diff --git a/CHANGELOG.md b/CHANGELOG.md
index 972567033..80d31660a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,12 @@
 
 -->
 
+# Relase 5.25 R2
+
+## Release notes
+
+* Changed: disabled the MLS by default in 5.25-R1 and release it as 5.25R2
+
 # Relase 5.25 R1
 
 ## Release notes
diff --git a/ansible/inventory/demo/host.yml b/ansible/inventory/demo/host.yml
index e98fc4d30..52ec5adbc 100644
--- a/ansible/inventory/demo/host.yml
+++ b/ansible/inventory/demo/host.yml
@@ -18,7 +18,7 @@ wiab:
     wire_ip: ""
 
     # artifact_hash
-    artifact_hash: "2dd562a37d449eb88eb1f77dcad5c9153987af5f"
+    artifact_hash: "dbdb1499977619f7aa7d24c13759a64143e4afb5"
   
     # docker vars
     docker_ce_version: "5:28.1.1-1~ubuntu.24.04~noble"
diff --git a/ansible/inventory/demo/wiab-staging.yml b/ansible/inventory/demo/wiab-staging.yml
index 66f2d97be..b4de82f81 100644
--- a/ansible/inventory/demo/wiab-staging.yml
+++ b/ansible/inventory/demo/wiab-staging.yml
@@ -6,6 +6,6 @@ wiab-staging:
       ansible_user: 'demo'
       ansible_ssh_private_key_file: "~/.ssh/id_ed25519"
   vars:
-    artifact_hash: 2dd562a37d449eb88eb1f77dcad5c9153987af5f
+    artifact_hash: dbdb1499977619f7aa7d24c13759a64143e4afb5
     # when enabled, disable WAN SNAT/masquerading for VMs on the private network
     private_deployment: true
diff --git a/changelog.d/2-wire-builds/5.25-mls-disabled b/changelog.d/2-wire-builds/5.25-mls-disabled
new file mode 100644
index 000000000..a2e6ea948
--- /dev/null
+++ b/changelog.d/2-wire-builds/5.25-mls-disabled
@@ -0,0 +1 @@
+Fixed: disabled the MLS by default for 5.25-R1
diff --git a/values/wire-server/demo-values.example.yaml b/values/wire-server/demo-values.example.yaml
index f12567827..83311ae5f 100644
--- a/values/wire-server/demo-values.example.yaml
+++ b/values/wire-server/demo-values.example.yaml
@@ -55,7 +55,7 @@ brig:
       teamMemberWelcome: https://wire.example.com/download # change this
     enableFederation: false # Keep false unless federation is explicitly configured
     optSettings:
-      setEnableMLS: true # Enable for MLS protocol use
+      setEnableMLS: false # Enable for MLS protocol use
       setFederationDomain: example.com # change this per host deployment
       # Sync the domain with the 'host' variable in the sftd chart
       # Comment the next line (by adding '#' before it) if conference calling is not used
@@ -199,7 +199,7 @@ galley:
             status: disabled
             config:
               protocolToggleUsers: []
-              defaultProtocol: mls
+              defaultProtocol: proteus
               allowedCipherSuites: [2]
               defaultCipherSuite: 2
               supportedProtocols: [proteus, mls]
diff --git a/values/wire-server/prod-values.example.yaml b/values/wire-server/prod-values.example.yaml
index 31932fbe5..3c097f0ae 100644
--- a/values/wire-server/prod-values.example.yaml
+++ b/values/wire-server/prod-values.example.yaml
@@ -55,7 +55,7 @@ brig:
       teamMemberWelcome: https://wire.example.com/download # change this
     enableFederation: false # Keep false unless federation is explicitly configured
     optSettings:
-      setEnableMLS: true # Enable for MLS protocol use
+      setEnableMLS: false # Enable for MLS protocol use
       setFederationDomain: example.com # change this per host deployment
       # Sync the domain with the 'host' variable in the sftd chart
       # Comment the next line (by adding '#' before it) if conference calling is not used
@@ -199,7 +199,7 @@ galley:
             status: disabled
             config:
               protocolToggleUsers: []
-              defaultProtocol: mls
+              defaultProtocol: proteus
               allowedCipherSuites: [2]
               defaultCipherSuite: 2
               supportedProtocols: [proteus, mls]