = ($facts['os']['name'] == 'Debian' and versioncmp($facts['os']['release']['full'], '12') >= 0)
+      $_debian_11 = ($facts['os']['name'] == 'Debian' and versioncmp($facts['os']['release']['full'], '11') >= 0)
 
-      if $_ubuntu_2204 or $_debian_12 {
+      if $_ubuntu_2204 or $_debian_11 {
         $python_package_name = pick($python_package_name, 'python3-psycopg2')
       } else {
         $python_package_name = pick($python_package_name, 'python-psycopg2')
diff --git a/metadata.json b/metadata.json
index 6ad73624ec..82cb5fa869 100644
--- a/metadata.json
+++ b/metadata.json
@@ -1,6 +1,6 @@
 {
   "name": "puppetlabs-postgresql",
-  "version": "10.5.0",
+  "version": "10.6.0",
   "author": "puppetlabs",
   "summary": "Offers support for basic management of PostgreSQL databases.",
   "license": "Apache-2.0",
@@ -14,11 +14,11 @@
     },
     {
       "name": "puppetlabs/apt",
-      "version_requirement": ">= 9.2.0 < 11.0.0"
+      "version_requirement": ">= 9.2.0 < 12.0.0"
     },
     {
       "name": "puppet/systemd",
-      "version_requirement": ">= 4.0.1 < 9.0.0"
+      "version_requirement": ">= 4.0.1 < 10.0.0"
     },
     {
       "name": "puppetlabs/concat",
@@ -60,7 +60,8 @@
       "operatingsystemrelease": [
         "10",
         "11",
-        "12"
+        "12",
+        "13"
       ]
     },
     {
diff --git a/spec/acceptance/db_deferred_spec.rb b/spec/acceptance/db_deferred_spec.rb
new file mode 100644
index 0000000000..731e0742b8
--- /dev/null
+++ b/spec/acceptance/db_deferred_spec.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'spec_helper_acceptance'
+
+describe 'postgresql::server::db:' do
+  let(:user) { 'user_test' }
+  let(:password) { 'deferred_password_test' }
+  let(:database) { 'test_database' }
+
+  let(:pp_one) do
+    <<~MANIFEST
+      $user = '#{user}'
+      $password = '#{password}'
+      $database = '#{database}'
+
+      include postgresql::server
+      postgresql::server::db { $database:
+         user     => $user,
+         password => Deferred('unwrap', [$password]),
+      }
+    MANIFEST
+  end
+
+  it 'creates a database with with the password in the deferred function' do
+    apply_manifest(pp_one)
+    psql_cmd = "PGPASSWORD=#{password} PGUSER=#{user} PGDATABASE=#{database} psql -h 127.0.0.1 -d postgres -c '\\q'"
+    run_shell("cd /tmp; su #{shellescape('postgres')} -c #{shellescape(psql_cmd)}",
+              acceptable_exit_codes: [0])
+  end
+end
diff --git a/spec/classes/lib/python_spec.rb b/spec/classes/lib/python_spec.rb
index 86093bc7e0..64e426ca39 100644
--- a/spec/classes/lib/python_spec.rb
+++ b/spec/classes/lib/python_spec.rb
@@ -30,7 +30,18 @@
 
     it {
       expect(subject).to contain_package('python-psycopg2').with(
-        name: 'python-psycopg2',
+        name: 'python3-psycopg2',
+        ensure: 'present',
+      )
+    }
+  end
+
+  describe 'on debian 12' do
+    include_examples 'Debian 12'
+
+    it {
+      expect(subject).to contain_package('python-psycopg2').with(
+        name: 'python3-psycopg2',
         ensure: 'present',
       )
     }
diff --git a/spec/spec_helper_local.rb b/spec/spec_helper_local.rb
index c9603be72a..930b943217 100644
--- a/spec/spec_helper_local.rb
+++ b/spec/spec_helper_local.rb
@@ -184,6 +184,10 @@ def param(type, title, param)
   let(:facts) { on_supported_os['debian-11-x86_64'] }
 end
 
+shared_context 'Debian 12' do
+  let(:facts) { on_supported_os['debian-12-x86_64'] }
+end
+
 shared_context 'Ubuntu 18.04' do
   let(:facts) { on_supported_os['ubuntu-18.04-x86_64'] }
 end
diff --git a/types/pg_password_encryption.pp b/types/pg_password_encryption.pp
index b2b5be66e5..7512174a89 100644
--- a/types/pg_password_encryption.pp
+++ b/types/pg_password_encryption.pp
@@ -1,2 +1,4 @@
 # @summary the supported password_encryption
+# Note that this Enum is also defined in:
+# lib/puppet/functions/postgresql/postgresql_password.rb
 type Postgresql::Pg_password_encryption = Enum['md5', 'scram-sha-256']