diff --git a/.mergify.yml b/.mergify.yml
index f44b0439484b..ac8644c7ba1a 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -381,3 +381,16 @@ pull_request_rules:
         labels:
           - "backport"
         title: "[{{ destination_branch }}](backport #{{ number }}) {{ title }}"
+  - name: backport patches to 8.17 branch
+    conditions:
+      - merged
+      - label=backport-8.17
+    actions:
+      backport:
+        assignees:
+          - "{{ author }}"
+        branches:
+          - "8.17"
+        labels:
+          - "backport"
+        title: "[{{ destination_branch }}](backport #{{ number }}) {{ title }}"
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 9d2b177ab9fb..e09dc023e1d9 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -16,6 +16,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Beats will rate limit the logs about errors when indexing events on Elasticsearch, logging a summary every 10s. The logs sent to the event log is unchanged. {issue}40157[40157]
 - Drop support for Debian 10 and upgrade statically linked glibc from 2.28 to 2.31 {pull}41402[41402]
 - Fix metrics not being ingested, due to "Limit of total fields [10000] has been exceeded while adding new fields [...]". The total fields limit has been increased to 12500. No significant performance impact on Elasticsearch is anticipated. {pull}41640[41640]
+- Set default kafka version to 2.1.0 in kafka output and filebeat. {pull}41662[41662]
 
 *Auditbeat*
 
diff --git a/dev-tools/packaging/templates/ironbank/metricbeat/Dockerfile b/dev-tools/packaging/templates/ironbank/metricbeat/Dockerfile
index 54394e24b1d4..cee8fe1fe6fa 100644
--- a/dev-tools/packaging/templates/ironbank/metricbeat/Dockerfile
+++ b/dev-tools/packaging/templates/ironbank/metricbeat/Dockerfile
@@ -4,7 +4,7 @@
 ################################################################################
 ARG BASE_REGISTRY=registry1.dsop.io
 ARG BASE_IMAGE=redhat/ubi/ubi9
-ARG BASE_TAG=9.4
+ARG BASE_TAG=9.5
 
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as builder
 
diff --git a/filebeat/docs/inputs/input-kafka.asciidoc b/filebeat/docs/inputs/input-kafka.asciidoc
index 69e39afa0ff7..360218bb74b0 100644
--- a/filebeat/docs/inputs/input-kafka.asciidoc
+++ b/filebeat/docs/inputs/input-kafka.asciidoc
@@ -89,7 +89,7 @@ The Kafka client id (optional).
 [float]
 ===== `version`
 
-The version of the Kafka protocol to use (defaults to `"1.0.0"`). When using Kafka 4.0 and newer, the version must be set to at least `"2.1.0"`.
+The version of the Kafka protocol to use (defaults to `"2.1.0"`). When using Kafka 4.0 and newer, the version must be set to at least `"2.1.0"`.
 
 [float]
 ===== `initial_offset`
diff --git a/filebeat/input/kafka/config.go b/filebeat/input/kafka/config.go
index 107d765344ba..9d085af27d2e 100644
--- a/filebeat/input/kafka/config.go
+++ b/filebeat/input/kafka/config.go
@@ -110,7 +110,7 @@ var (
 // were chosen to match sarama's defaults.
 func defaultConfig() kafkaInputConfig {
 	return kafkaInputConfig{
-		Version:        kafka.Version("1.0.0"),
+		Version:        kafka.Version("2.1.0"),
 		InitialOffset:  initialOffsetOldest,
 		ClientID:       "filebeat",
 		ConnectBackoff: 30 * time.Second,
diff --git a/libbeat/outputs/kafka/config.go b/libbeat/outputs/kafka/config.go
index c7dc74ee9934..4bdd63d59c50 100644
--- a/libbeat/outputs/kafka/config.go
+++ b/libbeat/outputs/kafka/config.go
@@ -136,7 +136,7 @@ func defaultConfig() kafkaConfig {
 		BrokerTimeout:    10 * time.Second,
 		Compression:      "gzip",
 		CompressionLevel: 4,
-		Version:          kafka.Version("1.0.0"),
+		Version:          kafka.Version("2.1.0"),
 		MaxRetries:       3,
 		Headers:          nil,
 		Backoff: backoffConfig{
diff --git a/libbeat/outputs/kafka/docs/kafka.asciidoc b/libbeat/outputs/kafka/docs/kafka.asciidoc
index 286b894e584d..383b724d4042 100644
--- a/libbeat/outputs/kafka/docs/kafka.asciidoc
+++ b/libbeat/outputs/kafka/docs/kafka.asciidoc
@@ -69,7 +69,7 @@ The cluster metadata contain the actual Kafka brokers events are published to.
 
 ===== `version`
 
-Kafka protocol version that {beatname_uc} will request when connecting. Defaults to 1.0.0. When using Kafka 4.0 and newer, the version must be set to at least `"2.1.0"`
+Kafka protocol version that {beatname_uc} will request when connecting. Defaults to 2.1.0. When using Kafka 4.0 and newer, the version must be set to at least `"2.1.0"`
 
 Valid values are all kafka releases in between `0.8.2.0` and `2.6.0`.